f981e672c4a7f23c70ab009fa3330d53e74a3c7ffeefd6eebfbae1c9aac766c2

General

Target
2026-09-10_65fe7db9f4cded5c8ac33ddfcccdb7c2_elex_glassworm_icedid_njrat_vidar.exe
Size 7.8MB
Sample260910-tfdpfat1c1
SHA256 f981e672c4a7f23c70ab009fa3330d53e74a3c7ffeefd6eebfbae1c9aac766c2
MD5 65fe7db9f4cded5c8ac33ddfcccdb7c2
SHA1 27a5d0f78d1349cb7b59e2cdac9f227de90a9e29
SHA512 30a64d6b286087cae9310c0617c9f567ae755d1ee58b0798ea06c45f4af153b29d5c763e1b0483a5a55574005c5c1c054a89b15e267c8be0cdca14a7e934ed5d
SSDEEP 98304:z0nAAYEp5hUu1MbQ9yDAD7KjjqkusjmqMhM:QNuu1tIDewjqkjiqMO
TLSH
T162867D39ABA4C1E5F9ABD878A97BC672FA717E110833530B89D1C61EAF335524D18331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1188	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_65fe7db9f4cded5c8ac33ddfcccdb7c2_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1188	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4160 wrote to memory of 1188	4160	2026-09-10_65fe7db9f4cded5c8ac33ddfcccdb7c2_elex_glassworm_icedid_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-10_65fe7db9f4cded5c8ac33ddfcccdb7c2_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_65fe7db9f4cded5c8ac33ddfcccdb7c2_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4160
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
Size 1.6MB
SHA256 ba3d3f52a9002cf9e54c110396a5129c22434fe199148b6225dbe70aea6bd8c1
MD5 e4f82e2e8f0e06fd1f6d4a2b4ac29e5e
SHA1 cbe5dbd11c24c44a31964f5f47e5a9de076f9499
SHA512 f490fa484e61de3684c4b3e439951c3e865b652bf5c0d42356f506d98b8a11bf72431e5f8801472f7c55d2b31e530cb59be6eb764ef779561f39c0a9983ab30b
SSDEEP 24576:+7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOTYA+wjYnMYenGJiKEbXWtj:16F0eMpAAYEhpfhwMMPnRWt4W
TLSH
T11B758E65E783C0F1E92300F1550BE7BAA934AE1940318C6BFBC4FF15BA72D52767A246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX48A8.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX48A8.tmp
Size 1.2MB
SHA256 703adc434a693ad2ae74b25f4250cfdb873ed3cd9b10e939bb1d0ec75d938672
MD5 46135a152aa3064ef9cf3b472a3cf835
SHA1 d1ffec19cef7e62b4a02c7f0bafaff2c97409b8a
SHA512 7341abe4301e6bb529f2754e26d97c8c9e25633dbdb58eacc9521ed7ff20e9ebe3eca1fced883abdb43c82e6c00bc833d8a4f4db8f9bf1cff8616a545a0707e6
SSDEEP 24576:L7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOOGAYA+wjy:I6F0eMpAAYEhpvUhwG
TLSH
T1F6455B94E687C4F1ED2310F0454BEBFBA5309E2940318D6BFBC8FF11BAB2D522529656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.6MB
SHA256 ea4553f17792800d7785ae88c866604c80d7efc84a33fafe11eecda4fc1530d5
MD5 338fed50e83457f88770ac0598f5dd9c
SHA1 3bb38ed9ebf29692a4d8198a17c8268b359a0e1d
SHA512 72b274077235061c8a1d9c7c15c6997cf3c5b15478aeedb9b16756e9314a058ace3d41e05888939b90c0887e1f2e28065eed86f55f560a70a036a2f426ec8bd5
SSDEEP 49152:yozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAs8a:y1MbQ9yDAD7KjjqkusjmqMh
TLSH
T16D665B39ABB4C1E5F9ABD83CA97B8671FA727A510833530B89E1C21E6F335524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 eb4634871f36a98d62c1deefaa1e5dcd52401483a6b3676a1646c03fd3d0d379
MD5 993d25d640e77a997148745802adf86c
SHA1 06e4be707ddaf69ef0b18ff40d671b05a0bebac2
SHA512 ba54c6637f25e98c7d039e4d6d42c5755b3ba75e72a39a720dab68bf43b67624d258697adbafd9e652978bbc85f4664d313aba45f52b4609a1f48fdfb5bbc12c
SSDEEP 24576:z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOVGAYA+wy2:Q6F0eMpAAYEhpkUhwp
TLSH
T126455B94E687C4F1ED2310F0454BEBFBA5309E2940318D6BFBC8FF11BAB2D522529656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 93dd8daee0e24851cdf1d4bcdf634969a6b7d5b1c5b846d46bc6fb6ca16fb4b3
MD5 52d8f65fef360dc6abdd01f493abf5b6
SHA1 f0ced0ef7281da4a981ca0cfa1974bf48ff2ed56
SHA512 1f6c8685512646ca1173be8443736dcda2a82867bed651ce3b42a4eaf62074fbe8bdb7bb61e13f1fe0ccee3491a5cf55a712c91a361ee29a9010314db590c82f
SSDEEP 24576:/7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOeGAYA+wK3:E6F0eMpAAYEhp/UhwE
TLSH
T1D4455B94E687C4F1ED2310F0454BEBFBA5309E2940318D6BFBC8FF11BAB2D522529656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4160-152-0x0000000000400000-0x0000000000535000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads