2d8518172af9205b4f21029fb64ce78a00d492a380f7bb86746c9a9c3dfd357b

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_61485d4dcced3017c6df85bb97991ae9_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.2MB
Sample260910-tpfv6avsdz
SHA256 2d8518172af9205b4f21029fb64ce78a00d492a380f7bb86746c9a9c3dfd357b
MD5 61485d4dcced3017c6df85bb97991ae9
SHA1 db6977060deee7f89f73019f7581ae7b047d3c54
SHA512 5d4e75f5fe471efc4d07918f484f8c0e25fa8d16c31df34c8bc1cea49ce39c1cb571d7b2d416ca8cef48e881d40b917fd680c76c6a50d494e78f7998efd92896
SSDEEP 98304:e0nAAYEpwhnQA91pH2WpjHrgBFFu416AWva:zNWQmHpn6F44IAWva
TLSH
T1F1766BA5A2A761FDE0AFD075892AC732E6717C130431934B16BCEA563F736182D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	original_temp.exe

Executes dropped EXE 1 IoCs

pid	Process
4376	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_61485d4dcced3017c6df85bb97991ae9_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4376	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 4376	1768	2026-09-10_61485d4dcced3017c6df85bb97991ae9_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-09-10_61485d4dcced3017c6df85bb97991ae9_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_61485d4dcced3017c6df85bb97991ae9_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX4E1B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX4E1B.tmp
Size 1.2MB
SHA256 0244e3c25e062d4c37c49413e6fb636841beff9931c3e52e2c3033adc76d748e
MD5 a2d929689ec54d69496e40dc0fc6f3a4
SHA1 c26b83eb49accacf5693c2712049c5d076940437
SHA512 f637a98a5f143603f88ef730186fc4ece0005c32fffeab440f8b4cca34cf6b597dea2db61114b732d821ed5e852e144230a9592d78f3c63a053d3929afc03786
SSDEEP 24576:07VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOnuYA+wJ0:36F0eMpAAYEhpIHhw6
TLSH
T1B5455C54E643CFF6E92B00F0444BE7FA55329E158C218FE7FAC8FE01B972A522569607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX509E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX509E.tmp
Size 1.2MB
SHA256 cc838a8afe16f33dcb991d65cea5185facace05a16417b697482ba7e1beaa1cc
MD5 a19de3a58f40defa4ded38dde5194867
SHA1 fd739e00af51fe2dd1cb28e72463e7e73b3146d9
SHA512 74c2e6d1ec2c4777c82b7a2c0f1b873e06f4d00a2efcbab64ebf89e3b35eb0717ccb7507fe6b825901f3b70cf342f7791ba3e1045cb28e0e14210f0b1a30f83c
SSDEEP 24576:M7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsObuYA+wIw:P6F0eMpAAYEhpoHhw9
TLSH
T101455C54E643CFF6E92B00F0444BE7FA55329E158C218FE7FAC8FE01B972A522569607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX509F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX509F.tmp
Size 1.2MB
SHA256 23e19437e3056f6e3f8da02441079d403847dd7b1ae7bc6dd70c32e6f1842fea
MD5 61bd5d2f9b5f704f9713b0fdce7a8489
SHA1 6707a849d240895356c9f4b6ab3f75d7add8d33c
SHA512 f8823b984ecbbac6e47dabfb020d1a9ca4a28ee2496da97768155a0545259d8b450d18bce0f559dc47200e9bcadb2b8d3516ffa0a44e6fb7e0fbb78d2ce407e9
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOvYA+wJ/:/6F0eMpAAYEhpbhwF
TLSH
T1A2454C54E643CFF6E92B00F0444BE7FA55329E158C218FE7FAC8FE01B972A522569607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.0MB
SHA256 6effa6d8cb8962edfa9252f749ed12305cb70897a6bb4fafd8c1a9f24403d217
MD5 582145a978a3dc9c2ccabdfd402b58c6
SHA1 565f29eb64aad6f6889a2351d8d73489f39e268f
SHA512 ef9586f2df1310481f2fc9a566e3371731159d773206f8ecec82891abd1362e3810547b81fb6887e623e3e553d105cf006b7ff4b7dbc6551f2b5037a645eca22
SSDEEP 49152:ib6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpKtpVUoNwyp21INm1T:sA91pH2WpjHrgBFFu416AWvc
TLSH
T13A564BA562A720FDE0AFE179893AC732E6B17C530131530F167CD6562FA36286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1768-263-0x0000000000400000-0x0000000000536000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads