f2ed3d14fb433603a536382224e8adb4f22a4529aa6370c4972ad39fe2234ec5

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/11/2026, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
Size 4.5MB
Sample261101-1fa2waysht
SHA256 f2ed3d14fb433603a536382224e8adb4f22a4529aa6370c4972ad39fe2234ec5
MD5 ac9c2ed1312d1edb729268086e169797
SHA1 4d12201175b07e8528466a799c67864097f12964
SHA512 d05ad3da8d54d14de21f30e07ad34867131bc5fef050e3f2904f6415a2e80c2913ba813207ee7500f599b68a0512843c4fee717838bfbf10be326e7323b15591
SSDEEP 49152:lkdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai25zYo5UC9RhuCTFKlaxV5dgbTPJI2:lH/IJsiC5sop7cTz
TLSH
T1AB264A656BF880F5E1BBD17889768AB1F77678120D31EB4F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	exeCD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	exeCD.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1504	temp0a1.exe

Executes dropped EXE 5 IoCs

pid	Process
1504	temp0a1.exe
1836	2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
3960	exeCD.exe
4284	temp0a1.exe
3864	exeCD.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jaremore = "C:\\Windows\\exeCD.exe"	temp0a1.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	temp0a1.exe
File opened (read-only)	\??\B:	temp0a1.exe
File opened (read-only)	\??\G:	temp0a1.exe
File opened (read-only)	\??\I:	temp0a1.exe
File opened (read-only)	\??\K:	temp0a1.exe
File opened (read-only)	\??\L:	temp0a1.exe
File opened (read-only)	\??\S:	temp0a1.exe
File opened (read-only)	\??\X:	temp0a1.exe
File opened (read-only)	\??\B:	temp0a1.exe
File opened (read-only)	\??\E:	temp0a1.exe
File opened (read-only)	\??\H:	temp0a1.exe
File opened (read-only)	\??\O:	temp0a1.exe
File opened (read-only)	\??\U:	temp0a1.exe
File opened (read-only)	\??\W:	temp0a1.exe
File opened (read-only)	\??\M:	temp0a1.exe
File opened (read-only)	\??\N:	temp0a1.exe
File opened (read-only)	\??\A:	temp0a1.exe
File opened (read-only)	\??\J:	temp0a1.exe
File opened (read-only)	\??\V:	temp0a1.exe
File opened (read-only)	\??\Y:	temp0a1.exe
File opened (read-only)	\??\Z:	temp0a1.exe
File opened (read-only)	\??\P:	temp0a1.exe
File opened (read-only)	\??\Q:	temp0a1.exe
File opened (read-only)	\??\R:	temp0a1.exe
File opened (read-only)	\??\T:	temp0a1.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\bb.ico	temp0a1.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	temp0a1.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\temp0a1.exe	2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\temp0a1.exe	2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\file0a0.dat	2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\exeCD.exe	temp0a1.exe
File opened for modification	C:\Windows\temp0a1.exe	exeCD.exe
File created	C:\Windows\temp0a1.exe	exeCD.exe
File opened for modification	C:\Windows\file0a0.dat	exeCD.exe
File opened for modification	C:\Windows\exeCD.exe	temp0a1.exe
File created	C:\Windows\exeCD.exe	temp0a1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	exeCD.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	exeCD.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp0a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exeCD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp0a1.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4652	2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
4652	2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
3960	exeCD.exe
3960	exeCD.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3864	exeCD.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 1504	4652	2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe	84
PID 1504 wrote to memory of 1836	1504	temp0a1.exe	85
PID 3960 wrote to memory of 4284	3960	exeCD.exe	89
PID 4284 wrote to memory of 3864	4284	temp0a1.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\temp0a1.exe
  "C:\Windows\temp0a1.exe" ejecuta
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Users\Admin\AppData\Local\Temp\2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
    C:\Users\Admin\AppData\Local\Temp\2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
    3⤵
    - Executes dropped EXE
    PID:1836

C:\Windows\exeCD.exe
C:\Windows\exeCD.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Windows\temp0a1.exe
  "C:\Windows\temp0a1.exe" ejecuta
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\exeCD.exe
    C:\Windows\exeCD.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of SetWindowsHookEx
    PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
Size 47KB
SHA256 1a85e0235f7f0f810b2b8c2b81351ab631dab5b351ffa30a49606682c8869a9c
MD5 659153659772b6da39f1be1cf49b04b4
SHA1 35f3ecd3b8a26086f86cb9c45c3b83b51fe0231d
SHA512 b33283748c23c91fb56293ad96f9228f3321601f3c92a1b030c31c0c84c0cd15aa4b7b79c516848bae5196de5d1bc4795382086414553e05b0f94448df9e72fa
SSDEEP 768:ARjxEfYgdA1INwYTYKc5z1mmB1xi19zHVMK1UJu9zC1aW:tf7wYct5z1tjkz1TQqztW
TLSH
T1F023398167AC8202E9FF1F74A5B1D9132D7DABC67830D91E1998F8851DA33C19B2077B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb.ico

Path C:\Windows\SysWOW64\bb.ico
Size 4KB
SHA256 823cbf89390733bd09d5541839786670d748064e50ff235928abd9e2433192b7
MD5 84a8ab049bb249ce1b1e25d5648571a9
SHA1 66b48c0e63f542b74a5b003af9660222c1d0f324
SHA512 8ce3b7fa9917ee0164b3a09920aaa1ec6806159aab184e3fbb15fc58134c64957811eded9ad3d459c0c1a257aee3129473136d1800f5d89bc9adc5a43a4b6c64
SSDEEP 48:z2pe4sdnY/3XXXXXXXXXXcDD3V+yD3/6k0vucpb:z6bsdnY/XXXXXXXXXXcDD3Vr/6Jvu6
TLSH
T19C91553EA718B8B0F98E6DB1236FC064505E7504151BCDA6B1A9FCB07F92CEA40143CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exeCD.exe

Path C:\Windows\exeCD.exe
Size 4.4MB
SHA256 0d78ab0f960c23659857c2735db840dcaa87572bc2799f185e7bdc67b2ca7736
MD5 cd5312de7fc55bcda2ec01304696b067
SHA1 00bf9000d05eaae7476c4c2279601439dadb7917
SHA512 f6661fd24cd05cdc912167fc750c3ccd634142ea524e79d2a956a62c890f0da51edde1ce67e109e542bcf77032b395ccdd856e68354938b8a892cf66dc4c041b
SSDEEP 49152:KdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai25zYo5UC9RhuCTFKlaxV5dgbTPJIU9:l/IJsiC5sop7cTz
TLSH
T12B264A656BF884F5E1BBD13889768AB1F77678120D31EB4F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

exeCD.exe

Path C:\Windows\exeCD.exe
Size 4.1MB
SHA256 332eee2e0c6d24704b8c805b890f48e0b21be5c041e7147258ddd3dbc2d1ec92
MD5 e31bd41b3a0214d7f38724894d9a3b14
SHA1 26cbff072d79d1da7032584ae1aea21b6a4d8ec8
SHA512 8c07ec1ca52bae412781475ed8c7996a5ef00e1f5077b8c72a03f70f019654872caef85ef13c131fce371d30b0eb947d6981aab072914c86cd72bd1e47b1baa7
SSDEEP 49152:gdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai25zYo5UC9RhuCTFKlaxV5dgbT4:L/IJsiC5sop7cT4
TLSH
T11C164B656BF880F5E1A7E134897AC9B2F77678420D31EB5F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file0a0.dat

Path C:\Windows\file0a0.dat
Size 115B
SHA256 b8048475fcca1dbb27c575da884cc2d34fbaa7fc61186dd8e13ee1f1eb9da33c
MD5 dcac4866d28b7d6c70fd3b15cc9d14ce
SHA1 010de232d3cc8de07b610abf49d9d7d5fe87559a
SHA512 faed64127f8d4c1e4b2b80c288b2df3ddc80ab4a8b8f631ba4bc4d9fadea096a551953d36275bc45ebf366102d87e66d543d29508137e4d291fa1ee746ab16f0
TLSH
T100B0124086E78D51086961134568595FC975745CAF5573F1DB34CA4D21CD807FCC0B10
MD5 SHA1 SHA512 TLSH

Submit Download

file0a0.dat

Path C:\Windows\file0a0.dat
Size 20B
SHA256 9fff7d3d2046f9ecd12c7954d3ecb60ddcce08f1c11c43298e7314997694df32
MD5 44f6958d1a36313a2dea6506821ddbd8
SHA1 265782c31c0c130ec6f6009acbfedd132ac3a525
SHA512 a70366da012bcce57916bd247995e5b4a4a28e1c5e94189753496693a48b5a3269354a8693c6ec3184346e353f652633e7752bde583b2c4590d650d0d94b8c46
MD5 SHA1 SHA512

Submit Download

temp0a1.exe

Path C:\Windows\temp0a1.exe
Size 4.5MB
SHA256 f2ed3d14fb433603a536382224e8adb4f22a4529aa6370c4972ad39fe2234ec5
MD5 ac9c2ed1312d1edb729268086e169797
SHA1 4d12201175b07e8528466a799c67864097f12964
SHA512 d05ad3da8d54d14de21f30e07ad34867131bc5fef050e3f2904f6415a2e80c2913ba813207ee7500f599b68a0512843c4fee717838bfbf10be326e7323b15591
SSDEEP 49152:lkdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai25zYo5UC9RhuCTFKlaxV5dgbTPJI2:lH/IJsiC5sop7cTz
TLSH
T1AB264A656BF880F5E1BBD17889768AB1F77678120D31EB4F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1504-21-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1836-15-0x000001E86B840000-0x000001E86B84E000-memory.dmp

Download

memory/3960-30-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4284-38-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4284-39-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4284-46-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4284-70-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4652-9-0x0000000000400000-0x0000000000413000-memory.dmp

Download