031f3ffde1147ff8d6172051529c2ee59e6454ea0eecb38ad78e7dbf9e3eb85b

General

Target
2026-09-07_5b0960efed6fd34ac9cf2199a40449c3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.2MB
Sample260909-bb2llazfne
SHA256 031f3ffde1147ff8d6172051529c2ee59e6454ea0eecb38ad78e7dbf9e3eb85b
MD5 5b0960efed6fd34ac9cf2199a40449c3
SHA1 491033aa956a9ed816f56c202c2fffefdf594185
SHA512 66cf637d8b9f0282751691b878dbceeea8e6d87e52fa5bed34579af33d41018b87aeb68f4d15f7010d0c8c4ab46aa7daae88add2a7d5ba432b9ed4c7be3d777e
SSDEEP 98304:a0nAAYEp4hoQA91pH2WpjHrgBFFu416AWvB:vNlQmHpn6F44IAWvB
TLSH
T185765BA5A6A760FDE0AFE075892BD732E6717C130031570F16BCEA562F736182D29723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1352	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_5b0960efed6fd34ac9cf2199a40449c3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1352	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 1352	3300	2026-09-07_5b0960efed6fd34ac9cf2199a40449c3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-07_5b0960efed6fd34ac9cf2199a40449c3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_5b0960efed6fd34ac9cf2199a40449c3_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXE1CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXE1CE.tmp
Size 1.2MB
SHA256 c5a204524165949cf10452d40316175015de1c5582acf7be36debde4f3071cbe
MD5 322684012334ffbe0ba5a85cd95d01d5
SHA1 a7604bc82d07580cc68dadfc0abd8a573f96c2bd
SHA512 7f06dec18fadcf7759b4016332c581818b84869a62b883ac7d9c7588959ca13ea060104924faf243c645409fd9eb5c30938e703734acd4ad30e9f35c388af5b4
SSDEEP 24576:U7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOmYA+wnF:X6F0eMpAAYEhpIhwF
TLSH
T17F454C99EE4384F2EA1FE0F0045BF7BE56359D3D40628D2FE68DFE01BB729152129606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.0MB
SHA256 6effa6d8cb8962edfa9252f749ed12305cb70897a6bb4fafd8c1a9f24403d217
MD5 582145a978a3dc9c2ccabdfd402b58c6
SHA1 565f29eb64aad6f6889a2351d8d73489f39e268f
SHA512 ef9586f2df1310481f2fc9a566e3371731159d773206f8ecec82891abd1362e3810547b81fb6887e623e3e553d105cf006b7ff4b7dbc6551f2b5037a645eca22
SSDEEP 49152:ib6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpKtpVUoNwyp21INm1T:sA91pH2WpjHrgBFFu416AWvc
TLSH
T13A564BA562A720FDE0AFE179893AC732E6B17C530131530F167CD6562FA36286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 7ad9862e08e621d6f1b07e717e77f80b0c091875cc0796278bc89cec7ae40c84
MD5 5eb97c5e828e8cedc898a8aa813bcb6e
SHA1 5e943fc95d26edaeff8a8d5607f9a938ebd2cfae
SHA512 ea448e2b16caada6108ff7ede6710c43fdf1c6cd0c486cebd7b9b985e445f67e623e719c28cb0ca535b1bf0e9b89e9daf3e738aafc8240daf9a9b43829a0c740
SSDEEP 24576:w7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOOYA+w5b:L6F0eMpAAYEhp4hw5
TLSH
T11A454C99EE4384F2EA1FE0F0045BF7BE56359D3D40628D2FE68DFE01BB729152129606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 e97f89914709cfbbee1e32d4fbd3add55eadd2ce5b4fde2df04b02f7743f5ce8
MD5 0f8b67ad3961e128c5069598086bf1bb
SHA1 59c73138452181fda7d012f28a7f437a35cbc04d
SHA512 9eda5a525e19d5df70ec426868629bf6c467b277ca6564107eed854a748bc96c9e5445fbd540ccc17abb441eb44ba6cc61266b75800a02e1e299e4d0c7e4c1f2
SSDEEP 24576:Q7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOrYA+ww1:r6F0eMpAAYEhpjhwI
TLSH
T191454C99EE4384F2EA1FE0F0045BF7BE56359D3D40628D2FE68DFE01BB729152129606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 cf4a515b325972f647fbf7cf3dcea7d2bb7eef54e9e7183ba2f32a323d80b684
MD5 87067e3281addf82bce8d627dbd021db
SHA1 ed71e11aa85c7a0360ec67b8795c3b5c3274dc5c
SHA512 c2744282880f7bc831e6db30e45a78b9d4df3879bc96c0ea253303395b5f7579c4abec15e39e2bf13b1be49af26c2895301d6ed0fdb21b8e30c4f89203aada3a
SSDEEP 24576:M7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO0YA+wu/:P6F0eMpAAYEhpmhwI
TLSH
T1FA454C99EE4384F2EA1FE0F0045BF7BE56359D3D40628D2FE68DFE01BB729152129606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 18798fec5b3b8c9c9a38bb0c6ed97d3f46dab599fabf7ef7220b9728aa07bc8f
MD5 4a1216721a83885a18730dfa854c5aa2
SHA1 1c886c5ed6373602e94c4d1febb9f405e1811321
SHA512 54b91a4277d1d2b3eff5cd29c2adc47808f000fb42f649d359f3c23f29568caa4236ce4a9567d90dcbcc99c1a8254ef5b9fbf7759906cdd0b1b4473337529ca0
SSDEEP 24576:o7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOEYA+whh:j6F0eMpAAYEhpahwv
TLSH
T163454C99EE4384F2EA1FE0F0045BF7BE56359D3D40628D2FE68DFE01BB729152129606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 7964fb5dfbf2f0b32c997e497830127c93414ac69b1d21fbfd7363c82a21b5d0
MD5 99e8e96505a89bfcab79dbb0cdcf948d
SHA1 6f230f3aa3fc1a1e567306a21a32cc65c150a0e7
SHA512 b9c61aa4e00da3bd62b31969939d172df6ab023be11a235496366d1e679aa91d6921119b2deebe4ca1a17b6b5c7b66ec650d5a94efda6d1fca83cf7f5f14d4c2
SSDEEP 24576:Y7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOdYA+wnB:z6F0eMpAAYEhpFhwB
TLSH
T1BA454C99EE4384F2EA1FE0F0045BF7BE56359D3D40628D2FE68DFE01BB729152129606
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3300-152-0x0000000000400000-0x0000000000540000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads