0b867b118e25df83c3d68b4db3b6721f0b1904e8a53a50f4c9986b509ce4ba1e

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_580e151164d1c5e72df54d082f1596d2_elex_glassworm_icedid_njrat_vidar.exe
Size 7.8MB
Sample261002-rl2mcaz17p
SHA256 0b867b118e25df83c3d68b4db3b6721f0b1904e8a53a50f4c9986b509ce4ba1e
MD5 580e151164d1c5e72df54d082f1596d2
SHA1 04595d062df0ccdb60797a6b7a68be3fd0f0d0a1
SHA512 38ef8685973672d85409b6c8be03b1e901fc4a464ad91c1ccf377a388c3ba4dacdf535e13728268c13c07f6a1726e019bf8bca9e098747a6e9a9aa243e89db93
SSDEEP 98304:j0nAAYEpaha1MbQ9yDAD7KjjqkusjmqMho:gNj1tIDewjqkjiqMi
TLSH
T1F4867D399BB4C1E5F9ABD878A97BC672FA717A110833530B89E0C61EAF335525D18331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	original_temp.exe

Executes dropped EXE 1 IoCs

pid	Process
2864	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_580e151164d1c5e72df54d082f1596d2_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2864	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 2864	4240	2026-10-01_580e151164d1c5e72df54d082f1596d2_elex_glassworm_icedid_njrat_vidar.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-01_580e151164d1c5e72df54d082f1596d2_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_580e151164d1c5e72df54d082f1596d2_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX7A7B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX7A7B.tmp
Size 1.2MB
SHA256 a794a70df32f6abe3e930a1bd0171c33cdd69f7139228ea722c67bb719e530ca
MD5 9763e817f5e53a5067b80d7b1e59aa1e
SHA1 d2ddee58f9342fd756b9ccb068be527216895180
SHA512 e81bbfa4441f3274a6e992042d6aa2b63eddb4b26d88f5801ea9f772380b7e7289905fe1ebb300aee6ca0771e93e751264cbd58178e7e2eb5add335c58919556
SSDEEP 24576:n7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsObYA+w4:s6F0eMpAAYEhpnhw
TLSH
T12A455B54E68384F1E93310F0465BE7FBA6349E164032CD6BEBC8FE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.6MB
SHA256 ea4553f17792800d7785ae88c866604c80d7efc84a33fafe11eecda4fc1530d5
MD5 338fed50e83457f88770ac0598f5dd9c
SHA1 3bb38ed9ebf29692a4d8198a17c8268b359a0e1d
SHA512 72b274077235061c8a1d9c7c15c6997cf3c5b15478aeedb9b16756e9314a058ace3d41e05888939b90c0887e1f2e28065eed86f55f560a70a036a2f426ec8bd5
SSDEEP 49152:yozMlTzQ/7YGsTj1VrXcp0AUkQ0j9CmJrwK6HG7ZWbD72Hv1wOhLnis2b+9tAs8a:y1MbQ9yDAD7KjjqkusjmqMh
TLSH
T16D665B39ABB4C1E5F9ABD83CA97B8671FA727A510833530B89E1C21E6F335524D19331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.1MB
SHA256 aa7bc57af192aeea017471723712d280735e12700e6e19442037449359ee945e
MD5 f8efecaebbfc3c56b17bac3957fca1e1
SHA1 6a75193ad06a47a9008a597230c96650128767a3
SHA512 f55300330aaadda28ccf3988e40101092416e6cff9127174a49785cfec1ac510d9a522b1089b11175320c1b5cc9e950d8cffcb34493dc7a556763a3e11cead32
SSDEEP 24576:G7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOgYA+w9:96F0eMpAAYEhpyhw
TLSH
T1CD455B54E68384F1E93310F0465BE7FBA6349E164032CD6BEBC8FE01BAB2D527529716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 7.8MB
SHA256 0b867b118e25df83c3d68b4db3b6721f0b1904e8a53a50f4c9986b509ce4ba1e
MD5 580e151164d1c5e72df54d082f1596d2
SHA1 04595d062df0ccdb60797a6b7a68be3fd0f0d0a1
SHA512 38ef8685973672d85409b6c8be03b1e901fc4a464ad91c1ccf377a388c3ba4dacdf535e13728268c13c07f6a1726e019bf8bca9e098747a6e9a9aa243e89db93
SSDEEP 98304:j0nAAYEpaha1MbQ9yDAD7KjjqkusjmqMho:gNj1tIDewjqkjiqMi
TLSH
T1F4867D399BB4C1E5F9ABD878A97BC672FA717A110833530B89E0C61EAF335525D18331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4240-262-0x0000000000400000-0x0000000000535000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads