Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 03:05
Behavioral task
behavioral1
Sample
2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe
- Size 1.3MB
- Sample260730-dk76vaah48
- SHA256 377388bbcf486e6395b05b711068e528620121a3c58670ea56705380719d77ca
- MD5 a5cc94c83a402a2cbf0b11a81c93a19e
- SHA1 2302bc896fd678647587b57551ffb90275026b2d
- SHA512 50769ca43158246ba277fd415b52fab70b813bbf1d4a1b60b79989513407b2da611742e11ea393ad1579d7f3b85a0a75b12fd8050f0d0e19ad493467694cafaa
- SSDEEP 24576:RWIs/MMpd2JZDS/KWlGYDmhnMqfOdjJVJTt4D7/SAOZi+5v48cKfS:2vqLl3imhnMqfObVBXdcv
- TLSH T151558D06B3E448A2D073D139CAA69675EA727C115F20D7CF0368E79E1E337D1993A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\provlaunch.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dialer.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\compact.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\bootcfg.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cacls.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winver.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\control.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\expand.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\expand.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\printui.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\secinit.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\reg.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\calc.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mode.com 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\convert.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.19041.1266_none_92496ac84272f5f1\LegacyNetUXHost.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.19041.84_none_2c3254d57443e050\f\SrTasks.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.19041.1_none_f8d6d7787573666b\powershell_ise.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.19041.746_none_e540b68b09558f5a\f\LockScreenContentServer.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\r\usocoreworker.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.572_none_90e9bab3cbbfd71a\r\djoin.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.19041.1_none_15692775b14712c0\forfiles.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.19041.1_none_77365f2eaca89f2a\DeviceEnroller.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_1befc89391e44c23\convert.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.1266_none_c4b179e0b12fe4b9\r\winload.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.19041.746_none_a5986eca8fd4063b\f\CastSrv.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.19041.746_none_a89acde4afbab635\r\mip.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.1_none_bc34aea0c10c4a99\setupugc.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.1_none_1b0846060f09c968\gpscript.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.19041.928_none_0b17415ae0dd0379\hvc.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.19041.844_none_93c03ca99a47dc8f\omadmprc.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.746_none_ff52abd5cb47bbe1\r\lpremove.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_abd26b7610cb738e\f\AddSuggestedFoldersToLibraryDialog.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.19041.1_none_8b53de27def16277\eventcreate.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.746_none_dfcf5b6f69f16f7a\rdpclip.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.1202_none_05cd606e025d0d96\f\TrustedInstaller.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1_none_d67c2e3d05659825\winrs.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_15e5bfcd83a1911a\AssignedAccessLockApp.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.264_none_fe5852f864c5941f\f\wermgr.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_wpf-presentationfontcache_31bf3856ad364e35_10.0.19041.1_none_bb8aa452b18b9835\PresentationFontCache.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\f\ApplyTrustOffline.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskkill_31bf3856ad364e35_10.0.19041.1_none_db6f0c88fb6e127a\taskkill.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.19041.1_none_a2b9da391bff31c4\hdwwiz.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_installutil_b03f5f7f11d50a3a_10.0.19041.1_none_3c6036d4b220f210\InstallUtil.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_c42bf1ebf80a8661\isoburn.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1_none_4028e460f6e7e25b\SettingSyncHost.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.19041.746_none_915a78ef54321214\SystemSettingsRemoveDevice.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\f\LsaIso.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_1d38815769c81e5a\f\dllhost.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\r\wslconfig.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.1_none_f59d207965b1bbc3\ShapeCollector.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.19041.1288_none_23aa03725ec9354a\wuauclt.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.19041.1_none_b79f30aeb967a64a\dvdplay.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.19041.1023_none_9583d52fd3076014\f\SystemSettingsAdminFlows.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\vds.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_81cc87a43da05fd1\r\control.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.19041.1_none_f1d9ebd2fe6dc15b\reg.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.19041.1266_none_b9c280a4d350d170\MDMAgent.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.1_none_aa1fc2e87b362d12\regedit.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-ping_31bf3856ad364e35_10.0.19041.1_none_53ab1b93e0160a53\RpcPing.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.19041.746_none_58702f801199ce06\NetCfgNotifyObjectHost.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_1d907c422e447b14\dsdbutil.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\BitLockerWizardElev.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\WMIADAP.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\r\explorer.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-diagnostic-results_31bf3856ad364e35_10.0.19041.1_none_ded7404f8608d19f\MdRes.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.1_none_3ccd00f4f3f0b0c9\net1.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.1288_none_e0f8082a6952ce81\ntoskrnl.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.1202_none_7f995fddf54c000c\SppExtComObj.Exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.1_none_b3dc6ec86265288d\CertEnrollCtrl.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setx_31bf3856ad364e35_10.0.19041.1_none_6267e352b86de969\setx.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..egistration-cmdline_31bf3856ad364e35_10.0.19041.1_none_f526198caecd7792\dsregcmd.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.985_none_c3639a9e3ab1a351\WindowsSandboxClient.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - NSIS installer 1 IoCs
resource yara_rule behavioral1/files/0x0005000000023208-5.dat nsis_installer_2
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2120
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 1.8MB
- SHA256 62dedac08479d1a9298e4079e54db59b89df0bab47d4188e4dd3720d13b95a83
- MD5 3f482a8cc3d6de7bb24178cb9793824d
- SHA1 4b3fdbb73ddc3e7f020b9e4599000e388f97c576
- SHA512 97c3150a1546bcd326eab3c7ba63d89195c0f188512ec4f9f4c41785c402b8f3836f546b5c1c6d9a058819bfee5e959d2eafb6ba258134cd974e12b09e7cd032
- SSDEEP 24576:RWIs/MMpd2JZDS/KWlGYDmhnMqfOdjJVJTt4D7/SAOZi+5v48cKfg0Le5ji0hmx5:2vqLl3imhnMqfObVBXdcXPji0Ajf
- TLSH T115956B16F7A44671D073C179C9E2967AEA7238425B30C6CB0355D76D2F33BE18A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH