Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 04:27
Behavioral task
behavioral1
Sample
2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
- Size 7.6MB
- Sample260604-e3fpzshz3s
- SHA256 21f0ac8e2d59a0fba0e84e64f91cdd0eddfbc5ad7179d2f60b480847e5540362
- MD5 942dfed035e72a10d00e2edec59c2e54
- SHA1 689eb2fc6905233822c76f5cdda3f3a0bb497184
- SHA512 541cf9439e13bce14b95e96174b9bd6706835c1630c78274ff0bfa8f75ffb3979742de0e1817eccf793c772884c00ad3ad5f57626e0a6cb97f4a728e8c13b655
- SSDEEP 49152:Zvq0usNDS5lSYcY/3YO+EaI8boQhfD6UDvxvykXk1rBsgyegFKvc4clwYiVBXdcT:ZbjNDS5lShEYO+EIDmFdzRi
- TLSH T1C98680036E2DDD31E06F7DB4C854D7895B197D108A637A973CE2BE9EEA726C07D18220
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\raserver.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wscript.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fc.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\whoami.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\printui.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\takeown.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\where.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\curl.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\explorer.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mshta.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\find.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hh.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icacls.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\relog.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\subst.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\timeout.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/5004-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000c000000026fd3-5.dat upx behavioral2/memory/5004-1014-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/5004-3194-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.22000.1_none_a3f177b107b8418a\dmclient.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.22000.120_none_64d060998298410d\f\FileExplorer.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.22000.1_none_dd4fd4f5b71d35a0\HvsiSettingsWorker.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.22000.1_none_f159656ce5b94cb8\tpmvscmgrsvr.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\msil_wsatconfig_b03f5f7f11d50a3a_10.0.22000.1_none_a5a77d19762002a4\WsatConfig.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx-netfxsbs10_exe_31bf3856ad364e35_10.0.22000.1_none_35b3f196fa600d12\NETFXSBS10.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.22000.120_none_e2284b7d90c8a180\f\iexplore.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.22000.1_none_c4795c793bc04b9f\hvsiproxyapp.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.22000.120_none_b1071c7fd34df0e8\fixmapi.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.22000.1_none_bfb8876999af625a\cmstp.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.22000.1_none_dcb8e29764e006a4\vbc.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.22000.1_none_9a93850442801f9d\odbcad32.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.22000.282_none_85f8b97e4dbf9185\wpnpinst.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.22000.1_none_30a652d7a8697eb8\BitLockerDeviceEncryption.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\ScreenClippingHost.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\r\TextInputHost.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.22000.1_none_0f97a0bb2461b363\WmiApSrv.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.282_none_6b2d7072c225a87c\f\WerFaultSecure.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.22000.1_none_010c2089229afa0b\fsavailux.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\4833c22ad03dd801643e0000585e205e.nfsclnt.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.22000.1_none_43d2192836b57f90\PackagedCWALauncher.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.318_none_349d8ac96fe3d679\appidtel.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.22000.1_none_88db7a29937b79fa\tasklist.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-userinit_31bf3856ad364e35_10.0.22000.37_none_c87c050022130145\userinit.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.22000.1_none_19ec4b0d58c2755e\mofcomp.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_10e4c14208d6d2d3\f\wmpshare.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\r\runexehelper.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.22000.318_none_fbf48b4fce07c440\f\tcblaunch.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.22000.1_none_04376727db53ed5d\setup_wm.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.22000.71_none_bcb9c63bb991a4c6\f\msconfig.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.318_none_2da4853532607174\f\audit.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_bsdtar_31bf3856ad364e35_10.0.22000.434_none_5be11e6025939378\f\tar.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.22000.1_none_0f7f7612eae8630f\SecEdit.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\Microsoft.Uev.SyncController.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.22000.65_none_99e34b544b7754a7\f\provtool.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.22000.1_none_9af0ff62d9f93c09\colorcpl.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.120_none_f6a11a34378fa70f\StartMenuExperienceHost.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_vmconnect_31bf3856ad364e35_10.0.22000.1_none_e679ca0f4ee761e2\vmconnect.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseSampleUploader.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.22000.1_none_014b03c8301af3f9\WinMgmt.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.22000.282_none_53574bb7dad4a93c\f\mstsc.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\lpremove.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.120_none_83fc3979242f7e2e\f\CustomShellHost.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ipconfig_31bf3856ad364e35_10.0.22000.1_none_acd238f8511877bc\ipconfig.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpremove.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.22000.1_none_e4c8388cb4892f1c\BackgroundTransferHost.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.22000.318_none_1e08617dd1895eb7\f\UtcDecoderHost.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upfc_31bf3856ad364e35_10.0.22000.1_none_fd692349212c38d0\upfc.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\ScriptRunner.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.22000.469_none_265cec8f409ba4eb\f\HealthAttestationClientAgent.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.469_none_160103e31c4d8d88\SystemSettings.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\WebExperienceHostApp.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.22000.318_none_2cba3682f8941339\DiagnosticsHub.StandardCollector.Service.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpksetup.exe- 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_942dfed035e72a10d00e2edec59c2e54_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5004
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 8.2MB
- SHA256 fcdc09f19a5a019256b5db3bacd7caa6f5fda770c3e0f936c6177c3d0d6154d6
- MD5 de0b7dd8cf7517f22846e5a6893410fa
- SHA1 e1af67cb2fe2633449150ce408067f87914e4b8e
- SHA512 1f9db6bd02622114aa809658e96749e190bc1be33394f908018a7c8b5e4d6db7789bf3b706f79a5d6201b2a3c6eebc847e4dfe93971b2ccb472b1bf54fabc5f0
- SSDEEP 49152:Zvq0usNDS5lSYcY/3YO+EaI8boQhfD6UDvxvykXk1rBsgyegFKvc4clwYiVBXdcS:ZbjNDS5lShEYO+EIDmFdzROjoT
- TLSH T17586A303AE2DDE31E02F7DB4C854D7899B297D1046627A973DE1BE9DEE726C07D18220
- MD5 SHA1 SHA512 SSDEEP TLSH