Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 18:30
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
- Size 7.6MB
- Sample260805-w5g49stdlc
- SHA256 9be6477cc2bb7cbf3b914be86742323e3f3b299fbc10c2e19d19eeb32cca8278
- MD5 5b414176060cd0a651d1d4409bf89792
- SHA1 8b91a5c60b2bac74b68a901fcae7dcb5deb230e5
- SHA512 5d5fb198a15f6fc96b573305fc0a59942af34e7116e66e3e646a4eca3ee7e997e46586a2fc9be3c5eccfae7ce756c1f976c9e4afc5d18db2c63a3a73aa2d28e5
- SSDEEP 49152:3qJtb2IygkEaSCpYqgT3S9tsgX8zEC8ULgCSA/Bkj0WeW4SkZP4sz9Mb2gkEaSiO:3nmad65TIOSA8fkZc2maNKd26+fkZcs
- TLSH T1D5864A16F2B88332E0B7D17EC0E26A69FA7130565B31CACB2245D66D1E677D2C536332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x000b0000000244b7-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x000b0000000244b7-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cliconfg.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\curl.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icacls.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tar.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\write.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wscript.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\compact.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\at.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regedit.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\comp.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\help.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\choice.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msdt.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\subst.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.1_none_1655d5e596a1ade0\netbtugc.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\r\PrintBrm.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\usocoreworker.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1151_none_4e193eb76ed5f8cb\r\wiaacmgr.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.19041.928_none_31fd477afc7b8278\PktMon.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\ImeBroker.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.19041.746_none_915a78ef54321214\f\SystemSettingsRemoveDevice.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_51cf02378fc26da3\f\SyncHost.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.746_none_49d38afb2289b178\r\netiougc.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.153_none_aa284d65c7bee591\f\upnpcont.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.19041.1_none_d7372edf29e45655\LanguageComponentsInstallerComHandler.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.19041.1266_none_b2317523477fbd48\r\lsass.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.423_none_c3eac275ecdf7e0a\f\NgcIso.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\r\LaunchTM.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.19041.928_none_0b17415ae0dd0379\r\hvc.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.84_none_65d0f4a4c6cd4975\r\Magnify.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.264_none_4a12028313046a9e\r\ntoskrnl.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_d848cc62b1883bca\r\cttunesvr.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1151_none_c86feb6936a97173\f\omadmclient.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.84_none_ee550b91ec0a7e82\f\MBR2GPT.EXE- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.19041.84_none_2c3254d57443e050\f\SrTasks.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.906_none_72b8b02e4865ebca\r\schtasks.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.264_none_911b6d2a51481d59\mavinject.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\BitLockerWizard.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_10.0.19041.1_none_3f67a7384812df13\ComSvcConfig.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.19041.746_none_64e9b1de23df7cf4\r\AppHostRegistrationVerifier.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.1_none_b4746d3aaf96ef0d\regedt32.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.19041.844_none_c606f47e6aa94b5b\hvsievaluator.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\r\sdclt.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\r\unsecapp.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.19041.1_none_15692775b14712c0\forfiles.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-label_31bf3856ad364e35_10.0.19041.1_none_1774c39d9e06c822\label.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_abd26b7610cb738e\r\AddSuggestedFoldersToLibraryDialog.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\r\winresume.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.19041.1_none_194488652435e51b\ieUnatt.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\UevTemplateBaselineGenerator.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.1202_none_c0150a0a443c0ffc\f\wbadmin.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\f\FsIso.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.19041.84_none_c43e71af69351575\f\dstokenclean.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.19041.1_none_5d525a67aae579a5\dpnsvr.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.1202_none_7f995fddf54c000c\r\SppExtComObj.Exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_e867a49a6e97813d\LaunchWinApp.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_ed5986fc58f1b817\SystemUWPLauncher.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_81cc87a43da05fd1\f\control.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icacls_31bf3856ad364e35_10.0.19041.1_none_f2fa56e679b879d1\icacls.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_2afd3bd8e33c2cf2\msinfo32.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.423_none_df344b9fe5390f25\r\AppResolverUX.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.84_none_b4499a04dddcc22e\ssh-add.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.264_none_0f23d07ed2574292\DiagnosticsHub.StandardCollector.Service.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_6c7de5b30e8f6071\f\BackgroundTransferHost.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.84_none_29cf9b86db5fb249\audit.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1266_none_ba0845abb58c8bdd\BioIso.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.19041.1_none_31d99128a3ae3145\WmsSelfHealingSvc.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_ec5eb439471de957\f\cleanmgr.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.19041.1_none_a18558d9ae23205d\scrnsave.scr- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.19041.1_none_ac65d58626f4027c\efsui.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.746_none_a9ff72b1a43fd663\f\DeviceCredentialDeployment.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\f\unsecapp.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.264_none_7517ff6e147bc8a9\f\pacjsworker.exe- 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_5b414176060cd0a651d1d4409bf89792_amadey_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2520
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 8.2MB
- SHA256 9e3c39db1480f4a42479b9e4366dc4f741ae75da10b92c24c5c6d62b88fc4172
- MD5 9c626d888a8b1d84434418c8cdab769f
- SHA1 6aaa1cdf035add9f1868a2e4e9f053a29adf6e36
- SHA512 4b35f41378a62043af51f394786ce8030fa09364010b47f9d3c7ce4a3b8350b660c8a2c0271ed1f751cc69ae2b6eb567f3469e46d5f3b98ae3a6c1b6310c1a6c
- SSDEEP 98304:3nmad65TIOSA8fkZc2maNKd26+fkZcMjov:3mad65Tf+PtaNKd26oPGov
- TLSH T109864A16F2B88332E077D17EC0E26A69EA7130565B31CACB2245D76C2E677D2C536732
- MD5 SHA1 SHA512 SSDEEP TLSH