lockfile | ddf2292387e365ec274af9b7f88059e71d32c2bdb044fa1e7520a8e982d4691a

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/03/2026, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
Size 871KB
Sample260328-mktswsfx8z
SHA256 ddf2292387e365ec274af9b7f88059e71d32c2bdb044fa1e7520a8e982d4691a
MD5 928f711e3168ee009b254ee8a3f9e48e
SHA1 89a0f4d3927477f82f20b48150dc23dca884b933
SHA512 9cb4b611abd52982afd1f64e28d28175c7debdc5284089b911e0abfd91afa38ca5d4f48b1085448450321a5bc4b2a526b477ea4b6403ef8e8083407f707f2b88
SSDEEP 12288:agVoEaQOJI9WYgeWYg955/155/CIc8BcHb6SxIo/BgzJoXGNHsati:apBQOOwc8BIWS6o/BgzJyGVsati
TLSH
T1C9156C5AB2A813F4E07BC03989424146E7B27CF547A09BDB12A0239B5F73AE55F3B750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery lockfile ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-600123060-2148212387-2211176695-1000\WWAKKABN-LOCKFILE-README.hta

Ransom Note

<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><meta http-equiv="x-ua-compatible" content="ie=9"><title>LOCKFILE</title><hta:application id=LOCKFILE applicationName=LOCKFILE icon=explorer.exe selection=yes scroll=no contextmenu=no innerBorder=no windowState=maximize minimizeButton=no singleInstance=yes sysMenu=no /><link rel="stylesheet" href="public/css/test.css"><meta name="viewport" content="width=device-width, initial-scale=1.0"><style>html{font-size:100%}body{position:relative;border:0;font-family:Arial;padding:1% 0 0 0;margin:0;width:100vw;height:100vh;overflow:hidden}*{font-size:1rem}.g1{content:"";position:absolute;left:0;top:50%;transform:translateY(-50%);height:368px;width:150px;z-index:-1}.g2{z-index:-1;content:"";position:absolute;right:0;top:50%;transform:translateY(-50%);height:368px;width:150px}.container{width:90%;margin:auto}.container img{max-width:100%}.ht{margin-bottom:1%;position:relative;padding-left:16px;font-weight:900;font-size:1rem;line-height:100%;letter-spacing:.05em;text-transform:uppercase;color:#dedede}.hb{margin-bottom:1%}.hb img{width:850px;max-width:100%}.hi{margin-bottom:1rem;background:#fcfcfd;border:1px dashed #f71b3a;box-sizing:border-box;border-radius:4px;padding:1rem 3rem;width:100%}.hit{margin-bottom:1%;font-weight:bold;font-size:.9rem;line-height:100%;color:#222}.hib{font-weight:bold;font-size:.9rem;line-height:100%;color:#f71b3a}.main-p{font-weight:bold;font-size:1rem;line-height:125%;color:#333160}.mn{position:absolute;width:5%;height:276px;top:3rem}.mn img{max-width:90%}.ml1{position:absolute;width:50%;height:10rem;left:0;top:0;background:#f3f3fc;border:1px solid #cfd3da;box-sizing:border-box;padding:2% 2%}.ml2{position:absolute;width:50%;height:13rem;left:0;top:11rem;background:#f3f3fc;border:1px solid #cfd3da;box-sizing:border-box;padding:2% 2%}.mr3{position:absolute;padding:2% 2%;width:48%;height:24rem;left:52%;top:0;background:#ffdfdf;border:1px solid #ffa5aa;box-sizing:border-box;border-radius:4px;font-size:15px;line-height:130%}.mlb{font-size:.8rem;line-height:1.2;color:#8988a4;margin-top:2%;margin-bottom:2%}.mlb img{max-width:14px}.sp1{left:0;top:50%;position:absolute;display:block;width:6px;height:6px;background:#f71b3a;transform:translateY(-50%) rotate(135deg)}.mll{font-size:.9rem;line-height:1.2;color:#333160;margin-bottom:2%;position:relative;padding-left:20px}.mll a{font-size:.8rem}.mlt{margin-bottom:15px;font-weight:bold;font-size:.9rem;line-height:1.2;color:#333160}.mlt img{max-width:14px;position:relative}.mrli{font-size:.9rem;line-height:1.2;margin-bottom:2%;position:relative;padding-left:25px}.mrli a{font-size:.9rem}</style><script type="text/javascript">function o(c){var d=new ActiveXObject("WScript.Shell");d.run(c.href)};</script></head><body bgcolor=#F8F8F8 text="buttontext"><img class="g1" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAJYAAAFwAQMAAABgpRCKAAAABlBMVEXw8PDv7+81SmF7AAAAAXRSTlMBN+Ho8AAAAWpJREFUeAHt1slxBCEMhWFRs3AkhA7BIRAahEYIDoEQOM5CIfvOX2V5nwWOX+8t6RWirzIt1QamGayDaQY7gSlZBTuBKVkBO4ENMM1gFayBdTAly2AV7ATWwQaYZrACVsFOYB1sgClZBitgDewE1sGG0ZSsGK2CNbATWP/YDC/t6K9uYDsqe4Kyb/Pflx0Y9mUEC9CrHnrVgeHgRLANhimA+fkniAPDaU9gERJgI4PoCWAe0mMH5sAgytgSWIQMJdvIIC6D0TwZFGRnNEcGhSOT71iai/4ti39mJyim9bxly27TdFpkFayBnYzWly1btuxH7AVMElgAc2CSwCJYAPNgDkzIElgE24wWwLzRdkZzRpPvWFom+rPmjLYzmjda+EY/R7AEZpxBDxZuyPyN2+7Gzd2hya1buiFTmzmwHZgHiw+8l1q27PTD1r5h1WjFaBlMZhtG62AnsAZWwDKYzNbBGliZbchs9Z3eAJcyeuremDsyAAAAAElFTkSuQmCC"><img class="g2" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAJYAAAFwAQMAAABgpRCKAAAABlBMVEXv7+/w8PB6KHGJAAAAAnRSTlP/AZKwANwAAAGJSURBVHgB7dSHbQMhFMbxh1xQZwQWyA6MdozGCBmBEVB3QRApF3wk77P80l34q/+uH4Xqx56JWSRmO+LmuSXi5rll4haBEbcMLAEL3Apx2wFLwAIw4paB7YBFYAEYcSvAdsASsAjMAyNuBVgGtgMWheaBEbcitJ3QErAILADzwEhmBVheQGfig9ssncgCqyeLjfRioZkFVhfzb7QCZjrrbtesNJu4qbpYbo8AZjrbtUcAc52l9lhuqnYWZ1sB072F2Qww25ufzV2y9nrAKjfVW5ltJTTdW57NCM32tjtv7pKl2SahVZmpdxY/ZasvWXg1/cNmftX82fMsOg+YvVobNmxHvAgsAPPQ/rPRaDR64qQzN8dNVW4amAXmgE3cVOW2AqaBGaFZYA7YJLQqMyW01TdMQxu2+oYpoZHUJqE5YFZoBpgGtgJGyCZg7opsunKr123qBm115aavyFZCU9/ZDwywW2k08j9s4RsWhZaEtgOWgRWhVWQeWACWgO2AZWAVWQCWgBVg7MQX+2SwUiS8JcwAAAAASUVORK5CYII="><div class="container" style=""><div class="ht"><span style="width:6px;height:15px;background:#f71b3a;position:absolute;display:block;left:0;top:0"></span>LOCK <span style="color:#c4c4c4">FILE</span></div><div class="hb"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA4QAAAAwBAMAAAC706n2AAAAGFBMVEVHcEwiIiIiIiIiIiL3Gzr//f79tL76ZHmOe1JuAAAABHRSTlMA/axJAz2MyAAACKNJREFUeAHtmwli4joWRfPDBoDaAMMGnKol1LSBgtoAkA1k2H7LJxxeSW21TEjPfr/bsZ4Gh3t0Jduh7qaYYooppviPj2//hTFRmxBOCCeEE8IJ4YRwignhvzg+bzYrz7YmZ5tN92ejexv1J9QvUmwdgJ+b1D1VEIwkwpfT6e34RPHn6fRImehPyR53u93+0Q5EFKLpj9PpQP4yIAlbUfAydkud0lgcjZPxx8WfcoSbiwZ+prM0RohlhBozBfu8XiyW22IY6xU0HYiORAxngcYzG9nvzkiX+OTZ8oJsseAKxsxGD4tFR1OC3MO5G8XZgqC7CL/vdun4vNv9ovgjqZV+HHcE50nEcwkAz5cqCsZvivzk7NyacR2NgpexW/8bPHGUoO3Jc3HPAyEfwjPiTXxLyxDHQI3Ui9wcIVVD0VCtFPQvB+joYdxFxZwuNmJgfhLxy6xlSXMR5nhpHJfpRGj34gOetd5z5Icnoimpqa9VJcIjbYQ5EuEPET6J0Eoyz7YUoWDmgZDocmAVhHMRig01AqEm0EGQkm4bIZRE6PWXTRfqvpSf09KRay6kvwh14U4D6EKpVSSl6nsgtKEIqR/pwm9VF2pCbagEiJUjnLdduKZChPJAjXUwAM5KN0JKum2EkhAhPbqGC2UHSWqNqgsZq3ChC59lhSs45VW5C3+SFSFn71pIy4vbV4SoJ6WFsRy1kCKReqmGCAnZSTIQrpoIGQwgXp9Gq6YLWUG1/1+MQqnLXSj7GQ3LvXD3C2l14T52NI4AKqtiEghGSs6JCzVXQltS63npQtt6HRqRi3VHlWJRHJjd4rIbcpq78FyERbydyATVWbSg7El+GRotcxc+wLjhQi/s1KG7Uyh3ISmaly7EEAhJmSzUDkKjUV5VIvweCB3QcobF/Y/QhWYK3F78+PhNhHqmE6HCqmQdIS4x5x3fpgt9sYck4SEpW1j2JGMCdRFqPdlXXSguDg7soIMutEnGJQWCgVDBf0KAQhiWBsIx4VngZqDMhXWEdRd6bsSyowjgULUBF5qR/FKEF7gCsrlbE4cMYcOF5gIhwoOu4UIM6G3UwyDCdRWhLkTU3ZALc4RHq0qEVFlwwJYLPc/3wgZCJrEA2ghzFy66QLiqIcSAWPE6FwbCyM8lUnWh04urXu9CrcUS+FOEmmm0C025HjLgob0XXu9CealoiXDeQrga4ULwKegNLoSVHaoudLQNg7zbhfteq6Tj8Vz+XXPhc82FtJZNSgLtA/bC3WOG0M/oJ7vKhWxMDRcq0bZver0LA6G8tVzVhaZSdCNd+DC0F/Ynz66Ex/ZCmt/OyEWyjLRr74XtO1LfrolQMZzbTv9xe+Ey/a/uQrWlEsPe6sIHL1d3oeGzUNOFsxSLIRf2qibBL2Uq6y4sHyqsBxVJfFV34f7Uh/7LEFr5yKB9PD6J0Amp2P35LMXloWLpa8sUeQY1egClC50VXdet4zk8xQVZis+LARduiNpeqPPo2XCht8tNFxI2zbkk/zwmLLrQePp7hFGVI8SfHBzwV92F5zjU3874uoBwNY0pr2iDj/b6K8ugRi/esAsN+YSgxqpwofmu7kLSsGu68N4r1F1Ye8Gm696wWH4LCuVCGlUlwt/0NJkY1F0YCOvvSOnxkl0u5rBzO5uWbYS4dtCFDlMKGgi70oXmq3uhEBYjXOjiOM6F5Iq98PwoFy5U4poLDwVCXCeKlGTQW13oH5u8XvhARULgJkK6pP//QxcqbSALuFe5UFT2aLjQ+lEutHvhwu+IZlkRawhp5ghiOXgkye7admH9Hak9Xo6Xkh/RY/nHprYLk55f6i5URdrmZltCZawLA4YgGy4UYcOFbO0LRwouKp70PupC7ycyhFalw1OOUBR4kSSn735H+jP9F8FqKsJei3ADn0l1ejN0fVAqM94fbodcyDC6p0AYf831up44dMWFDzGBPsqFrswDLmTyP1lW8ByhtAOBCe25xy4k6XjDc6HhahoIsy0deZS1/VzIbK49F2qOEqG5q58LY6P+MBe6Mg/shfhLIHixjjBUNpHd55gE6m3vSA3rs7UROByVpP1cyBSuPBeaaiIc9VxI1lh+oAu92oALv/fKHS3XEB5LxraVYObVG96RVhHeZ3NbkJ9UsuXCpHLFhTD+OBfy0/hAF3ouwmx1/CUQBa+60HUve+NmPJEk1d4Lr3chDIilCJVnzEI6q7nQ+X+7C+++fLGF0Y12oVcQtL9TzLvIlS4cLOu4AqEMTJAxDjETbt8LXw4lwodsbsc3FkYivCsQ3m/VD/FWN7kw5oAlWVznQgfrOK7oIsKAXOyFGS+p2QR1dy6kuczQkoG3pM6Em9+Reu4dqY7zc4BQTQJYdS9EGRffpUn1s/87Xejj+T33rw7tFznWvpDr4rXftkAoYFqeB3tru3AXlGfLhSEi6u4fT/3DmU2DpAlwBSy9epUL9/vj6Xg6gCudpNIbupMXB6EbgdjUjiTSrNN/fo+TTComEcSS+rn4nh8kRCjWsS506NWdTPjSqMbxN3XY9cDXqD4NIbSln8mgkI2cr451F8Yud7BpWDNn6onJa/ZCgvbHbFM16BAT3pNzaT3u6082moOgfGhD/GtcaP/83aUIw9PrAuGsitCRbcloXkaEjHXNXhiSSigg2FZG2lGuV9yRBqldIEy1Bo01n/doIkT7DFgVIZ+fPtaon3zaLqwipJMI/U1JdCNdSGS1jl3c+XaBcNCFCq4NVbf2J1/LLoxukI29sOlCbeg4mcrM7bgVXDVduFZh+0hA/dhkbnLhKhDaUpjjXQhiX+lZWonQAce70PdbpKyStQld6Zm3qVfshaLKXOhbbi9WrHULELqqjlxIg9PapuqHs29x4fYuEN4Ssy8pslJ3479s+vn6+qrm//J49eIg/NBQqI+OrqvXTf84bYoJ4YRwQjghnBBOCKeYYooppphiiv+O+Bvo15hrmh7VCwAAAABJRU5ErkJggg=="></div><div class="hi"><div class="hit">Any attempts to restore your files with the thrid-party software will be <span style="color:#f71b3a;font-size:.9rem">fatal for your files!</span></div><div class="hib">Restore you data posible only buying private key from us.</div></div><div class="main-p">There is only one way to get your files back:</div><div style="position:relative;margin-top:15px"><div class="mn" style=""><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADgAAAEVBAMAAABH7TtxAAAALVBMVEVHcEz/NXAiIiL9DTYiIiKSIDUiIiL9EzwiIiIiIiL/N3L9ACP8AST+KF3+G0rPEf4SAAAADHRSTlMA/v7+PxmqQoLamc5bm0ExAAAB20lEQVR4Ae3ZtZYUURDG8W9npgV39289xd01w909w2Ncwjl95gHgPYhwWc1xYngFpLjdhd1G16vG539+reHF5+k/fj28c2vYKG/rP2zYsPV+OMxHBSrdvBIAtl9RqDQkKwAONihUeokJlyJkg0KlrAl5IU4kKhwm51ri1BLLBSYSsWFYOicllj/1wmG3z6qfxAAuRtlmkUU92lMu3kS2T42RQjnamPslhtwv1EE9T42RQrlCDdAoVKDM2ivrAaxchdLKpRAq0DOnBHqmaph8WLTY3pPkoOd5cVLeZnNle4dIPVqLFi1a7DtxcK580SFy0LsO2efg93nxRSdKixYtWrToiYs7RBY7RhZn5MW3eXHxX8sZ3U1atGjRYs+Nd7uZHNiUFxd2vizmbtaiRYsWOz7ubjrpbcHtpjneuKup6e5JP2xqeuiHSnHj+FJg7dErUNiU7nUH2YCQ5P4MKj3YeIlLl/MoaxSmew1YG3P/pTq3GDmgqcnR9ekqZjlYhUTi7qZ0dP0T2MpaJ92s1xgk/LLWuFD3mcV1rEBmk24VCDhVet16BCvXO+ogkDRs5YUdrLt2OOR+Rx0ElpNcf4lknUShKUScsIJEo1AHgWAVdIR6b4rQk/4YnMNP5yP+Vz9OakSaLAAAAABJRU5ErkJggg=="></div><div style="margin-left:6%;position:relative"><div class="ml1"><div style="position:relative;top:50%;transform:translateY(-50%)"><div style="font-weight:bold;font-size:1rem;line-height:1.2;color:#333160">contact us</div><div class="mlb" style=""><span class=sp2><img class=im1 src="data:image/x-icon;base64,AAABAAEAGBgAAAEAIACICQAAFgAAACgAAAAYAAAAMAAAAAEAIAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAD//////////9XV1f9YVlj/KScp/yUjJf8lIyX/JSMl/yUjJf8lIyX/JSMl/yUjJf8lIyX/JSMl/yUjJf8lIyX/JSMl/yUjJf8lIyX/JiQm/1FQUf/S0tL/////////////////+Pj4/2ppav8hHyH/JSMl/yUjJf8lIyX/JSMl/yQiJP8iICL/IiAi/yIgIv8iICL/IiAi/yIgIv8kIiT/JSMl/yUjJf8lIyX/JSMl/yEfIf9qaGr/+Pj4////////////5eTl/z49Pv8jISP/JSMl/yUjJf8lIyX/JCIk/zk3Of+CgYL/jYyN/42Mjf+NjI3/joyO/318ff80MjT/JCIk/yUjJf8lIyX/JSMl/yMhI/8+PT7/5eTl////////////4eHh/zw6PP8kIiT/JSMl/yUjJf8lIyX/IR8h/3Nxc/////////////////////////////v7+/9jYmP/IiAi/yUjJf8lIyX/JSMl/yQiJP88Ojz/4eHh////////////4eHh/zw6PP8kIiT/JSMl/yUjJf8lIyX/IR8h/3h3eP////////////////////////////v7+/9nZWf/IR8h/yUjJf8lIyX/JSMl/yQiJP88Ojz/4eHh////////////4eHh/zw6PP8kIiT/JSMl/yUjJf8lIyX/IiAi/11cXf/39/f//////////////////////+np6f9JR0n/IyEj/yUjJf8lIyX/JSMl/yQiJP88Ojz/4eHh////////////4eHh/zw6PP8kIiT/JSMl/yUjJf8lIyX/JCIk/y0sLf+srKz/////////////////8fHx/4KBgv8mJCb/JSMl/yUjJf8lIyX/JSMl/yQiJP88Ojz/4eHh////////////4eHh/zw6PP8kIiT/JSMl/yUjJf8lIyX/JSMl/yQiJP8zMTP/o6Kj//39/f/z8/P/eHd4/yUjJf8lIyX/JSMl/yUjJf8lIyX/JSMl/yQiJP88Ojz/4eHh////////////4eHh/zw6PP8kIiT/JSMl/yUjJf8lIyX/JSMl/yQhJP89PD3/x8fH///////+/v7/xsXG/z89P/8jISP/JSMl/yUjJf8lIyX/JSMl/yQiJP88Ojz/4eHh////////////4eHh/zw6PP8kIiT/JSMl/yUjJf8lIyX/JSMl/yIgIv+DgYP//////////////////////4OCg/8iICL/JSMl/yUjJf8lIyX/JSMl/yQiJP88Ojz/4eHh////////////4eHh/zw6PP8kIiT/JSMl/yUjJf8lIyX/JSMl/yIgIv+OjY7//////////////////////4yLjP8iICL/JSMl/yUjJf8lIyX/JSMl/yQiJP88Ojz/4eHh////////////4eHh/zw6PP8kIiT/JSMl/yUjJf8lIyX/JSMl/yMhI/9QT1D/5OPk////////////4+Pj/09OT/8jISP/JSMl/yUjJf8lIyX/JSMl/yQiJP88Ojz/4eHh////////////4uHi/zw6PP8kIiT/JSMl/yUjJf8lIyX/JSMl/yUjJf8lIyX/VlRW/6CfoP+enZ7/VlRW/yUjJf8lIyX/JSMl/yUjJf8lIyX/JSMl/yMhI/88Ojz/4uLi////////////7+/v/05NTv8hHyH/JSMl/yUjJf8lIyX/JSMl/yUjJf8lIyX/IiAi/yclJ/88Ojz/JSMl/yQiJP8lIyX/JSMl/yUjJf8lIyX/JSMl/yEfIf9QT1D/8PDw/////////////////6yrrP82NTb/JCIk/yQiJP8lIyX/JSMl/yUjJf8kIiT/IiAi/yIgIv+FhIX/l5aX/zAuMP8kIiT/JSMl/yUjJf8kIiT/JCIk/zg2OP+vrq////////////////////////39/f/T0tP/rKys/6Khov9DQkP/IyEj/yQiJP8vLS//aWhp/5STlP+/vr///v7+/5aVlv8mJCb/IyEj/0NBQ/+ioaL/rKys/9TT1P/+/v7///////////////////////////////////////n5+f9YV1j/IR8h/y4sLv+mpqb/+/v7/////////////////+np6f9IRkj/IB4g/1hWWP/5+fn///////////////////////////////////////////////////////b29v9XVlf/Hx0f/19eX//4+Pj///////////////////////39/f9sa2z/Hhwe/1ZVVv/19fX///////////////////////////////////////////////////////f39/9aWVr/Hhwe/3V0df////////////////////////////////90c3T/Hhwe/1pZWv/39/f///////////////////////////////////////////////////////39/f9vbW//Hhwe/1VUVf/y8vL///////////////////////Ly8v9VVFX/Hhwe/29ub//9/f3///////////////////////////////////////////////////////////+kpKT/JCIk/yknKf+Yl5j/+vr6////////////+/v7/5qZmv8pJyn/JCIk/6SjpP/////////////////////////////////////////////////////////////////q6er/VFNU/yAeIP8sKiz/bWxt/6Wkpf+lpKX/bm1u/y0rLf8gHiD/VFJU/+np6f//////////////////////////////////////////////////////////////////////0NDQ/1BPUP8kIiT/IR8h/yQiJP8kIiT/IR8h/yQiJP9QT1D/0NDQ/////////////////////////////////////////////////////////////////////////////////+Dg4P+CgYL/Pjw+/yclJ/8nJSf/Pj0+/4KBgv/g3+D///////////////////////////////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="> UTox       </span><span class=sp2><img class=im1 src="data:image/x-icon;base64,AAABAAEAGBgAAAEAIACICQAAFgAAACgAAAAYAAAAMAAAAAEAIAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAABgAAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAYAAAAAgAAAAAAAAAYAAAAjQAAANgAAADkAAAA5AAAAOQAAADkAAAA5AAAAOQAAADkAAAA5AAAAOQAAADkAAAA5AAAAOQAAADkAAAA5AAAAOQAAADkAAAA5AAAAOQAAADYAAAAjQAAABgAAAChAAAA/wAAAOMAAACIAAAAgQAAAIIAAACBAAAAgQAAAIEAAACBAAAAgQAAAIEAAACBAAAAgQAAAIEAAACBAAAAgQAAAIEAAACCAAAAgQAAAIgAAADjAAAA/wAAAKEAAAD1AAAA8QAAAPEAAABnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGcAAADxAAAA8QAAAPUAAAD/AAAAlQAAAKwAAADwAAAAVAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVAAAAPAAAACsAAAAlQAAAP8AAAD/AAAAfgAAABsAAADEAAAA5QAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAA5QAAAMQAAAAbAAAAfgAAAP8AAAD/AAAAgQAAAAAAAAAuAAAA1gAAANYAAAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC4AAADWAAAA1gAAAC4AAAAAAAAAgQAAAP8AAAD/AAAAgAAAAAAAAAAAAAAAQAAAAOUAAADEAAAAHwAAAAAAAAAAAAAAAAAAACcAAAAnAAAAAAAAAAAAAAAAAAAAHwAAAMQAAADlAAAAPwAAAAAAAAAAAAAAgAAAAP8AAAD/AAAAgAAAAAAAAAAAAAAAAAAAAFQAAADwAAAAsAAAABIAAAAAAAAATAAAANwAAADcAAAATAAAAAAAAAASAAAAsAAAAPAAAABUAAAAAAAAAAAAAAAAAAAAgAAAAP8AAAD/AAAAgAAAAAAAAAAAAAAAAAAAAAAAAABqAAAA9gAAAJoAAABrAAAA7AAAANEAAADRAAAA7AAAAGsAAACaAAAA9gAAAGoAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAP8AAAD/AAAAgAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAhgAAAP0AAAD8AAAAtAAAACIAAAAiAAAAtAAAAPwAAAD9AAAAhgAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAP8AAAD/AAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAUAAAAngAAAPsAAACaAAAAFAAAAAAAAAAAAAAAFAAAAJoAAAD7AAAAngAAABQAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAP8AAAD/AAAAgAAAAAAAAAAAAAAAAAAAACMAAAC0AAAA9QAAAH8AAAAKAAAAAAAAAAAAAAAAAAAAAAAAAAoAAAB/AAAA9gAAALQAAAAjAAAAAAAAAAAAAAAAAAAAgAAAAP8AAAD/AAAAgAAAAAAAAAAAAAAANgAAAMsAAADtAAAAZQAAAAMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAAAAZQAAAO0AAADLAAAANgAAAAAAAAAAAAAAgAAAAP8AAAD/AAAAgAAAAAAAAABMAAAA3wAAAN8AAABMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEwAAADfAAAA3wAAAEwAAAAAAAAAgAAAAP8AAAD/AAAAhgAAAGIAAADtAAAAywAAADYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2AAAAywAAAO0AAABiAAAAhgAAAP8AAAD2AAAA4AAAAPAAAACxAAAAHwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHwAAALEAAADwAAAA4AAAAPYAAAChAAAA/wAAAPQAAACYAAAAfwAAAIIAAACBAAAAgQAAAIEAAACBAAAAgQAAAIEAAACBAAAAgQAAAIEAAACBAAAAgQAAAIEAAACCAAAAfwAAAJgAAAD0AAAA/wAAAKEAAAAYAAAAjQAAANgAAADjAAAA5AAAAOQAAADkAAAA5AAAAOQAAADkAAAA5AAAAOQAAADkAAAA5AAAAOQAAADkAAAA5AAAAOQAAADkAAAA5AAAAOMAAADYAAAAjQAAABgAAAAAAAAAAgAAABgAAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAB8AAAAYAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAA/wAAAH4AAAAAAAAAAAAAAAAAAAAAAAAQAAgAAAAAAAAAAAAAAAAAABgAAAB+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///wA="> Email </span></div><div class="mll"><span class=sp1></span> qTox ID:  B2F873769EB6B508EBC2103DDEB7366CEFB7B09AB8314DAD0C4346169072686690489B47EAEB     <a href="https://utox.org/" class=ah1 onclick="o(this)">https://tox.chat/download.html</a> </a></div><div class="mll"><span class=sp1></span> Email:     [email protected]    </div></div></div><div class="ml2"><div style="position:relative;top:50%;transform:translateY(-50%)"><div class="mlt" style="">Through a <img style="" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABYAAAAWCAMAAADza

Emails

[email protected]

URLs

http-equiv="Content-Type"
http-equiv="x-ua-compatible"

Signatures

Detect LockFile payload 2 IoCs

resource	yara_rule
behavioral2/memory/4176-0-0x00007FF6CA130000-0x00007FF6CA20C000-memory.dmp	family_lockfile
behavioral2/memory/4176-931-0x00007FF6CA130000-0x00007FF6CA20C000-memory.dmp	family_lockfile

LockFile
LockFile is a new ransomware that emerged in July 2021 with ProxyShell vulnerabilties.
ransomware lockfile
Lockfile family
lockfile
Renames multiple (3125) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Custom signature

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/4176-0-0x00007FF6CA130000-0x00007FF6CA20C000-memory.dmp	UPX
behavioral2/memory/4176-931-0x00007FF6CA130000-0x00007FF6CA20C000-memory.dmp	UPX

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4176-0-0x00007FF6CA130000-0x00007FF6CA20C000-memory.dmp	upx
behavioral2/memory/4176-931-0x00007FF6CA130000-0x00007FF6CA20C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\homebusiness2019r_trial-ul-oob.xrm-ms	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\skypeforbusinessentry2019r_prepidbypass-ppd.xrm-ms	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\onenote_k_col.hxk	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\apothecaryresume.dotx	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\it-it\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\readme.html	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ui-strings.js	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Trust Protection Lists\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrome.7z	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\ui-strings.js	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\skypeforbusinessr_trial-ul-oob.xrm-ms	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fi-fi\ui-strings.js	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\homebusinessr_retail2-ul-oob.xrm-ms	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_neutral_split.scale-200_8wekyb3d8bbwe\microsoft.system.package.metadata\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Paint_10.2104.17.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\id-ID\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\homestudent2019demor_bypasstrial180-ul-oob.xrm-ms	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\skypeservicebypassr_prepidbypass-ul-oob.xrm-ms	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ca-es\ui-strings.js	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sl-si\ui-strings.js	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\de-de\ui-strings.js	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\mondor_enterprisesub_bypass30-ul-oob.xrm-ms	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\personalr_retail-pl.xrm-ms	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\vi-VN\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\outlookr_retail-ul-phn.xrm-ms	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\professional2019r_trial-ppd.xrm-ms	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\proplus2019vl_mak_ae-ul-oob.xrm-ms	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\mondor_subtest2-ul-oob.xrm-ms	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_shared_single_filetype.svg	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-il\ui-strings.js	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fi-fi\ui-strings.js	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ml\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\standard2019vl_kms_client_ae-ul.xrm-ms	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sybase.xsl	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Trust Protection Lists\Sigma\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\2.0.1\Diagnostics\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\homebusinessr_oem_perp4-ppd.xrm-ms	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\microsoft.system.package.metadata\Autogen\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_unshare_18.svg	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\en\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..n-frameserverclient_31bf3856ad364e35_10.0.22000.469_none_a133f3a75bd38aed\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mapi.resources_31bf3856ad364e35_10.0.22000.184_ja-jp_5473bae72cd8b668\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..edia-base.resources_31bf3856ad364e35_10.0.22000.318_sv-se_bee1862af8325f07\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-o..t-storage.resources_31bf3856ad364e35_10.0.22000.184_uk-ua_d8515e72c894997e\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..alian-english-emoji_31bf3856ad364e35_10.0.22000.348_none_dfebd8ea89b5926c\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..dminflows.resources_31bf3856ad364e35_10.0.22000.184_bg-bg_0ed058355fa5ab14\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..lers-maps.resources_31bf3856ad364e35_10.0.22000.120_sk-sk_35700a0c38dab2e9\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..ehandlers.resources_31bf3856ad364e35_10.0.22000.282_ca-es_1f23399e535eb0aa\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\AppReadiness\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..onaries-kyrgyz-main_31bf3856ad364e35_10.0.22000.348_none_f60be7c1423b3a9c\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-taskbar-dll.resources_31bf3856ad364e35_10.0.22000.184_ro-ro_66f53625d30d863b\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\InputApp\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mff1be75b#\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\PolicyDefinitions\es-ES\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_10.0.22000.493_pt-br_7b97c5fba64fb582\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-l..terprises.resources_31bf3856ad364e35_10.0.22000.493_he-il_cb19bdcf3f15dee3\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-srumon-energy_31bf3856ad364e35_10.0.22000.65_none_1fdfe2452cad8179\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-taskbarcpl.resources_31bf3856ad364e35_10.0.22000.348_nl-nl_29634714500e4c95\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationCFFRasterizer\3.0.0.0__31bf3856ad364e35\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Data.Entity.Design\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-l..me-ppipro.resources_31bf3856ad364e35_10.0.22000.493_hr-hr_4022e317336609d0\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-o..t-storage.resources_31bf3856ad364e35_10.0.22000.184_pt-pt_b0c6354c069cd8ba\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-shell32.resources_31bf3856ad364e35_10.0.22000.184_fr-ca_efcb364556079eeb\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\rescache\_merged\425634766\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..ntmanager.resources_31bf3856ad364e35_10.0.22000.120_sl-si_fd30c8345466f227\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.JScript\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-l..me-ppipro.resources_31bf3856ad364e35_10.0.22000.493_zh-tw_bae65d763fdd4a97\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..randprintui-printui_31bf3856ad364e35_10.0.22000.348_none_d78ce78cf930fe6c\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..k-library.resources_31bf3856ad364e35_10.0.22000.120_vi-vn_85281452ddb8ab37\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.resources\v4.0_4.0.0.0_fr_b03f5f7f11d50a3a\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-l..erprisesn.resources_31bf3856ad364e35_10.0.22000.493_uk-ua_6bbfc38688ae9819\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-networkicon.resources_31bf3856ad364e35_10.0.22000.184_cs-cz_a292c09ab40f56ee\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..lcontrols-webfilter_31bf3856ad364e35_10.0.22000.493_none_2653c7e4a8df60fd\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\rescache\_merged\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lsa.resources_31bf3856ad364e35_10.0.22000.434_pt-pt_8484420e87f0bd2c\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-ntdll.resources_31bf3856ad364e35_10.0.22000.434_nb-no_1ebfc102692fde55\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-time-ptp-provider_31bf3856ad364e35_10.0.22000.434_none_7d5f9e6f9eb78368\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..eexplorer.resources_31bf3856ad364e35_10.0.22000.184_bg-bg_1bfd2fa0813239b0\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\System.ComponentModel.DataAnnotations\3.5.0.0__31bf3856ad364e35\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\Boot\PCAT\ko-KR\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\napcrypt\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_10.0.22000.120_ar-sa_02ef0d7d5fba00c2\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationBuildTasks.Resources\3.0.0.0_de_31bf3856ad364e35\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\INF\SMSvcHost 4.0.0.0\0411\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\v4.0_10.0.0.0_es_31bf3856ad364e35\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lsa_31bf3856ad364e35_10.0.22000.434_none_a1a8f28ee1fd30c0\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..handlers-appcontrol_31bf3856ad364e35_10.0.22000.37_none_731baff294cb3855\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-taskbar-dll.resources_31bf3856ad364e35_10.0.22000.184_fr-fr_c2bf3ce0737c556b\f\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Configuration.Resources\2.0.0.0_de_b03f5f7f11d50a3a\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Tools.v4.0.Framework\v4.0_10.0.0.0__b03f5f7f11d50a3a\WWAKKABN-LOCKFILE-README.hta	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Kills process with WMI 9 IoCs

defense_evasion

pid	Process
3684	WMIC.exe
4136	WMIC.exe
3912	WMIC.exe
3312	WMIC.exe
4808	WMIC.exe
5916	WMIC.exe
4472	WMIC.exe
4260	WMIC.exe
3248	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3684	WMIC.exe
Token: SeSecurityPrivilege	3684	WMIC.exe
Token: SeTakeOwnershipPrivilege	3684	WMIC.exe
Token: SeLoadDriverPrivilege	3684	WMIC.exe
Token: SeSystemProfilePrivilege	3684	WMIC.exe
Token: SeSystemtimePrivilege	3684	WMIC.exe
Token: SeProfSingleProcessPrivilege	3684	WMIC.exe
Token: SeIncBasePriorityPrivilege	3684	WMIC.exe
Token: SeCreatePagefilePrivilege	3684	WMIC.exe
Token: SeBackupPrivilege	3684	WMIC.exe
Token: SeRestorePrivilege	3684	WMIC.exe
Token: SeShutdownPrivilege	3684	WMIC.exe
Token: SeDebugPrivilege	3684	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3684	WMIC.exe
Token: SeRemoteShutdownPrivilege	3684	WMIC.exe
Token: SeUndockPrivilege	3684	WMIC.exe
Token: SeManageVolumePrivilege	3684	WMIC.exe
Token: 33	3684	WMIC.exe
Token: 34	3684	WMIC.exe
Token: 35	3684	WMIC.exe
Token: 36	3684	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3684	WMIC.exe
Token: SeSecurityPrivilege	3684	WMIC.exe
Token: SeTakeOwnershipPrivilege	3684	WMIC.exe
Token: SeLoadDriverPrivilege	3684	WMIC.exe
Token: SeSystemProfilePrivilege	3684	WMIC.exe
Token: SeSystemtimePrivilege	3684	WMIC.exe
Token: SeProfSingleProcessPrivilege	3684	WMIC.exe
Token: SeIncBasePriorityPrivilege	3684	WMIC.exe
Token: SeCreatePagefilePrivilege	3684	WMIC.exe
Token: SeBackupPrivilege	3684	WMIC.exe
Token: SeRestorePrivilege	3684	WMIC.exe
Token: SeShutdownPrivilege	3684	WMIC.exe
Token: SeDebugPrivilege	3684	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3684	WMIC.exe
Token: SeRemoteShutdownPrivilege	3684	WMIC.exe
Token: SeUndockPrivilege	3684	WMIC.exe
Token: SeManageVolumePrivilege	3684	WMIC.exe
Token: 33	3684	WMIC.exe
Token: 34	3684	WMIC.exe
Token: 35	3684	WMIC.exe
Token: 36	3684	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4136	WMIC.exe
Token: SeSecurityPrivilege	4136	WMIC.exe
Token: SeTakeOwnershipPrivilege	4136	WMIC.exe
Token: SeLoadDriverPrivilege	4136	WMIC.exe
Token: SeSystemProfilePrivilege	4136	WMIC.exe
Token: SeSystemtimePrivilege	4136	WMIC.exe
Token: SeProfSingleProcessPrivilege	4136	WMIC.exe
Token: SeIncBasePriorityPrivilege	4136	WMIC.exe
Token: SeCreatePagefilePrivilege	4136	WMIC.exe
Token: SeBackupPrivilege	4136	WMIC.exe
Token: SeRestorePrivilege	4136	WMIC.exe
Token: SeShutdownPrivilege	4136	WMIC.exe
Token: SeDebugPrivilege	4136	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4136	WMIC.exe
Token: SeRemoteShutdownPrivilege	4136	WMIC.exe
Token: SeUndockPrivilege	4136	WMIC.exe
Token: SeManageVolumePrivilege	4136	WMIC.exe
Token: 33	4136	WMIC.exe
Token: 34	4136	WMIC.exe
Token: 35	4136	WMIC.exe
Token: 36	4136	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4136	WMIC.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 5012	4176	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe	80
PID 5012 wrote to memory of 3684	5012	cmd.exe	81
PID 4176 wrote to memory of 4104	4176	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe	83
PID 4104 wrote to memory of 4136	4104	cmd.exe	84
PID 4176 wrote to memory of 3808	4176	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe	85
PID 3808 wrote to memory of 3912	3808	cmd.exe	86
PID 4176 wrote to memory of 3304	4176	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe	87
PID 3304 wrote to memory of 3312	3304	cmd.exe	88
PID 4176 wrote to memory of 3972	4176	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe	89
PID 3972 wrote to memory of 4472	3972	cmd.exe	90
PID 4176 wrote to memory of 728	4176	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe	91
PID 728 wrote to memory of 4260	728	cmd.exe	92
PID 4176 wrote to memory of 5296	4176	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe	93
PID 5296 wrote to memory of 4808	5296	cmd.exe	94
PID 4176 wrote to memory of 4000	4176	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe	95
PID 4000 wrote to memory of 3248	4000	cmd.exe	96
PID 4176 wrote to memory of 5416	4176	2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe	97
PID 5416 wrote to memory of 5916	5416	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-03-28_928f711e3168ee009b254ee8a3f9e48e_cobalt-strike_glassworm_icedid_lockfile_njrat_vidar.exe"
1⤵
- Drops startup file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic process where "name like '%vmwp%'" call terminate
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where "name like '%vmwp%'" call terminate
    3⤵
    - Kills process with WMI
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic process where "name like '%virtualbox%'" call terminate
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where "name like '%virtualbox%'" call terminate
    3⤵
    - Kills process with WMI
    - Suspicious use of AdjustPrivilegeToken
    PID:4136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic process where "name like '%vbox%'" call terminate
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3808
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where "name like '%vbox%'" call terminate
    3⤵
    - Kills process with WMI
    PID:3912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic process where "name like '%sqlservr%'" call terminate
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where "name like '%sqlservr%'" call terminate
    3⤵
    - Kills process with WMI
    PID:3312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic process where "name like '%mysqld%'" call terminate
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where "name like '%mysqld%'" call terminate
    3⤵
    - Kills process with WMI
    PID:4472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic process where "name like '%omtsreco%'" call terminate
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:728
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where "name like '%omtsreco%'" call terminate
    3⤵
    - Kills process with WMI
    PID:4260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic process where "name like '%oracle%'" call terminate
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5296
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where "name like '%oracle%'" call terminate
    3⤵
    - Kills process with WMI
    PID:4808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic process where "name like '%tnslsnr%'" call terminate
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where "name like '%tnslsnr%'" call terminate
    3⤵
    - Kills process with WMI
    PID:3248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic process where "name like '%vmware%'" call terminate
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5416
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic process where "name like '%vmware%'" call terminate
    3⤵
    - Kills process with WMI
    PID:5916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WWAKKABN-LOCKFILE-README.hta

Path C:\$Recycle.Bin\S-1-5-21-600123060-2148212387-2211176695-1000\WWAKKABN-LOCKFILE-README.hta
Size 26KB
SHA256 65c2125418461d4edf5b69e12eaa5b78bdce0c6ed0f94e8f972eef3ed3338c0c
MD5 01a800aa6cd9af905876bf66c4fbe686
SHA1 5ddb6d90b0e93542dc6af63a5d83caabcfa6f0c7
SHA512 32d44239be0fb3cd7209090fa5aefbd15bb1be2e83e8d766dcb7b188270c3498d5e323be1def6584d1d3d4a648109a49f7c2be06da8f86a54adb668b71c8468e
SSDEEP 768:f9btgPyzuoBRRRRu5OqSrXXXvXJXcRXQXvXPXNkRORfRCue2+Ux5Jy7fYu:f9btIyzuoBRRRRu5OqSrXXXvXJXcRXQq
TLSH
T1FFC27C338246B8799AEF4EC0E4D53F4C0EA0851FC5664188F95DB2D432C6BE9B85C9B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4176-0-0x00007FF6CA130000-0x00007FF6CA20C000-memory.dmp

Download

memory/4176-931-0x00007FF6CA130000-0x00007FF6CA20C000-memory.dmp