Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/05/2026, 13:58
Behavioral task
behavioral1
Sample
2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe
- Size 1.5MB
- Sample260511-rablsabx5w
- SHA256 54be8a0847c9559e54afcec58f589c1844c1bb14eed5a6c89ac96498ee180cdb
- MD5 be69ca075826e108d420044d236ffecd
- SHA1 39b145166b1a77c80a20f989d32ae8eb901556e9
- SHA512 dc16ee71a11a0339438ce5eb096fec1b9831006d8e9e9352986639e6145b8fdb7188620b09a39a8303e8e76652fdd32efbdd63c83d7389f018cfa80cabde9da7
- SSDEEP 24576:TIs/MMpd2JZyw9JLvOG7404o5nC/XdUJVJTt4D7/SAOZi+5v48cKff:3vqKw9dH40N5C/X8VBXdc2
- TLSH T159758D02B7E408A5E1B796398AB29715EA72BC611F30C7CF1355926E1E33BD18D39732
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ddodiag.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\expand.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\find.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\net.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\notepad.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runonce.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\systray.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cipher.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\compact.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\compact.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\autofmt.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\efsui.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msdt.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hh.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\user.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\attrib.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wscript.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7z.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\r\ssh-keygen.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\1ea4214236e5d7010e9700001815341f.hvsiproxyapp.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.19041.1_none_13a24884d12d6915\vmplatformca.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVNice.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\f\uwfux.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_10.0.19041.906_none_1756861d80a1f0f5\inetinfo.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.844_none_64d33f8fb364398c\r\net1.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.19041.1202_none_d081cba554088913\r\slui.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.1151_none_d57e154a0a8460d3\f\pacjsworker.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_76e6fb38a70dbd6d\GameBarPresenceWriter.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\ScriptRunner.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\FXSCOVER.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_9d61200c734f61dd\LockApp.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.19041.1_none_bddafe5ea5731fa2\bridgeunattend.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.19041.1_none_1102b0871cbfcf0b\rdrleakdiag.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.19041.746_none_915a78ef54321214\f\SystemSettingsRemoveDevice.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\f\UNPUXHost.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.19041.1237_none_665f7346099d6350\r\bdechangepin.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_21d0a68ccdc67be8\r\wusa.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.19041.1_none_bbc1ad79155f896a\ExtExport.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.1266_none_d92abf553d8a282c\f\MusNotification.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.1_none_20aa8037cb026fdb\netbtugc.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.19041.1_none_bf6140efbe1a7808\csc.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1202_none_958d6588f50ca146\f\edpnotify.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mschedexe_31bf3856ad364e35_10.0.19041.1_none_958f624251c93843\MSchedExe.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.906_none_686405dc140529cf\f\schtasks.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\SysResetErr.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.746_none_2703bed0ba809808\GamePanel.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15805.0_none_7d38f956251354fe\mscorsvw.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\ea94772a36e5d701947000001815341f.tlsbln.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-format_31bf3856ad364e35_10.0.19041.1_none_e6ce9a885db7db4f\format.com- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.19041.1_none_da52541188969d5e\mcbuilder.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\shrpubw.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.19041.1_none_8a1c4327a89528e3\help.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_d22800313aa7eb5c\f\regedit.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.746_none_8ea10e81a707d623\dcomcnfg.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.746_none_79bfc5cb57157e98\LocationNotificationWindows.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_9204c42a031e28cf\f\appcmd.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.19041.1_none_c9a1700d547d6cde\powercfg.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.1266_none_adfc223229a335a6\f\MusNotifyIcon.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\SgrmBroker.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1_none_f79dcf01d5a416bd\msra.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_12e3d70535675c5f\f\dllhost.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\f\SystemSettings.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.19041.1_none_71d7deb9b2d1d29b\verclsid.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_b40cbfe2afd2c015\wowreg32.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.1_none_6c93021db54246b0\PasswordOnWakeSettingFlyout.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..appserver-licensing_31bf3856ad364e35_10.0.19041.746_none_84af66409a2cad45\tlsbln.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.82_none_2358a116979cc599\FlashUtil_ActiveX.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_c3054a007d804943\r\ChsIME.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\msil_inspectvhddialog_31bf3856ad364e35_10.0.19041.1_none_cc14df174755d4a1\InspectVhdDialog.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.19041.1_none_a6a8b89bc50eae31\cvtres.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\IMEPADSV.EXE- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.19041.1_none_85d1745a1d49397f\aspnet_wp.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.19041.1_none_f35caf2131abed9a\lsass.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-locator_31bf3856ad364e35_10.0.19041.1_none_8525a0b08bf57bbb\Locator.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_4c95cf26b3aa5907\f\CredentialUIBroker.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.19041.1_none_33c3e07f6cce5a52\dpapimig.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5f557b607e14f541\ByteCodeGenerator.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - NSIS installer 1 IoCs
resource yara_rule behavioral1/files/0x001300000002429a-4.dat nsis_installer_2
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4128
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 2.0MB
- SHA256 4c9ce2d2b82a46caf08d2aa49199c5a327591471a25fe96fbd7db54578b9f331
- MD5 c000987bbfe21b8acde953d429196429
- SHA1 6dfa95dc7d56d5c9e152d58d53c2fd2c7b3f7325
- SHA512 143839effc61b9534de6650302b1b4a2964f5f6ceb1edf89cee38eedf492aa44ae7a9fc143fca42d27682b28cbc81e9a3dbf850bd64510686cbd5f5cba06fc73
- SSDEEP 24576:TIs/MMpd2JZyw9JLvOG7404o5nC/XdUJVJTt4D7/SAOZi+5v48cKfH0Le5ji0hmo:3vqKw9dH40N5C/X8VBXdccPji0Aj0
- TLSH T1C0A55B12B7E446A5E0B3D179CAB29749EA727C511B30C7CF0255926E2E33BD18D3A732
- MD5 SHA1 SHA512 SSDEEP TLSH