Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/05/2026, 12:20
Behavioral task
behavioral1
Sample
2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
- Size 9.5MB
- Sample260506-phy1yaat31
- SHA256 fbddd149c509b21a4f1a98d93f0d1da170256fb619bbe87a69953501bd6bf7f9
- MD5 804add84b74effff5fab7b553fcde357
- SHA1 35607596a601c024266adc6e576afbf0bbf98bd8
- SHA512 7be7d4c7683a49e3d9d3b56e85f64215af3bb4aef105a1d32d92d25a72a337550ab7cb5db602b555149ede9db4bcc15e17b8582beae2a28b1587612119f2aed2
- SSDEEP 98304:dkYgrt0Laesvhj3COUALMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzME:WYGt0La39CZhMTfhcIWdf
- TLSH T17DA66B1272E404A6D16A9139CB224A3597B17C2A8FF2C6DF3110B6CE1E737D17A3A717
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x001300000001efa2-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x001300000001efa2-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\diskperf.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\resmon.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Dism.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\sc.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\label.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\compact.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\notepad.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\expand.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\findstr.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe -
resource yara_rule behavioral1/memory/4752-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x001300000001efa2-5.dat upx behavioral1/memory/4752-581-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/4752-3229-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\SendResolve.bat 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.153_none_ff44cfa7cb529ce3\r\lpksetup.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\ssh-agent.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1237_none_9ad73d125ac89655\f\bfsvc.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.19041.746_none_b0a3ebd117ec81d4\hh.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.1_none_1b0a4d6f748b99f5\bthudtask.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.19041.1_none_fad576d8cf74b38a\dispdiag.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..egistration-cmdline_31bf3856ad364e35_10.0.19041.1202_none_b3f538f2c4a648b2\f\dsregcmd.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.19041.1165_none_a82485b8f343811f\WaaSMedicAgent.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.264_none_223a5768a6257099\r\CustomShellHost.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.264_none_2649f3f85f3b49b1\cscript.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.572_none_90e9bab3cbbfd71a\djoin.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_5940d1a4fc4ad8f3\f\backgroundTaskHost.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1_none_0b4eeb140948562c\drvinst.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.1288_none_75442af2fe19577c\f\tcblaunch.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.19041.844_none_de5d9fe254d9f8c4\r\BioEnrollmentHost.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.19041.1_none_ab07dd0c9dcc66c0\RMActivate_ssp_isv.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_bd769d14dfd7d29d\f\sdbinst.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\CustomInstallExec.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\rdpshell.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_01dba454b887ba53\f\fltMC.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_216932a6d29366ce\typeperf.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.207_none_4054ef70f69f6ff9\wpr.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.19041.844_none_77a5d9aafae08e77\r\MDMAppInstaller.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.19041.1_none_99318cb064fcaf44\mscorsvw.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.19041.1_none_8bc62bc63a30d6fb\nslookup.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.19041.1_none_911aa822a342ea29\extrac32.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_f20ecec27517964b\f\PinningConfirmationDialog.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.19041.746_none_9ebd3ef9f0c794b5\WmsSvc.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\explorer.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\r\cscript.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.15805.0_none_9959f3c5e4eeac5f\cvtres.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.1266_none_ab5bdb26141e0be5\vmms.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.928_none_138fb436497565f4\f\directxdatabaseupdater.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.19041.117_none_610933d42d963a44\r\wsl.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\f\immersivetpmvscmgrsvr.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.19041.1288_none_91a5fb477b6af5a0\r\SIHClient.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.746_none_49d38afb2289b178\netiougc.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15805.0_none_c4e6302d398f7e04\mscorsvw.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.19041.1_none_e6d5a48c4da284da\aitstatic.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\winresume.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.19041.84_none_dc38e61c21c1b710\NetEvtFwdr.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.264_none_a71c9f7fdcd899c5\r\SearchApp.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\f\SgrmBroker.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\r\hvix64.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.19041.1_none_60b99066bd2f6d16\fsavailux.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.1_none_544850fb795d0a4f\LicensingUI.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.264_none_08acfd4a9926561a\f\wermgr.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.1288_none_75442af2fe19577c\tcblaunch.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.19041.1266_none_b9c280a4d350d170\MDMAgent.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1023_none_228521f0037fd996\r\PickerHost.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_4cb1ff2aa122b5dd\r\tttracer.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\r\appidcertstorecheck.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.19041.1_none_5efb81c4b092852b\cvtres.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\scp.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.84_none_9d98e005fb7852ca\SecurityHealthService.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.746_none_49d38afb2289b178\f\netiougc.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\SearchFilterHost.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1266_none_8fc08423f52c1606\f\wmlaunch.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_15114cf4ffe3136a\cmstp.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.19041.1_none_f0c3a71562899181\sessionmsg.exe- 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_804add84b74effff5fab7b553fcde357_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4752
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 10.1MB
- SHA256 aa3ec20fd4407d18bfb219f101e6f22b9bd312c1aad6dce7967f4473fc97085f
- MD5 0eb94ccd3cc3ef70fe67eb2f3564d7b6
- SHA1 7ce6eadef1f00e55862dec13301b47cdb0d96121
- SHA512 facae39466db164971e8939b489fddad43ea8e0674f4cee5677c2392a44997c4cf4b6d209544d3fc91e657b0d7be924fc3a8936ee03e15b7e54c5020605b19ae
- SSDEEP 98304:dkYgrt0Laesvhj3COUALMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMp:WYGt0La39CZhMTfhcIWd7on
- TLSH T1D8B67C12B2E404A6D06A9139CB628635D7B17C2A8FB1C7DF2150B2DE1E737D17A3A713
- MD5 SHA1 SHA512 SSDEEP TLSH