Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
21/04/2026, 21:46
Behavioral task
behavioral1
Sample
2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
- Size 10.3MB
- Sample260421-1mp5dact9p
- SHA256 ebf1aeb2fb2cd774f6b6b9ce1f059730426aa22c878fbeb1db3ab1f16e2bf928
- MD5 34a225ac541916ddfc2fb3747d0561be
- SHA1 92aabb77cb6880ed2078adadb8d3647f150c4473
- SHA512 1e4d1bd627a6b20973a311bdd298af784da506b7b029e94a0e9dc565e5ee71b8a8b9dfa3463a686e19538a99583b2974ff6a039abfa2e6020203bbe247b60917
- SSDEEP 98304:6sGIUbYZfgs0QlxFTIOSA6+d8MUSXIYa3Y4z+:TU64s1TfuEU8IBtz+
- TLSH T1BCB66C1677E400F6E0AAD2398472457AE7B1B8265F32CB8F2560DA5E1F737D14D3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x001000000002ad90-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x001000000002ad90-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ktmutil.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mmc.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\userinit.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\control.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\resmon.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\finger.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sc.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\choice.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\control.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\label.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mode.com- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fontview.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tar.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sort.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\notepad.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runonce.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\systray.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\help.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PING.EXE 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\attrib.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/1452-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001000000002ad90-5.dat upx behavioral2/memory/1452-678-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/1452-3186-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\ClearSelect.cmd 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\ClearSelect.cmd- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.22000.1_none_1be9c0745b95a762\MpCmdRun.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.22000.469_none_ddccf236be43e7c9\memtest.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.22000.282_none_78d41497d781352f\r\SpeechModelDownload.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.22000.318_none_1e08617dd1895eb7\f\UtcDecoderHost.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.22000.1_none_ca8b72bbd453db4c\TapiUnattend.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\f\SearchFilterHost.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.22000.434_none_eb6ed0d1cadda675\f\dcdiag.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.22000.1_none_49632d3770877d59\aciniupd.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.22000.65_none_f3a35be8937453f0\TabTip.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.469_none_574c4adf3362fbca\explorer.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_3d11f25cbb74100a\r\msra.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.22000.1_none_a3d5ad1b3a087b4a\prevhost.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.22000.376_none_836023902a7c3e20\bcdedit.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.22000.1_none_f3552e31fa0ca962\WUDFHost.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.22000.1_none_b903dc9f79e461c1\sethc.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15806.256_none_7593da10f932a980\mscorsvw.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.469_none_3a8cfd7d7fe46760\wowreg32.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.22000.1_none_4b3b75ad087c3772\eventvwr.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.469_none_160103e31c4d8d88\r\SystemSettings.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.22000.71_none_ccb71d3ee4c7b8a6\ByteCodeGenerator.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.22000.1_none_397d6ed60254bd95\PackagedCWALauncher.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\cmproxyd.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.22000.1_none_d08b70dc5fb929d4\DpiScaling.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.22000.120_none_285ae36df9fb90ad\r\OOBENetworkConnectionFlow.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.22000.1_none_d7fdc61a4a1da73a\PrintBrmUi.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.22000.434_none_4f4ac04322f04123\r\PktMon.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.22000.1_none_0e45b35a878542f9\PickerHost.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\tskill.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.22000.100_none_1c26ef58a3003bf2\f\SystemSettingsAdminFlows.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_0f0554e930e1de1c\f\RMActivate_ssp.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_334ea48b976d3bd3\f\CHXSmartScreen.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\TextInputHost.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.22000.1_none_57e0cfd01d70414f\SystemPropertiesAdvanced.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.22000.282_none_a92d755764592be1\r\TokenBrokerCookies.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.22000.1_none_c4e0220059a427b2\CredentialUIBroker.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_c58bc93032642398\f\winrm.cmd- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.22000.348_none_68edda92a96b8e44\conhost.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.22000.65_none_64161fe87cb55cea\pcaui.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\AppVNice.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.469_none_71e2bda169e58aea\f\SpatialAudioLicenseSrv.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_97c4601a91ef2a4b\mfpmp.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sstext3d_31bf3856ad364e35_10.0.22000.71_none_e67840367b6dc817\f\ssText3d.scr- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.22000.1_none_5ba5eadfaddccaf4\wecutil.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.22000.41_none_1d0a15319901359b\f\PinEnrollmentBroker.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\chgusr.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..monotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_618940d4a376d501\f\MoNotificationUx.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx-netfxsbs10_exe_31bf3856ad364e35_10.0.22000.1_none_35b3f196fa600d12\NETFXSBS10.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.22000.348_none_30982568e4ff2521\f\vmwp.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\AppVShNotify.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.22000.469_none_265cec8f409ba4eb\HealthAttestationClientAgent.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.22000.493_none_674ce99b39869941\r\ntoskrnl.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_75b35e16f6608fe4\f\WerFault.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.376_none_d180c9ec46d962eb\f\splwow64.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.469_none_71e2bda169e58aea\r\audiodg.exe- 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_34a225ac541916ddfc2fb3747d0561be_cobalt-strike_coinminer_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1452
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 10.9MB
- SHA256 cea7a86803941070f3f8b1ddcfac5b09d2bb31acfe75995ff8a1514ef3732da7
- MD5 009ba8f04ff049e053b74125a2d61303
- SHA1 db9d76f886dace446329706f7415c64790fbdb0a
- SHA512 670d677189bd1e048644f75ba1c03ce534d40357893cef776776d8ca83d48203186ae22fd8198fcefee261c5690f16e9786b6e8cafbaeb5d00f36aeb209840db
- SSDEEP 98304:6sGIUbYZfgs0QlxFTIOSA6+d8MUSXIYa3Y4zSjoB:TU64s1TfuEU8IBtzEoB
- TLSH T108B66B1677E401F6E06AD2388472457AE6B1B8265F32CBCF2560DA5E1F737D14E3A322
- MD5 SHA1 SHA512 SSDEEP TLSH