Analysis
- max time kernel
113s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/04/2026, 11:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
- Size 1.2MB
- Sample260417-narffscv5m
- SHA256 48be10341791f6871aa17b5338a494c1c1e624c1693ec2e04a7dad667187a703
- MD5 da67ee99613ac3de975fbdac955c3367
- SHA1 00bed33169dc12805743155db5454000a306dba3
- SHA512 426325a5113a60c11aa81f70f8fd2bdf5cffaebd9b2c7123a8139c4e906a96f33221d161b3aebb139962e4198c8f996bc333411ce08b04ed1ffc6fb8bffb1977
- SSDEEP 24576:aMntq6Mntq6Mnt6xDx0uAO8SB6/5AANw243njv:XkkaDFAj+ew2Ez
- TLSH T118459F17EAA499E1EA7784748EA6C711AB357D310B10D6EBA374F3294E333C06E39711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4932 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$ 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4976 2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe 4932 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4976
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4932
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.2MB
- SHA256 48be10341791f6871aa17b5338a494c1c1e624c1693ec2e04a7dad667187a703
- MD5 da67ee99613ac3de975fbdac955c3367
- SHA1 00bed33169dc12805743155db5454000a306dba3
- SHA512 426325a5113a60c11aa81f70f8fd2bdf5cffaebd9b2c7123a8139c4e906a96f33221d161b3aebb139962e4198c8f996bc333411ce08b04ed1ffc6fb8bffb1977
- SSDEEP 24576:aMntq6Mntq6Mnt6xDx0uAO8SB6/5AANw243njv:XkkaDFAj+ew2Ez
- TLSH T118459F17EAA499E1EA7784748EA6C711AB357D310B10D6EBA374F3294E333C06E39711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe
- Size 1.3MB
- SHA256 eb6bc14a4c3dc2de680469822ca8d010725a2b958a741831d5eee617443f4288
- MD5 aba7d516fbddaf724a3f4f5bb81a3d98
- SHA1 f809d6a2b9808b8b6a280e001aa0633aad45b117
- SHA512 36b09c565ceebeb09273519ca13a8dcbe127d0a9668b070a3c8522e4f9c059a75b92ca08f6c1533507f983f758703fc47563ae3d5b3f94029959ba9d85ac4fe4
- SSDEEP 24576:aMntq6Mntq6Mnt6xDx0uAO8SB6/5AANw243nj2Gen:XkkaDFAj+ew2EFI
- TLSH T19C559E17AAA458E5EA7784748EA68711AB36BD310B10D7EF5374F3294E333C06E39B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 1.3MB
- SHA256 4f2ff1e050d391d3724b3c1817e2bd5ec47f6bd68791c1c39a5963167b4f22e0
- MD5 2aa9de5eb911e55ae64d962977dfb50d
- SHA1 317f2d9a206b36b9f6d97b94c111c9b503971074
- SHA512 cdb9ea05dab8b333df297fdf788b90f3edd8494ec65c99382013fe57845c2c701d532f687d5e184c60300bff6cf78e1813189795ab0c810514719ced61a3963b
- SSDEEP 24576:aMntq6Mntq6Mnt6xDx0uAO8SB6/5AANw243nj1TjE:XkkaDFAj+ew2ERw
- TLSH T153559E17AAA458E5EA7784748EA68711AB32BD710B1097EF5370F3294E337C06E3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.7MB
- SHA256 9c840c0cd4603e12464aa2bd083f06ca45092c36b4210980537b2f155f881b24
- MD5 a675a12e76dbaf0ee5dda6e4caf6a28f
- SHA1 54a54247718c8e785d4c593f5393ba15a320ca6c
- SHA512 6cdf48abed3d435a4c873b283805a6bad9ac306ffdbb2534180fadacf63f7007afc6076c130088bb1aa36b338cb359e894dc6e09ad1c80e005715c6e1a8140d1
- SSDEEP 24576:aMntq6Mntq6Mnt6xDx0uAO8SB6/5AANw243njb0Le5ji0hmxNrM:XkkaDFAj+ew2EvPji0Aj
- TLSH T167857C16FAA486B1E473C078C9E29759EA327C510B3086DB5364F3386E337D59E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe$
- Size 1.5MB
- SHA256 c7908e4cac6bcc6c7fb16492f7c00aaa33d0560d593e8810e4f888e6048b5656
- MD5 c761dca82d1ff472586e8e9c2cfab43d
- SHA1 03dd11e52b25a8b98661454b14b5201a3c2d017a
- SHA512 493c1217f874ddc9e7606830c276286ceb51efd48c51a95a108b195c738a57c9d4d3454d5dd0fc96491f61dfa88eeb9362eb7e5e48c01cbf28bd3e010e4b71f1
- SSDEEP 24576:aMntq6Mntq6Mnt6xDx0uAO8SB6/5AANw243njZZM9zFVSOS:XkkaDFAj+ew2EtZM9zfu
- TLSH T17F659E16ABA458E5E97784788EA68711EB327C610B10D6DF6374F3294E333C06E3EB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe
- Size 1.7MB
- SHA256 6e1f2072ff3bb52720b117f620fd9b501eda9a13a10d7b0c088592f481a4690a
- MD5 25e40b6b3421c0e7e1b77b5c670c91ad
- SHA1 6065f00301f8d5cdda17971d30729c6f05a29a28
- SHA512 90c18c6151e83470c9d5bdd6cca5a1a5bfa9dbba043db0fc63baa5c9dc4949e13c87f2c0fc8b5244e16e4b5153d893ef04d835ab0867f2fbce424b7f26baea02
- SSDEEP 24576:aMntq6Mntq6Mnt6xDx0uAO8SB6/5AANw243njbUOlZ7q/c9:XkkaDFAj+ew2EHUOlk09
- TLSH T173858E26EA6498E1D67B84788EA6C711E7317C210B10D7DBA374F3295E336D06E39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.3MB
- SHA256 b1645d55e1dd7f0cba0652f42cc7e3bd378124c4ef365b661de8df393f98dad1
- MD5 34bea4542cc2408dbf2e8600760fd431
- SHA1 ab8d7a377de76fb8b3c9998585f58fa225a2f8ba
- SHA512 e6d554cd9161488f7186ed545ceccfdbc0b493088dcec2b01c6b4b459f2737c64559f2c00f3da29d39870df44916cc9271c799bc2dbf43b64ae00bfe14c0156d
- SSDEEP 24576:aMntq6Mntq6Mnt6xDx0uAO8SB6/5AANw243nj3F:XkkaDFAj+ew2ER
- TLSH T1EA559E17EAA459E1EAA78434CEA6C711AB35BD610B1096FB6374F3398D333C06E39711
- MD5 SHA1 SHA512 SSDEEP TLSH