40293b4a814d0fa871a957fca55092af30a02dab8ed51e39d38da9f34ed9ecf3

General

Target
2026-10-08_062f941a824d4407e25c22458e5798c6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 7.7MB
Sample261009-1tpgesfs2w
SHA256 40293b4a814d0fa871a957fca55092af30a02dab8ed51e39d38da9f34ed9ecf3
MD5 062f941a824d4407e25c22458e5798c6
SHA1 c1b391d70d9de1ebffdc2aa2b4a90f8e25a1df95
SHA512 a706b688fc5884fa6d090dda14b9caf8d05cf1bbae3baa553902978db586d489e6fb267b34ea0157be097d4331c735f1059e35f2bb81a67c5736e8b4c0f12446
SSDEEP 98304:g0nAAYEpxnj+hkQA91pH2WpjHrgBFFu416AWv3:dNznjRQmHpn6F44IAWv3
TLSH
T194865BA166A7A0FCE46ED075DB2A8775E6723C274071830B12BDFA163F736142D29723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4852	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	original_temp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	original_temp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-08_062f941a824d4407e25c22458e5798c6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4852	original_temp.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 4852	1788	2026-10-08_062f941a824d4407e25c22458e5798c6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-08_062f941a824d4407e25c22458e5798c6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-08_062f941a824d4407e25c22458e5798c6_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of SetWindowsHookEx
  PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCXAB0D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXAB0D.tmp
Size 1.5MB
SHA256 5b07de3f5b4d96a2f29a396e3ec58fa678a7b0dec981f97b2c1a12745567e3ed
MD5 de2454e80873fab89255d56123165660
SHA1 9531ffbc49379a57c84f5c08cae7f49116bea710
SHA512 f74cd0a3aab30b55a1fa0aaf409449b3219d9ba4476af19f16863dc834e9fea755e54987c4fae265ffea55ab188946d85032535910557efa0bd3058d3324dca6
SSDEEP 24576:X7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOmnv4S1YA+w8z:86F0eMpAAYEhpnnQS+hwe
TLSH
T11C656CD4EF83B4F5E85308F1310BE7BF9523AE2580228D67FA87FF11B9729522529116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 6.0MB
SHA256 6effa6d8cb8962edfa9252f749ed12305cb70897a6bb4fafd8c1a9f24403d217
MD5 582145a978a3dc9c2ccabdfd402b58c6
SHA1 565f29eb64aad6f6889a2351d8d73489f39e268f
SHA512 ef9586f2df1310481f2fc9a566e3371731159d773206f8ecec82891abd1362e3810547b81fb6887e623e3e553d105cf006b7ff4b7dbc6551f2b5037a645eca22
SSDEEP 49152:ib6LgA97HrsdochZVNhcOgs0F2oHN8kVpiux7TLbT+sMPHpKtpVUoNwyp21INm1T:sA91pH2WpjHrgBFFu416AWvc
TLSH
T13A564BA562A720FDE0AFE179893AC732E6B17C530131530F167CD6562FA36286D29733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.7MB
SHA256 07557c931c7134b84616599227c40bd1836e30d567014399d61228dd81c7e2a8
MD5 c61b9008ca49178c0436808d9b11f099
SHA1 0ef9e4f61ae9c63eae3fb235667ceb10636c3ab1
SHA512 c7082766c25aacf7b688ddd9695c9e52c8d237142c7bccd3dc2d595d8914924128aed06b37361b2210d7e9e664400896cf44ab5d9505c1a96ea9e980dbb8e079
SSDEEP 24576:i7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOQnv4S1YA+wNv:x6F0eMpAAYEhpxnQS+hwp
TLSH
T12185B4F6BA43E4F1D81A18B0EF0A9FFE51625D7DC0D28B1B96CAFE20BB315513496109
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.7MB
SHA256 d21d4ae2ad0573394bb2bcf377fdc80f2c2f6312d828ba69625ce01ee49f8165
MD5 f721a745e1a837fe5b7b64f9af58b370
SHA1 c03fc6e3a55461845a24c467ad89fc6f54c974ad
SHA512 e89f957832cf1d88d7952287419591047180d16057a4002f1da5a0aaa7562425f8ffccf0eb59a4f6892b4ef90c8bc597c467d2075e1622a59b531afa96034813
SSDEEP 24576:r7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOknv4S1YA+wZG:o6F0eMpAAYEhp1nQS+hw0
TLSH
T13F85B4F6BA43E4F1D81A18B0EF0A9FFE51625D7DC0D28B1B96CAFE20BB315513496109
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.7MB
SHA256 28e5db60f289185933fd93f2e6fa68010f00fa84156be3d4b32d119802b0e516
MD5 f814ebd7a5b289e2f63d7454fc8826a9
SHA1 6c6908bf30bff7ff210c27ac68cb307e6b15968b
SHA512 9e338026e8c18ae3f54f0ec4ce0f04eab98f848d31b359f8200721b5e0eb9bd621fa5e18c3ebc88e9058853d5871b1ca4cc208301151ff8d9e395daddd946df1
SSDEEP 24576:X7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOsnv4S1YA+w9F:86F0eMpAAYEhpBnQS+hw3
TLSH
T1F685B4F6BA43E4F1D81A18B0EF0A9FFE51625D7DC0D28B1B96CAFE20BB315513496109
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.5MB
SHA256 8779438bf96f85759a0e5a794a27190d0e713e7356fbd29a3a6eee3c2554fb07
MD5 f8783ee162b18bb9c9834faa83d6a158
SHA1 5480b463101b278644d6b96bf2c7fb9a321c6446
SHA512 e9a009fa0e5fefa4cdcad28b6547baebb4b2677bbb7bfd3f55aba547c18565fa09a2057dae238cbcafe25385419ed571c4763e1a391fc2160477d130b9afbf0e
SSDEEP 24576:+7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOmnv4S1YA+wN7:16F0eMpAAYEhprnQS+hwF
TLSH
T13F656CD5EF83B4F5E85308F1310BE7BF9523AE2580228D67FA87FF11B9729522529112
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1788-168-0x0000000000400000-0x00000000005C5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads