Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 03:05
Behavioral task
behavioral1
Sample
2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe
- Size 1.3MB
- Sample260730-dk76vaah48
- SHA256 377388bbcf486e6395b05b711068e528620121a3c58670ea56705380719d77ca
- MD5 a5cc94c83a402a2cbf0b11a81c93a19e
- SHA1 2302bc896fd678647587b57551ffb90275026b2d
- SHA512 50769ca43158246ba277fd415b52fab70b813bbf1d4a1b60b79989513407b2da611742e11ea393ad1579d7f3b85a0a75b12fd8050f0d0e19ad493467694cafaa
- SSDEEP 24576:RWIs/MMpd2JZDS/KWlGYDmhnMqfOdjJVJTt4D7/SAOZi+5v48cKfS:2vqLl3imhnMqfObVBXdcv
- TLSH T151558D06B3E448A2D073D139CAA69675EA727C115F20D7CF0368E79E1E337D1993A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\help.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\compact.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wscript.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\logagent.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runas.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\systray.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mode.com 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msra.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\where.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\psr.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\choice.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\find.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ftp.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\subst.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\NisSrv.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MsMpEng.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.0_none_58273f1b819405f8\aspnet_wp.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_4.0.15912.0_none_d8607d8709732f01\InstallUtil.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\r\nmscrub.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.26100.1_none_b0088cffd56138b1\djoin.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1_none_42b151b278e19c01\gpresult.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\notepad.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\mode.com- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.26100.1591_none_300773bc06dfa2f0\r\NarratorQuickStart.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.26100.1_none_21c930510a00a526\AppLaunch.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\r\EaseOfAccessDialog.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.26100.1150_none_5dcdaa573c9a6613\chkdsk.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.26100.1150_none_88a9016fd4655cfd\DisplaySwitch.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ribbons_31bf3856ad364e35_10.0.26100.1150_none_249c3478d7e5d3ca\Ribbons.scr- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.26100.1_none_bd03ac53a23b1a65\svchost.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.26100.1_none_6a91f0bc88e36d4b\Register-CimProvider.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\splwow64.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1591_none_6b60aaf7ce5c0f38\AtBroker.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.26100.1591_none_bc8d33c5efdd20ef\edpnotify.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\WDAGNetDiag.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.26100.1150_none_0c098ad82e53afc9\r\NetCfgNotifyObjectHost.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_6d1bd4f9d0cbd5f8\r\Robocopy.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.26100.1591_none_324c8f3af62cc63f\dtdump.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.26100.1150_none_ced6ba8820394f22\r\fodhelper.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.1150_none_e568c5433603cb28\msiexec.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_4.0.15912.0_none_447f4612d8b724d2\AddInProcess32.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.26100.1301_none_1a384873cd299392\curl.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.26100.1591_none_a525938a63d6ed42\r\licensingdiag.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.26100.1150_none_30e310bffc56cea9\ProximityUxHost.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.26100.1150_none_4e317f44e4f64723\LicenseManagerShellext.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_58449d9961468d2f\r\IMJPSET.EXE- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.26100.1_none_fe90da8a8133c864\SystemPropertiesAdvanced.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_1ac5fa16ecade80d\stordiag.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_msbuild_b03f5f7f11d50a3a_10.0.26100.1_none_2572c0d564c128f3\MSBuild.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.26100.1150_none_1ab61fff20240053\r\EASPolicyManagerBrokerHost.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.26100.1455_none_a3b05fa5b61855a2\r\bridgeunattend.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_10.0.26100.1_none_57ca55906b66d7b3\SystemPropertiesPerformance.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.26100.1150_none_35ab52a6398cdc65\SnippingTool.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_10.0.26100.1_none_d1331449ca23b444\wsqmcons.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.26100.1591_none_1f650d1288a260be\UserAccountControlSettings.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_10.0.26100.1150_none_686748f1a08de9d9\wiawow64.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.26100.1_none_6de688b2d1a76706\backgroundTaskHost.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6157b26c767f49a2\ttdinject.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.26100.1_none_b8da79967c00e6a5\verclsid.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.26100.1_none_54005e095094fede\LinqWebConfig.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15912.0_none_b4e0bc75d19eec35\ngen.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.1_none_748c8913fa792db3\cleanmgr.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\r\ApplyTrustOffline.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\r\SpatialAudioLicenseSrv.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.26100.1591_none_10d0d236e479806f\WinBioDataModelOOBE.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.26100.1591_none_1754f2ff6760d03e\WinSAT.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.26100.1150_none_3d037cdb2138716c\r\WmsSessionAgent.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\r\CameraBarcodeScannerPreview.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.26100.1_none_773b7b96c37cb0e9\DpiScaling.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.26100.1591_none_0065af33551e5c88\BdeUISrv.exe- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\NETSTAT.EXE- 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x000700000000697a-4.dat nsis_installer_2
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_a5cc94c83a402a2cbf0b11a81c93a19e_cloudeye_elex_glassworm_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5324
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 2.2MB
- SHA256 018e46353e1e03ddd401b7e0e7f7d534119274ad7916222b303441e74645b021
- MD5 33eaca3a35d3ebde39fa0b797a050a0a
- SHA1 88000b806d83d1a273ae9deb732596782e300faf
- SHA512 fed6dcb7afc297696b4b9883f9457f70d9cb6101e0c6dc060edbec97f3144db8dd0dcde58fd1bca98caf1be7d5aae81bf85615d0dcb83cb4122c18d2d6ecb347
- SSDEEP 49152:2vqLl3imhnMqfObVBXdcY/ezSC6vUzPvMHjyr:2YiVd1ezSC6v2XMHy
- TLSH T1C5B54B15B6B88363D0B3D079C5E6A67AFA7234425B3086CB0346D76D2E337E1893A735
- MD5 SHA1 SHA512 SSDEEP TLSH