f2ed3d14fb433603a536382224e8adb4f22a4529aa6370c4972ad39fe2234ec5

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/11/2026, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
Size 4.5MB
Sample261101-1fa2waysht
SHA256 f2ed3d14fb433603a536382224e8adb4f22a4529aa6370c4972ad39fe2234ec5
MD5 ac9c2ed1312d1edb729268086e169797
SHA1 4d12201175b07e8528466a799c67864097f12964
SHA512 d05ad3da8d54d14de21f30e07ad34867131bc5fef050e3f2904f6415a2e80c2913ba813207ee7500f599b68a0512843c4fee717838bfbf10be326e7323b15591
SSDEEP 49152:lkdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai25zYo5UC9RhuCTFKlaxV5dgbTPJI2:lH/IJsiC5sop7cTz
TLSH
T1AB264A656BF880F5E1BBD17889768AB1F77678120D31EB4F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence spyware stealer

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1364	temp0a1.exe

Executes dropped EXE 5 IoCs

pid	Process
1364	temp0a1.exe
2648	2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
2536	PlayCD.exe
2328	temp0a1.exe
4436	PlayCD.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jaremore = "C:\\Windows\\PlayCD.exe"	temp0a1.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	temp0a1.exe
File opened (read-only)	\??\Q:	temp0a1.exe
File opened (read-only)	\??\R:	temp0a1.exe
File opened (read-only)	\??\X:	temp0a1.exe
File opened (read-only)	\??\M:	temp0a1.exe
File opened (read-only)	\??\A:	temp0a1.exe
File opened (read-only)	\??\A:	temp0a1.exe
File opened (read-only)	\??\D:	temp0a1.exe
File opened (read-only)	\??\H:	temp0a1.exe
File opened (read-only)	\??\L:	temp0a1.exe
File opened (read-only)	\??\P:	temp0a1.exe
File opened (read-only)	\??\V:	temp0a1.exe
File opened (read-only)	\??\G:	temp0a1.exe
File opened (read-only)	\??\I:	temp0a1.exe
File opened (read-only)	\??\O:	temp0a1.exe
File opened (read-only)	\??\T:	temp0a1.exe
File opened (read-only)	\??\U:	temp0a1.exe
File opened (read-only)	\??\W:	temp0a1.exe
File opened (read-only)	\??\Y:	temp0a1.exe
File opened (read-only)	\??\Z:	temp0a1.exe
File opened (read-only)	\??\N:	temp0a1.exe
File opened (read-only)	\??\B:	temp0a1.exe
File opened (read-only)	\??\B:	temp0a1.exe
File opened (read-only)	\??\K:	temp0a1.exe
File opened (read-only)	\??\S:	temp0a1.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\bb.ico	temp0a1.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	temp0a1.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	temp0a1.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\file0a0.dat	PlayCD.exe
File opened for modification	C:\Windows\PlayCD.exe	temp0a1.exe
File created	C:\Windows\PlayCD.exe	temp0a1.exe
File created	C:\Windows\temp0a1.exe	2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\file0a0.dat	2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\PlayCD.exe	temp0a1.exe
File created	C:\Windows\temp0a1.exe	PlayCD.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	PlayCD.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	PlayCD.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp0a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PlayCD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp0a1.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3832	2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
3832	2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
2536	PlayCD.exe
2536	PlayCD.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4436	PlayCD.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 1364	3832	2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe	90
PID 1364 wrote to memory of 2648	1364	temp0a1.exe	91
PID 2536 wrote to memory of 2328	2536	PlayCD.exe	95
PID 2328 wrote to memory of 4436	2328	temp0a1.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Windows\temp0a1.exe
  "C:\Windows\temp0a1.exe" ejecuta
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Users\Admin\AppData\Local\Temp\2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
    C:\Users\Admin\AppData\Local\Temp\2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
    3⤵
    - Executes dropped EXE
    PID:2648

C:\Windows\PlayCD.exe
C:\Windows\PlayCD.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\temp0a1.exe
  "C:\Windows\temp0a1.exe" ejecuta
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\PlayCD.exe
    C:\Windows\PlayCD.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of SetWindowsHookEx
    PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 4.5MB
SHA256 a4753c7f51cf0c4a6169b6d01db3d1461cc4ff2846dcd164606878e5608d0ded
MD5 1a7c7c3d3fb9bb3cbcd73fdbce8b0383
SHA1 8d8087a7c8e9be03137b2b01f31ce0da46e29c77
SHA512 e83545d66f103c66646143f9ab47b223ca53b915803be426fe4a331ceeffc6e3e6f80c74175f2dfc2c0f0e9a0f53a34f06607b51f8b0b176770bf11f4aec8518
SSDEEP 49152:QdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai25zYo5UC9RhuCTFKlaxV5dgbTPJIUm:b/IJsiC5sop7cTVG
TLSH
T145264A656BF884F5E1BBD13889768AB1F77678120D31EB4F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-31_ac9c2ed1312d1edb729268086e169797_elex_glassworm_icedid_njrat_vidar.exe
Size 47KB
SHA256 1a85e0235f7f0f810b2b8c2b81351ab631dab5b351ffa30a49606682c8869a9c
MD5 659153659772b6da39f1be1cf49b04b4
SHA1 35f3ecd3b8a26086f86cb9c45c3b83b51fe0231d
SHA512 b33283748c23c91fb56293ad96f9228f3321601f3c92a1b030c31c0c84c0cd15aa4b7b79c516848bae5196de5d1bc4795382086414553e05b0f94448df9e72fa
SSDEEP 768:ARjxEfYgdA1INwYTYKc5z1mmB1xi19zHVMK1UJu9zC1aW:tf7wYct5z1tjkz1TQqztW
TLSH
T1F023398167AC8202E9FF1F74A5B1D9132D7DABC67830D91E1998F8851DA33C19B2077B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PlayCD.exe

Path C:\Windows\PlayCD.exe
Size 4.4MB
SHA256 0d78ab0f960c23659857c2735db840dcaa87572bc2799f185e7bdc67b2ca7736
MD5 cd5312de7fc55bcda2ec01304696b067
SHA1 00bf9000d05eaae7476c4c2279601439dadb7917
SHA512 f6661fd24cd05cdc912167fc750c3ccd634142ea524e79d2a956a62c890f0da51edde1ce67e109e542bcf77032b395ccdd856e68354938b8a892cf66dc4c041b
SSDEEP 49152:KdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai25zYo5UC9RhuCTFKlaxV5dgbTPJIU9:l/IJsiC5sop7cTz
TLSH
T12B264A656BF884F5E1BBD13889768AB1F77678120D31EB4F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PlayCD.exe

Path C:\Windows\PlayCD.exe
Size 4.1MB
SHA256 332eee2e0c6d24704b8c805b890f48e0b21be5c041e7147258ddd3dbc2d1ec92
MD5 e31bd41b3a0214d7f38724894d9a3b14
SHA1 26cbff072d79d1da7032584ae1aea21b6a4d8ec8
SHA512 8c07ec1ca52bae412781475ed8c7996a5ef00e1f5077b8c72a03f70f019654872caef85ef13c131fce371d30b0eb947d6981aab072914c86cd72bd1e47b1baa7
SSDEEP 49152:gdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai25zYo5UC9RhuCTFKlaxV5dgbT4:L/IJsiC5sop7cT4
TLSH
T11C164B656BF880F5E1A7E134897AC9B2F77678420D31EB5F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bb.ico

Path C:\Windows\SysWOW64\bb.ico
Size 4KB
SHA256 823cbf89390733bd09d5541839786670d748064e50ff235928abd9e2433192b7
MD5 84a8ab049bb249ce1b1e25d5648571a9
SHA1 66b48c0e63f542b74a5b003af9660222c1d0f324
SHA512 8ce3b7fa9917ee0164b3a09920aaa1ec6806159aab184e3fbb15fc58134c64957811eded9ad3d459c0c1a257aee3129473136d1800f5d89bc9adc5a43a4b6c64
SSDEEP 48:z2pe4sdnY/3XXXXXXXXXXcDD3V+yD3/6k0vucpb:z6bsdnY/XXXXXXXXXXcDD3Vr/6Jvu6
TLSH
T19C91553EA718B8B0F98E6DB1236FC064505E7504151BCDA6B1A9FCB07F92CEA40143CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file0a0.dat

Path C:\Windows\file0a0.dat
Size 115B
SHA256 b8048475fcca1dbb27c575da884cc2d34fbaa7fc61186dd8e13ee1f1eb9da33c
MD5 dcac4866d28b7d6c70fd3b15cc9d14ce
SHA1 010de232d3cc8de07b610abf49d9d7d5fe87559a
SHA512 faed64127f8d4c1e4b2b80c288b2df3ddc80ab4a8b8f631ba4bc4d9fadea096a551953d36275bc45ebf366102d87e66d543d29508137e4d291fa1ee746ab16f0
TLSH
T100B0124086E78D51086961134568595FC975745CAF5573F1DB34CA4D21CD807FCC0B10
MD5 SHA1 SHA512 TLSH

Submit Download

file0a0.dat

Path C:\Windows\file0a0.dat
Size 21B
SHA256 6df5657c386562f4c71385afd79fb8c0d832e07273ee02bf4a61424a812b1af4
MD5 7f2d12f66ddc2484bd947d043afb2fb8
SHA1 58d90f86a1b817839e417ed1abde4f03daae68bd
SHA512 1488ae004c7f9809c8f8384b85732874c3f0b8a93f29042aba2609e5f9b5de4dce49ac7f7f767ed543f06dc79249e6a8e0d7ac79995dac92ded648ee97379c13
MD5 SHA1 SHA512

Submit Download

temp0a1.exe

Path C:\Windows\temp0a1.exe
Size 4.5MB
SHA256 f2ed3d14fb433603a536382224e8adb4f22a4529aa6370c4972ad39fe2234ec5
MD5 ac9c2ed1312d1edb729268086e169797
SHA1 4d12201175b07e8528466a799c67864097f12964
SHA512 d05ad3da8d54d14de21f30e07ad34867131bc5fef050e3f2904f6415a2e80c2913ba813207ee7500f599b68a0512843c4fee717838bfbf10be326e7323b15591
SSDEEP 49152:lkdRba8fD8qinfMSKJXIUQREV1QOTu1U5ai25zYo5UC9RhuCTFKlaxV5dgbTPJI2:lH/IJsiC5sop7cTz
TLSH
T1AB264A656BF880F5E1BBD17889768AB1F77678120D31EB4F0251CA1F2F33A904D29726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1364-16-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2328-28-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2328-59-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2328-29-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2328-27-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2536-19-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2648-11-0x000001772D0C0000-0x000001772D0CE000-memory.dmp

Download

memory/2648-26-0x00007FFB15160000-0x00007FFB15B04000-memory.dmp

Download

memory/2648-12-0x00007FFB15160000-0x00007FFB15B04000-memory.dmp

Download

memory/2648-10-0x00007FFB152EF000-0x00007FFB152F0000-memory.dmp

Download

memory/3832-2-0x0000000000400000-0x0000000000413000-memory.dmp

Download