35ed6dc1c99b8faec9a6ca1fdfbc2f7eb68eb655afc74ccf01ddce406f22cf11

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 20:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-27_1d0d6ef0647f5f8fdce491724d494274_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.1MB
Sample260928-y79cmsty7j
SHA256 35ed6dc1c99b8faec9a6ca1fdfbc2f7eb68eb655afc74ccf01ddce406f22cf11
MD5 1d0d6ef0647f5f8fdce491724d494274
SHA1 ea0c3972dd3dc8faea64b21e1e58a908f0bc59b1
SHA512 633b174c1f2c8d2f83576b065e8e670577dcc017c2afb1b40bb597b2f6999ae811c4584c5d38a55645cd7772d18af8ac290e153a70e69a967195b12b23751fd8
SSDEEP 98304:N0nAAYEpJtXh9QA91pH2WpjHrgBFFu416AWvB:yNztDQmHpn6F44IAWvB
TLSH
T174766CA5A2A760FDE4AFD075892AC732E6717C130031970F16BCDA563F636286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3480	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-27_1d0d6ef0647f5f8fdce491724d494274_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3480	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 3480	4612	2026-09-27_1d0d6ef0647f5f8fdce491724d494274_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-27_1d0d6ef0647f5f8fdce491724d494274_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-27_1d0d6ef0647f5f8fdce491724d494274_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX6E52.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX6E52.tmp
Size 1.1MB
SHA256 84acadcb9843ef89faef29e1d1d3dd5bcba51560a28c1ab797eeb8dde1a09f3b
MD5 1bde489d876af8dd45bdb3aa1ffa2105
SHA1 05a614af66e5b9ad21428d62fd3bffadac4a7ffa
SHA512 ced3ed820b425858a598e577492fb652c52cdcf75aa474642e3f5ac96a1f809301e4367da42038c3c964dc249efacb848dc6e4af99ad19de01ffa913d6a09363
SSDEEP 24576:97VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOHt+YA+wjP:W6F0eMpAAYEhpEtXhwD
TLSH
T18B455C64E783C4F5FD2314F0444BEBFBA5309E1A40318D67FBC8EE11BAB2E526529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.0MB
SHA256 6effa6d8cb8962edfa9252f749ed12305cb70897a6bb4fafd8c1a9f24403d217
MD5 582145a978a3dc9c2ccabdfd402b58c6
SHA1 565f29eb64aad6f6889a2351d8d73489f39e268f
SHA512 ef9586f2df1310481f2fc9a566e3371731159d773206f8ecec82891abd1362e3810547b81fb6887e623e3e553d105cf006b7ff4b7dbc6551f2b5037a645eca22
SSDEEP 49152:ib6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpKtpVUoNwyp21INm1T:sA91pH2WpjHrgBFFu416AWvc
TLSH
T13A564BA562A720FDE0AFE179893AC732E6B17C530131530F167CD6562FA36286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 2b3a2c08451773a6f337f8ebc982d5a0ea0722e1d9f0f52f6cdf821ddbe75274
MD5 61ef3e4a15974e65e1ff68b6b2334be1
SHA1 c7244731baf0e0bf959b89fe701a40ce9c355ad8
SHA512 7bed8dacee44f3023be76c1197eacbac9ed8ab2eb60886ad5f149d129c8c69ce80e42cd3c6ce18ff8405ef72083300b58aa7af2695ab51890cbfbd374a90dd00
SSDEEP 24576:h7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOut+YA+wKX:y6F0eMpAAYEhpJtXhwk
TLSH
T199455C64E783C4F5ED2314F0444BEBFBA5309E1A40318D67FBC8EE11BAB2E523529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 4a343deaca783a30ff8e23814db90163b2f208bdd7f0727ad46b31d87a073bb7
MD5 ef9542869301426a1a2b9f1e3a3d943f
SHA1 a4775eb52621a545a3b96179ac87831178824547
SHA512 c64da6bd241e63942642c7049f2eb1599379529135ca6d367c61f442538297cef756bee184c6b0ec8dfdaadf8fbd8a3d3fe7cff15ff305a273b801dd09cb4318
SSDEEP 24576:p7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOkt+YA+weu:a6F0eMpAAYEhprtXhwh
TLSH
T1E4455C64E783C4F5ED2314F0444BEBFBA5309E1A40318D67FBC8EE11BAB2E527529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4612-154-0x0000000000400000-0x000000000052B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads