Analysis
- max time kernel
149s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 13:58
Behavioral task
behavioral1
Sample
2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe
- Size 1.5MB
- Sample260511-rablsabx5w
- SHA256 54be8a0847c9559e54afcec58f589c1844c1bb14eed5a6c89ac96498ee180cdb
- MD5 be69ca075826e108d420044d236ffecd
- SHA1 39b145166b1a77c80a20f989d32ae8eb901556e9
- SHA512 dc16ee71a11a0339438ce5eb096fec1b9831006d8e9e9352986639e6145b8fdb7188620b09a39a8303e8e76652fdd32efbdd63c83d7389f018cfa80cabde9da7
- SSDEEP 24576:TIs/MMpd2JZyw9JLvOG7404o5nC/XdUJVJTt4D7/SAOZi+5v48cKff:3vqKw9dH40N5C/X8VBXdc2
- TLSH T159758D02B7E408A5E1B796398AB29715EA72BC611F30C7CF1355926E1E33BD18D39732
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msra.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\net.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\psr.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dccw.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\relog.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\replace.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\label.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Dism.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\takeown.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\whoami.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runas.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\write.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\help.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msdt.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{E82B72DE-E604-4D8F-B1D7-38905DC82757}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7z.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\x86_microsoft-windows-isoburn_31bf3856ad364e35_10.0.22000.1_none_e057a941e5a6e3d6\isoburn.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.22000.318_none_92049afacb4417d8\f\dtdump.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.22000.65_none_4f258ec343f09686\f\windeploy.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\r\AppVShNotify.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.22000.434_none_4a9fb8788572dd19\f\ldp.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.22000.282_none_fbdbe8fb711d9878\f\vfpctrl.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.22000.1_none_71324986934c6127\dccw.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\f\runexehelper.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmcfghost_31bf3856ad364e35_10.0.22000.1_none_7a72c4e477e7b25d\dmcfghost.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-format_31bf3856ad364e35_10.0.22000.1_none_7ccc80588ec2a649\format.com- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_5b46b110e29f5b31\runas.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.22000.434_none_95bd8d59818abcd7\r\nltest.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.22000.1_none_1b04230fd5e53bb5\verifiergui.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.22000.1_none_810efa0e3f0e1154\wermgr.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\f\Setup.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.22000.348_none_e313cfb919daa6b1\r\securekernel.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.318_none_2a48e0773b83147e\f\appidtel.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_10.0.22000.1_none_e59a7bd2a1bf4e0f\DataSvcUtil.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_da8c01e10676f001\sdbinst.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.22000.469_none_ddccf236be43e7c9\f\memtest.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.22000.120_none_e2284b7d90c8a180\r\iexplore.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.22000.469_none_e574fa2e821169ac\f\SystemSettingsBroker.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.22000.1_none_4dc986ddab447f27\IMJPDCT.EXE- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.318_none_b4bd4664802eaae9\r\CheckNetIsolation.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.22000.1_none_9d236d8db8081199\rstrui.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.22000.1_none_cddc7e5996b5a69e\cleanmgr.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_0384636b13b61c9e\poqexec.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.22000.120_none_68fb744ea962915c\conhost.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\r\LaunchTM.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.22000.1_none_1df835c1eb7ab0fb\DmNotificationBroker.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\tskill.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.22000.493_none_5c6bd6283c0b8362\r\ApplyTrustOffline.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.22000.282_none_eb29ce0d02c88de7\f\ntprint.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.22000.1_none_463e74ea2321487a\cttunesvr.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_d3608b4d6c1da7eb\subst.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.22000.1_none_f24d5bd1a5bd0380\resmon.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.22000.282_none_53574bb7dad4a93c\f\mstsc.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.493_none_2b6ddb5beae8ce90\r\hvix64.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\ScriptRunner.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.22000.1_none_9f5dc1b77d80d899\AppVClient.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.22000.65_none_cf76e66c2463ea3d\convertvhd.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\SenseCncProxy.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.22000.1_none_670ee9a3fc734020\ComputerDefaults.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.22000.120_none_8c1e5976c0145439\f\PkgMgr.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.22000.348_none_30982568e4ff2521\vmwp.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.22000.1_none_1779dd0615e565ea\MicrosoftEdgeCP.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.22000.1_none_3c7644c59e04550c\isoburn.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.22000.1_none_db5642aeddf1e2bb\PrintDialog.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.22000.65_none_9f7612893c144c09\f\smartscreen.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.22000.1_none_fca20623da1dc57b\perfmon.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_659b5b6317001d2c\runas.exe- 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x002b00000002b1d7-4.dat nsis_installer_2
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_be69ca075826e108d420044d236ffecd_cloudeye_elex_glassworm_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1720
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 2.0MB
- SHA256 4c9ce2d2b82a46caf08d2aa49199c5a327591471a25fe96fbd7db54578b9f331
- MD5 c000987bbfe21b8acde953d429196429
- SHA1 6dfa95dc7d56d5c9e152d58d53c2fd2c7b3f7325
- SHA512 143839effc61b9534de6650302b1b4a2964f5f6ceb1edf89cee38eedf492aa44ae7a9fc143fca42d27682b28cbc81e9a3dbf850bd64510686cbd5f5cba06fc73
- SSDEEP 24576:TIs/MMpd2JZyw9JLvOG7404o5nC/XdUJVJTt4D7/SAOZi+5v48cKfH0Le5ji0hmo:3vqKw9dH40N5C/X8VBXdccPji0Aj0
- TLSH T1C0A55B12B7E446A5E0B3D179CAB29749EA727C511B30C7CF0255926E2E33BD18D3A732
- MD5 SHA1 SHA512 SSDEEP TLSH