48be10341791f6871aa17b5338a494c1c1e624c1693ec2e04a7dad667187a703

Analysis

max time kernel
115s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/04/2026, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Size 1.2MB
Sample260417-narffscv5m
SHA256 48be10341791f6871aa17b5338a494c1c1e624c1693ec2e04a7dad667187a703
MD5 da67ee99613ac3de975fbdac955c3367
SHA1 00bed33169dc12805743155db5454000a306dba3
SHA512 426325a5113a60c11aa81f70f8fd2bdf5cffaebd9b2c7123a8139c4e906a96f33221d161b3aebb139962e4198c8f996bc333411ce08b04ed1ffc6fb8bffb1977
SSDEEP 24576:aMntq6Mntq6Mnt6xDx0uAO8SB6/5AANw243njv:XkkaDFAj+ew2Ez
TLSH
T118459F17EAA499E1EA7784748EA6C711AB357D310B10D6EBA374F3294E333C06E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5112	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe

Drops file in Windows directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2716	2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
5112	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_da67ee99613ac3de975fbdac955c3367_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2716

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe$

Path C:\905c0769f9a06c95a24ddf945\patcher.exe$
Size 1.2MB
SHA256 48be10341791f6871aa17b5338a494c1c1e624c1693ec2e04a7dad667187a703
MD5 da67ee99613ac3de975fbdac955c3367
SHA1 00bed33169dc12805743155db5454000a306dba3
SHA512 426325a5113a60c11aa81f70f8fd2bdf5cffaebd9b2c7123a8139c4e906a96f33221d161b3aebb139962e4198c8f996bc333411ce08b04ed1ffc6fb8bffb1977
SSDEEP 24576:aMntq6Mntq6Mnt6xDx0uAO8SB6/5AANw243njv:XkkaDFAj+ew2Ez
TLSH
T118459F17EAA499E1EA7784748EA6C711AB357D310B10D6EBA374F3294E333C06E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrCEF.exe$

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
Size 1.9MB
SHA256 2e7969ffe49b872d025b27086ff73d5fbd3b76555ab879e198fa8ee724dbf1ff
MD5 1db93b61e350f2f62267f02f0579cce6
SHA1 23667534ea2e701b5f68d975c2268d0fbb2cd066
SHA512 4b4b92459add121e612f7109e9a83ebd726967d201c7d81b260765f5e900f7e3acaba9c02d8b8c70e60f3a6575adaf99c862b0f2ed6b8134f6e29e8dc5dbebf4
SSDEEP 24576:aMntq6Mntq6Mnt6xDx0uAO8SB6/5AANw243njiVkGDvQGs94iGWWdTxT5f5EnNlv:XkkaDFAj+ew2EeVk0QGTvntQb
TLSH
T185958D27A6A816E5E5BAC178CA678602FB317C22072197DB4274F3694F336D06F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroTextExtractor.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
Size 1.2MB
SHA256 2a0b2acc3bc7eefddc10feb0e83a3bc1d74d8791cd056f1731254e6ce112254e
MD5 0349a0b9a059f7e49fedd75dd159f356
SHA1 41865ef4e76c670a2733edf0aeaa8c475b53c521
SHA512 5810b068ef201dfc8db1fb5dfe3e39d8b26b263c6ba6136cb4cdb627ae4fb6595aa3afd457238ce12e3415fe28b4bddcc4f974651b99cc373273723c4e9ba7f9
SSDEEP 24576:aMntq6Mntq6Mnt6xDx0uAO8SB6/5AANw243njm0:XkkaDFAj+ew2E60
TLSH
T1CE559F17EAA498E1EA7784748EA6C711AB357D310B10D6EBA374F3294E337C06E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe$

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$
Size 1.3MB
SHA256 4f2ff1e050d391d3724b3c1817e2bd5ec47f6bd68791c1c39a5963167b4f22e0
MD5 2aa9de5eb911e55ae64d962977dfb50d
SHA1 317f2d9a206b36b9f6d97b94c111c9b503971074
SHA512 cdb9ea05dab8b333df297fdf788b90f3edd8494ec65c99382013fe57845c2c701d532f687d5e184c60300bff6cf78e1813189795ab0c810514719ced61a3963b
SSDEEP 24576:aMntq6Mntq6Mnt6xDx0uAO8SB6/5AANw243nj1TjE:XkkaDFAj+ew2ERw
TLSH
T153559E17AAA458E5EA7784748EA68711AB32BD710B1097EF5370F3294E337C06E3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe$

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
Size 1.3MB
SHA256 b1645d55e1dd7f0cba0652f42cc7e3bd378124c4ef365b661de8df393f98dad1
MD5 34bea4542cc2408dbf2e8600760fd431
SHA1 ab8d7a377de76fb8b3c9998585f58fa225a2f8ba
SHA512 e6d554cd9161488f7186ed545ceccfdbc0b493088dcec2b01c6b4b459f2737c64559f2c00f3da29d39870df44916cc9271c799bc2dbf43b64ae00bfe14c0156d
SSDEEP 24576:aMntq6Mntq6Mnt6xDx0uAO8SB6/5AANw243nj3F:XkkaDFAj+ew2ER
TLSH
T1EA559E17EAA459E1EAA78434CEA6C711AB35BD610B1096FB6374F3398D333C06E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

integrator.exe$

Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
Size 1.6MB
SHA256 d709b1e22317571ccfbafcb4041a14411a0c9ebba22b21fe09573ce9ca361cbe
MD5 b18c7e667dee6d42b24589242d497222
SHA1 619f2ec2a6f4e3c1d234c098f95d644ff3f1efdf
SHA512 23d889dd1223b61641d5eac4151bd3f306d7cb16b6e8dd16467a9d3f9dd360f84f7533da1670e61fd62d29cfa0c33d959acc6a0326a214372facca9f0ffc8772
SSDEEP 24576:aMntq6Mntq6Mnt6xDx0uAO8SB6/5AANw243njG3npi63iC:XkkaDFAj+ew2EqXpiMh
TLSH
T1F5757D12B7E494B5F6B346349EB582119B36BC610F30D6DF63A4B71D4D326C0AE39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.exe$

Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\python3.exe$
Size 1.4MB
SHA256 5760bc0dbc16765461b4aacd2365a9c7c02ca67e5604602d8e319fd744da4125
MD5 c224ac6065f2691034e2a9ecdecd497b
SHA1 a92a2f96a6ae8d2d91abd97ed3ca79729c7dcb51
SHA512 0995d6f83bfc72b55ff67fdfd8f9fc538f214bf84e507dddf10f1f8214290d227abb9717b9736ec7df6e667e5e58097f586cbb0d0be648728044e316736ce7f9
SSDEEP 24576:aMntq6Mntq6Mnt6xDx0uAO8SB6/5AANw243nj3V+PAk2hMH3:XkkaDFAj+ew2Eri2WH3
TLSH
T11165AF22BBA458F2E57784748EA6C725AB35BD210B1192DBA374F32D4E337C05E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dfsvc.exe$

Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
Size 1.2MB
SHA256 3bd85a4dda0357f8da0f49ff3f4aec0f635c984378d10741163a422ff86fb966
MD5 c2aaa6594906a252ea6af37946d3d106
SHA1 490430e77b50115ebe2794775d310ccd97b83062
SHA512 eeff6b7a25a5b78cb070339da712c954033b30493a36c7dc07cf4b60ec3682ab3249b903bd7651caa178b564fb6e887b063789d32f5dee991c72ca286f8cb0a8
SSDEEP 24576:aMntq6Mntq6Mnt6xDx0uAO8SB6/5AANw243nj6lt:XkkaDFAj+ew2E
TLSH
T1D945AF17EAA498E1EA7784748EA6C711AB357D610B10D6EBA374F3294E333C06F39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2716-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2716-1-0x0000000002130000-0x0000000002132000-memory.dmp

Download

memory/2716-78-0x0000000002130000-0x0000000002132000-memory.dmp

Download

memory/2716-79-0x00000000029B0000-0x0000000002A8A000-memory.dmp

Download

memory/5112-15-0x0000000000640000-0x0000000000680000-memory.dmp

Download

memory/5112-81-0x0000000000640000-0x0000000000680000-memory.dmp

Download

memory/5112-80-0x0000000002AA0000-0x0000000002B7A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads