43794bec208e3ddb8cbda02ac88efad3f19012da481bac95096ae639c9cfe7eb

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-19_1ff355a7236cec20617caa54ff0332fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.2MB
Sample260919-ft6eqabf47
SHA256 43794bec208e3ddb8cbda02ac88efad3f19012da481bac95096ae639c9cfe7eb
MD5 1ff355a7236cec20617caa54ff0332fd
SHA1 2fc2544986882660eff8a27e9623fbfce98f88a9
SHA512 c1c376325a63a60b8f27ac382c5f545d651e4ceeb788bca61f31df424418e8a78ec669eff4e94950fa2e855cb5332f4112a1b5173c483158880593232bb9adb4
SSDEEP 98304:B0nAAYEp2MchSQA91pH2WpjHrgBFFu416AWvN:WNpNQmHpn6F44IAWvN
TLSH
T101765BA5A6E760FDE0AFD0B5896AC732E6717C130031530F16BCDA562F736286D29723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4364	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-19_1ff355a7236cec20617caa54ff0332fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4364	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 4364	1996	2026-09-19_1ff355a7236cec20617caa54ff0332fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-09-19_1ff355a7236cec20617caa54ff0332fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-19_1ff355a7236cec20617caa54ff0332fd_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.0MB
SHA256 6effa6d8cb8962edfa9252f749ed12305cb70897a6bb4fafd8c1a9f24403d217
MD5 582145a978a3dc9c2ccabdfd402b58c6
SHA1 565f29eb64aad6f6889a2351d8d73489f39e268f
SHA512 ef9586f2df1310481f2fc9a566e3371731159d773206f8ecec82891abd1362e3810547b81fb6887e623e3e553d105cf006b7ff4b7dbc6551f2b5037a645eca22
SSDEEP 49152:ib6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpKtpVUoNwyp21INm1T:sA91pH2WpjHrgBFFu416AWvc
TLSH
T13A564BA562A720FDE0AFE179893AC732E6B17C530131530F167CD6562FA36286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 d2bff877bad4d672c14c46dd1846fab07d8fd97839125c1d5553ffd2f0e80cb0
MD5 3c8fca4d606134516a79d09353030d67
SHA1 fdad6b38a77a8099170421256862d43479df8824
SHA512 1e348772aab3f2e3b782c36f38f763f20d7ef8e7f9e034a9f7307c5cc1d75fefe3adc99508c6b03ee1ac0ca26c9212561d83e1050c6a9a0c6c19b5f2a3c18af3
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOjMzYA+wPj:+6F0eMpAAYEhp2Mchwb
TLSH
T1EE455C98EEC394F1E92314F044CFE7FA99309E1740318D6FEEC9EE11B972D226529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 c1757ecaf5f52c331be4ff39fc224b712f20dcca3edc5d4a84d0065dba799141
MD5 6a8db304e33601efb563d345ff192f45
SHA1 aeee3264af719f6ef0d1aad01fea58f494e7cce2
SHA512 55e3ee5b39fa83411c18b57a4f24c03a1b0fa4f231aa893aa0098d1e3057e97e7d72cefc224c19fc457e5a6a2821e976be9d80edc6bbc099e47e2354b9671b21
SSDEEP 24576:d7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOeMzYA+wmD:26F0eMpAAYEhpbMchwI
TLSH
T10A455C98EEC394F1E92314F044CFE7FA59309E1740318D6FEEC9EE12B972D226529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 1e192e7cafb29e24e23f1f4f302d6bcc3f5eab5c2a860f61b9439ebf8f96020a
MD5 373dd2a14b9320c097a31968e62fdb65
SHA1 7408dd271385dde76a377b7596b6061503419f77
SHA512 dd8d834b3a7c81bd32f87922e7350423d123c8b6fe4f8eeba6a2980c757bac3388d02b4ce601532485bdcec6f80d10885fc17392644e622303cae07130d4db27
SSDEEP 24576:F7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOgMzYA+wiy:+6F0eMpAAYEhppMchwt
TLSH
T1C2455C98EEC394F1E92314F044CFE7FA99309E1740318D6FEEC9EE11B972D226529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1996-153-0x0000000000400000-0x0000000000542000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads