3def037453d0fe4b630b32ee2d33f78e26c34b0d21cd9702434ba8ad880e7356

Analysis

max time kernel
109s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Size 3.5MB
Sample260710-v23fcsdv8m
SHA256 3def037453d0fe4b630b32ee2d33f78e26c34b0d21cd9702434ba8ad880e7356
MD5 a69f63a4cdf1a83529691669630493fd
SHA1 3f30250f48fa137ff1743122b59adeea87b8cd88
SHA512 de17e03030806bf9b58b3f2808cdf52fee9e7f0b671499c13bd898c4b7150e62b1cf3270aaa1b0092a87e63f8c9790057c2ddc00bdccb91f68ae0ca6ff7497cf
SSDEEP 24576:Y3w/rpLiDKnxYaXJi2Y3MpbwnCvzb4cbmYdTyVDnSI8LUlFl5FpfTzAvL7dDaw8D:ncDkYOMwwnMb4PmyV9cY/v2aPji0Aj
TLSH
T1B1F57C11F665C571C06282708551DB9DA9327E119B328ECB62C57EEEBFB27C28D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5724	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3840	2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
5724	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_a69f63a4cdf1a83529691669630493fd_amadey_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3840

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 3.5MB
SHA256 3def037453d0fe4b630b32ee2d33f78e26c34b0d21cd9702434ba8ad880e7356
MD5 a69f63a4cdf1a83529691669630493fd
SHA1 3f30250f48fa137ff1743122b59adeea87b8cd88
SHA512 de17e03030806bf9b58b3f2808cdf52fee9e7f0b671499c13bd898c4b7150e62b1cf3270aaa1b0092a87e63f8c9790057c2ddc00bdccb91f68ae0ca6ff7497cf
SSDEEP 24576:Y3w/rpLiDKnxYaXJi2Y3MpbwnCvzb4cbmYdTyVDnSI8LUlFl5FpfTzAvL7dDaw8D:ncDkYOMwwnMb4PmyV9cY/v2aPji0Aj
TLSH
T1B1F57C11F665C571C06282708551DB9DA9327E119B328ECB62C57EEEBFB27C28D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe$

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$
Size 4.0MB
SHA256 3696da041d491a9c5a9bee8548b634975ae07406d7558c83b6fada862a3e5b72
MD5 348b5d32db4b9b89963f432f0ac06aa7
SHA1 d85a8d865ec78a172e33ac45b6aba4c5bf94fcb2
SHA512 834ddc77e27796742fa2edeaf4f9b59eae50a10e54c8897faab5da1be9737f07a2e0376faacbfb877d939bedb86e6ff42995f1d0a7862835e27a2eafbf305418
SSDEEP 49152:ncDkYOMwwnMb4PmyV9cY/v2aPji0Aj1T9t2:nhYOXwnS4rVKPwjoJ2
TLSH
T1E7167C11F6A4C575C066C2708951DA9DE9327D115B328ECB22C57EAEBFB27C28D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 4.0MB
SHA256 15db8ec1e4d4c890bf440ce4e5763b55ba93ea3c0e0e5798773ee82d1fc47f7a
MD5 fa140c8973c1636b4d2ec4d506bd90ee
SHA1 2037d274a75429a8d8705c7294f8ee89d67920dd
SHA512 6aa14933543ec94adbe91388ae036e89c891ac9bb814896e18da7dd12df3c0635d58119c4be371c9f39a814e083ef57d58c3930cf8075e0480435066423f2f03
SSDEEP 49152:ncDkYOMwwnMb4PmyV9cY/v2aPji0AjKPji0Aj:nhYOXwnS4rVKPwjo0jo
TLSH
T161165C11F664C571C072C2748591DA9DE9327D015B328ECB62C5BEAEBFB27C28936732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe$

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$
Size 3.6MB
SHA256 0cdaa27399d907cf6dac7211390132b612aa5c4753e50592310c37117ed37d61
MD5 e7ed7b0a088e09089c0ae420d1fae7f4
SHA1 d99b1bfc584df1170fb8c4e53e9c05eed0a664db
SHA512 fe9bc5ad05e5804a1d8a16c22bc362e0bd70a9f5b32e076bd842d9a97b2bc0cd7c1a7cd1457310e7dc7b4177fa06213466d29a5cfad4612ffa6ed7007bea0170
SSDEEP 24576:Y3w/rpLiDKnxYaXJi2Y3MpbwnCvzb4cbmYdTyVDnSI8LUlFl5FpfTzAvL7dDaw8g:ncDkYOMwwnMb4PmyV9cY/v2aPji0AjX
TLSH
T15B065B11F6648171C06A8270C651DA9DB9337D119B628ECB62C5BEBEBFB23C14976333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wordconv.exe

Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
Size 3.5MB
SHA256 9e98dc99aa3cba977e3cc22cacd38adab4e1db1d8f386b76b18f06eec021b785
MD5 ed0bddd371cb41dedbb558079ceb4e56
SHA1 8cf0a53b347f59b90e6b19a76e3ae40390d04221
SHA512 e27440f617ec9e09fd47f49fcffeb7fd825dc848dc312a9acd9a2c1f6f8382ce699617b333df889612c71680e6b185db93d506fd82ad99b8d13f1e8956da883d
SSDEEP 24576:Y3w/rpLiDKnxYaXJi2Y3MpbwnCvzb4cbmYdTyVDnSI8LUlFl5FpfTzAvL7dDaw8g:ncDkYOMwwnMb4PmyV9cY/v2aPji0Aj7
TLSH
T118067C11F665C571C06282708551DB9DA9327E119B328ECB62C57EEEBFB27C28D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wordconv.exe$

Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$
Size 4.0MB
SHA256 89a6a7d10ec9c308fc336aa429e254ce7849ec5042ea182f48d3ac3e4bb6d087
MD5 b4b7bc4a7a07a025ff70e10283d9c6a4
SHA1 4708d0e9d785b781b0088a02800dc17f6d2d027d
SHA512 08754348479a737936cc5573d31d1daa332060d7c34b630406c8238ab9282f52e5aa891a6da8cbadab5caed3765469f6fb30fd80cda78fd68ebc4a4b0cbf3ea2
SSDEEP 49152:ncDkYOMwwnMb4PmyV9cY/v2aPji0AjW8tDZqrKV:nhYOXwnS4rVKPwjo6m
TLSH
T132166C11F664C5B1C06282748561DAADEA327D115B328ECB62C5BEAEBFB33C14D36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 3.5MB
SHA256 bd88450b251693e060ab3228b58a3a6e2e51bc08cfee1bffaaf909bc40db8caa
MD5 ae8fb16c070e647125171e52b0830e2f
SHA1 a4c5bd48bd27c5c4440a5c56252d455b1dbda145
SHA512 0c432bf92cb1b086c8330e2ac4c5a8183e72d9d67f1db5caa8f391d45674980feb0fb47d23bf28f6557674a700bc6c8938571dd36a81879030e10db501b269ae
SSDEEP 24576:Y3w/rpLiDKnxYaXJi2Y3MpbwnCvzb4cbmYdTyVDnSI8LUlFl5FpfTzAvL7dDaw8e:ncDkYOMwwnMb4PmyV9cY/v2aPji0Aj5j
TLSH
T1EA067C11F665C571C06282708551DB9DA9327E119B328ECB62C57EEEBFB27C28D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe$

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$
Size 3.5MB
SHA256 f144fd6d4f0a5c5bcae0c51c93d1932c0e67f75be618568a3a6dd4670f59bdea
MD5 ac85ca081c71676505a94daabe3bf9a9
SHA1 57546083ed4176b5bc02f58d9c939777f79d54ff
SHA512 9503fbdf75a17ec68620275c8867914d703ac12ebf138421747115a31acb1e377b0e42f2f67abfdc61606f7131888c0e886960b3c5dd3e450e70964b07b23d58
SSDEEP 24576:Y3w/rpLiDKnxYaXJi2Y3MpbwnCvzb4cbmYdTyVDnSI8LUlFl5FpfTzAvL7dDaw8Z:ncDkYOMwwnMb4PmyV9cY/v2aPji0Aja
TLSH
T1AF067C11F665C571C06282708551DB9DA9327E119B328ECB62C57EEEBFB27C28D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveClose.exe$

Path C:\Users\Admin\AppData\Roaming\EnterMove\MoveClose.exe$
Size 3.7MB
SHA256 78e21a197c5d92b26e31736d803b2476a8a3badc5657838af57a2a4fb6094d6d
MD5 1b58804eaf50a0da357042d9f47c4e9a
SHA1 0aba7a32edec95ad1b8fed588765fbd01ffaeed7
SHA512 f9b14d4af2dd801f54fb84bb5496261f55176d3350bbee8d62c2d38f730dde2467c6ed0b0293a209475a91d09a3f10f125bc989a5064a533ea73db6bacb1fdf9
SSDEEP 49152:ncDkYOMwwnMb4PmyV9cY/v2aPji0AjDSO:nhYOXwnS4rVKPwjovSO
TLSH
T19B067C11F665C571C06282708551DB9DA9327E119B328ECB62C57EEEBFB27C28D36332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3840-1-0x0000000002180000-0x0000000002183000-memory.dmp

Download

memory/3840-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3840-18-0x0000000002180000-0x0000000002183000-memory.dmp

Download

memory/5724-11-0x00000000006E0000-0x00000000006F0000-memory.dmp

Download

memory/5724-25-0x00000000006E0000-0x00000000006F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads