75bb5621ca1c405b86b2801388b384a0ceb7cba161403caca5bf38f44eddde25

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-28_71a31a29b587f335c4cfba23029698db_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.4MB
Sample260928-sapdbabd33
SHA256 75bb5621ca1c405b86b2801388b384a0ceb7cba161403caca5bf38f44eddde25
MD5 71a31a29b587f335c4cfba23029698db
SHA1 49611e94a0c371c4e1c36cf4c49c7d93c409d04d
SHA512 bcf8a4bc7638e5d8fdb37194e8713262a6f625bc41396e46f2b0a8a40f6667ac43fcacfba44ac654622e10cf2b0204b252bc1044a8fb0de2e9115951e3abb001
SSDEEP 98304:z0nAAYEpMzhGQA91pH2WpjHrgBFFu416AWva:QNqsQmHpn6F44IAWva
TLSH
T174764AA562A7A0FCE46ED075CB2A8772E6713C274071930B16BCFA563F736142D29723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1224	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-28_71a31a29b587f335c4cfba23029698db_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1224	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 1224	3076	2026-09-28_71a31a29b587f335c4cfba23029698db_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-28_71a31a29b587f335c4cfba23029698db_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_71a31a29b587f335c4cfba23029698db_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 3.5MB
SHA256 a9133c37617715b2423f5ac9c51768ee4bcaa3b1e016961a6614e74cf86b11dc
MD5 2e1f19bd3bfcdb5aeceb481f19c4c70d
SHA1 0afd1d3b6196cdc2b63b17519a990a6d71f97752
SHA512 2dc71a3b05eb0bec5806e734359eb0cfa7c2b08ed57ea644ba4f07d01902c46acaa3d5af38821ae7199151ce9e682833afc1cc514f31fd36a9503bb1b8ec62da
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOsqVWRs47WXnueVulvspdb3:w6F0eMpAAYEhpFqo37WXnu6ulvKdfLME
TLSH
T150F539E2BE92F0B1E4D20CB1390BE6BED5237C348C238997B783F72D6573651562A116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX30BC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX30BC.tmp
Size 1.1MB
SHA256 b36ae9d1e6ffe76a1973b46f769e3893985162ddc20c3db1be5afaccacaa48a8
MD5 05e268eca5edb729f8fcf4e0e43ff77c
SHA1 783310b21fcd3ff291df0f0aa1937807aafd6267
SHA512 17e9dc0e34e5533083be3134ba25a7bfa1c2710f8d18669f1c4b26edc0b0d143ee618efee3a5f62e30d38afec4225c058fe3b1aeee33bf6efcee03ef99821fdb
SSDEEP 24576:u7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO5BIYA+wpu:F6F0eMpAAYEhp2zhwM
TLSH
T134455C54E787C4F5ED2314F0444BE7FBA5309E2A80318D67FBC8EF11BAB2E522529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.0MB
SHA256 6effa6d8cb8962edfa9252f749ed12305cb70897a6bb4fafd8c1a9f24403d217
MD5 582145a978a3dc9c2ccabdfd402b58c6
SHA1 565f29eb64aad6f6889a2351d8d73489f39e268f
SHA512 ef9586f2df1310481f2fc9a566e3371731159d773206f8ecec82891abd1362e3810547b81fb6887e623e3e553d105cf006b7ff4b7dbc6551f2b5037a645eca22
SSDEEP 49152:ib6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpKtpVUoNwyp21INm1T:sA91pH2WpjHrgBFFu416AWvc
TLSH
T13A564BA562A720FDE0AFE179893AC732E6B17C530131530F167CD6562FA36286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 d6c082ba51ddd39112f15afb239b33ff89b10092372d38b581763087dff4ae5c
MD5 8d68a469adaa27bc1c7ad8d9789b52b8
SHA1 452219238fd73e5896a267b076870fc12410085b
SHA512 a04a42012e82fb25393d3b0a393a524ce11349c2c75f5daff0c4916cafa870ad79f705cc7bb88a84f87f9b51138c838e99cce0321bdbda0999b95c88588ef9a9
SSDEEP 24576:z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOfBIYA+wcq:Q6F0eMpAAYEhpMzhwX
TLSH
T1B7658076B687D4F1D81A14B0CF0AABF651605D7DC0E28B1BA6CDFE21FB7195130AA10E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 e96a25bbe86a31ef313468b90c87cb7861c9cabeaa1363191fce9e378f8d00ea
MD5 862530e5dc3a234fa58f5f5c28251748
SHA1 07157123a350ef218ad374a6dc6ed9aaa2057906
SHA512 ea55eee81b2fe80423fc64305f22947abc1f9ace8feed55df030024d8a1c6aa0800931bee876de9851f241e2578fc41bdf03ddd0dcada11b6ff58ae8e4edd626
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO4BIYA+wNZ:w6F0eMpAAYEhpDzhwL
TLSH
T120658076B687D4F1D81A14B0CF0AABF651605D7DC0E28B1BA6CDFE21FB7195130AA10E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3076-153-0x0000000000400000-0x0000000000573000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads