Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/05/2026, 02:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
- Size 4.4MB
- Sample260516-c7rxpsdv3q
- SHA256 8402c50d5560670fb3407a1b2ebb4f1ec2527af483cf6132dacf5c5491f045ee
- MD5 a6508b97db0397c84f311653c41b735b
- SHA1 a817a35ffe86dd99996daf0bc2c91b3686aebb6b
- SHA512 429743747c2c7c3b5d5e04c3d09f1575e69a80eba307064b5f87998398afabaa8491a49ca4e295a7b54c8823066244fba464525705a2cac6e0aae7adf2962804
- SSDEEP 49152:8X6YRUqhySXDU3JsJf6ND/Pp78WeS++D8ZUUMM24f+sYZSZYZr9jkhNm2y/B7:8HysZB+D82MDfxir9Smh
- TLSH T1D5263803B19584D8D049C174CE06D232AB61BC9947F162EF3694BBEA3A73AD43B3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1036 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe - Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCX34B8.tmp 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX48BB.tmp 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX457C.tmp 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX376A.tmp 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX44BF.tmp 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX37F8.tmp 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX43C3.tmp 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX452D.tmp 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX43A3.tmp 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX488B.tmp 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX34D8.tmp 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX3799.tmp 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCX3876.tmp 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCX4460.tmp 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCX48AB.tmp 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"2⤵
- Executes dropped EXE
PID:1036
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 1.0MB
- SHA256 7faa9692c39fc9fe043fa5c4c072c9a8bcaf15bc7f86167661fbca615b58fe67
- MD5 adf691184181708a186378a263e392d4
- SHA1 5116a9644aed46b37d915fa0004bc7afbf369e06
- SHA512 2ac9013c12a5a670574faaeb20eee737a7ae03dd5658cf0642894adfbf09f6951d4b45d3880d5246c29c75d42b36904af791702fe691e9189ba6d08d20b6a370
- SSDEEP 12288:f1NWURpbVuS3SdgpRRuuWNS86nHrUA9HVlK8SQBJ9t4f15rL:v3X6YRVn86n9kAJ9tA3L
- TLSH T1A9357E40F788CBE9E4178130C916C1B299257CAA8B50618F36D8BB3F7F736D8152DB66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\2026-05-16_a6508b97db0397c84f311653c41b735b_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
- Size 3.9MB
- SHA256 431c7c80c02e8e328d3056ddd6a7c59a254b8cc084d35380342a5df33a4f2f9a
- MD5 5ac5ddc4c27ecc203b2ed62bbe8fb8b9
- SHA1 a3c06b947549921d60d59917575df5ee5dfc472a
- SHA512 9834cdcc648b438fb3e3d7df333bbe1c344aef2059ba5cfe92fb37d246bbbaa8b3cef3f0c95e15e2b876971a180f6275eb6170ebf9db991cbc4e874e91436c62
- SSDEEP 49152:lqhySXDU3JsJf6ND/Pp78WeS++D8ZUUMM24f+sYZSZYZr9jkhNm2y/B7:UysZB+D82MDfxir9Smh
- TLSH T17F163803B19544D8D049C174CE4A9632EB62BC8947F162EF3690B7EA2E77AD03B3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH