Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 04:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
- Size 4.9MB
- Sample260808-fepteszhmf
- SHA256 fad5cdb675b04dd8c1fa903bc1d7bb710662b8f531b74103b89853d4045f3055
- MD5 bf460be8ec8dbbd588da72d7a9b0d8f8
- SHA1 e64482f5a25151d5d747a2f4b73d5668690de4d6
- SHA512 c07e252e811642fab7197f1ee6fe9648ee451f1ac85d96a0517efffbb6217370bc0c42506c4e70c9996bd497177d087d5cd142e2c0fd013a72b8262424045a8b
- SSDEEP 49152:NgrfGh2j4s5M1hiakTi7hzSZfOVgcFarQsX7ysOtnDdlH8wQAxx22dqhl9qPURPz:G152OEt7H87oS9qMRPld
- TLSH T1B436070673F81388E1F7867C96B65616CA76BC198B21C7CF0160A15E1E33AE58D79B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes dropped EXE 9 IoCs
pid Process 756 svchost.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 1080 svchost.exe 1084 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 4484 icsys.icn.exe 4984 explorer.exe 4424 spoolsv.exe 1692 svchost.exe 4284 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe svchost.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe svchost.exe File opened for modification C:\Program Files\dotnet\dotnet.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe svchost.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe svchost.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe svchost.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe svchost.exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe File opened for modification C:\Windows\svchost.exe explorer.exe File opened for modification C:\Windows\svchost.exe svchost.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File created C:\Windows\svchost.exe 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe - System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icsys.icn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4484 icsys.icn.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4984 explorer.exe 1692 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 4484 icsys.icn.exe 4484 icsys.icn.exe 4984 explorer.exe 4984 explorer.exe 4424 spoolsv.exe 4424 spoolsv.exe 1692 svchost.exe 1692 svchost.exe 4284 spoolsv.exe 4284 spoolsv.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2740 wrote to memory of 756 2740 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 85 PID 756 wrote to memory of 2304 756 svchost.exe 86 PID 2304 wrote to memory of 1084 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 88 PID 2304 wrote to memory of 4484 2304 2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe 89 PID 4484 wrote to memory of 4984 4484 icsys.icn.exe 90 PID 4984 wrote to memory of 4424 4984 explorer.exe 91 PID 4424 wrote to memory of 1692 4424 spoolsv.exe 92 PID 1692 wrote to memory of 4284 1692 svchost.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\users\admin\appdata\local\temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exec:\users\admin\appdata\local\temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe4⤵
- Executes dropped EXE
PID:1084
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe5⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE6⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe7⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4284
-
-
-
-
-
-
-
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1080
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
- Size 4.9MB
- SHA256 b35fe47a0db83e6210f6b1f6f5d412d67d681c8da4c3de301f50da3618eeadf5
- MD5 c0943f28102b51179c91209fd03c1c9e
- SHA1 7ee65fbe5745e5738095ec2378d3106330acccba
- SHA512 4bbac38814e53a71233c1e51575826d4d5fd8a2c2a469b7f92aa3ebc0755ce13a7494846138f4a5e793235287d238893a4a0eca9337fdd9172ca23fcf7e34a8a
- SSDEEP 49152:t+rfGh2j4s5M1hiakTi7hzSZfOVgcFarQsX7ysOtnDdlH8wQAxx22dqhl9qPURP8:0152OEt7H87oS9qMRP8
- TLSH T15D36071673F81288E1F7867C96B75616CA72BC198B21C7CF0160A15E1E33AE58D79B33
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
- Size 4.7MB
- SHA256 e3da865f647be700491743ec3a602246e64ef578237f51224c695d474cc5063b
- MD5 501c4e4c3faecedd48a760af69dcd44d
- SHA1 bddeb644072071fc04fcc8d87273efa83d5b5da6
- SHA512 0de6d6d91b6b4664d129dfeaa0e40aed38de5e55af8c524710592f86e9cdf739927844de308f62eba12903221d20d09bc121e147d986f608c4b71807e243d256
- SSDEEP 49152:wrfGh2j4s5M1hiakTi7hzSZfOVgcFarQsX7ysOtnDdlH8wQAxx22dqhl9qPURPGg:Y152OEt7H87oS9qMRP3
- TLSH T1E036060673F81388E1F7967C96B75616CA72BC198B21C7CF0160915E1E33AE58D7AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 be83e2442bce7118018f6f397023ec3fe2255192046990b7ba7e5f32b1bf083a
- MD5 653be7b52657dc95744fc96d6d6bc776
- SHA1 be298613d5ac57476112cd1a8cd00fd1cf3ea859
- SHA512 1e5f0f0f83272cf66b5cad521d3f43a6c9bf7e0ae94a058830c029d57a7be9b85b8ca3e623c6f58cc75cf6651c42a9d997ba5343e90556d78440d58d55e1e974
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVdxx:UVqoCl/YgjxEufVU0TbTyDDaljxx
- TLSH T191D309236E20542FE812CAF12CA5D6AE79215E361BE89D5B3352FB50367260372F530F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\Themes\icsys.icn.exe
- Size 135KB
- SHA256 9b03c28b5b5a8cd6a1b798d6df26a8b8816d370014dd42fcbf21d620876f6b62
- MD5 a03d5de936cda8ad1242c1f29cc92f9f
- SHA1 941d6665013e2acaf380d59c5616fb7c2357f245
- SHA512 6004bdddbc64903ae27665cf5c2aa726923a67ac08e3c33c0a887716b752ed11d9f3798cbd21b99ea7caa1c21f9094d5898f4ba22db8b0d63ea4774f998f2c58
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVdxR:UVqoCl/YgjxEufVU0TbTyDDaljxR
- TLSH T132D308236E10546FE81286F268E5DB2EBA255E361BF5AD0733A2FB1525B1143B1F130F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 3974e144acf857663181fc527387cb008ee2b99a66cafc00155d6aa002e1ba6c
- MD5 aee2e60635e94e0275a417158be8c7dd
- SHA1 fe48282fa445fae413816c797ba11e755e11fd3b
- SHA512 293a81454ff501beeeb57057a4e37bf8961b9da3f9249fc9c97be89dd308d5a0858bc6f0367a98bd88060a0a2aed838fe886383a8b236a6ebc71f5d62009b326
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVdx7:UVqoCl/YgjxEufVU0TbTyDDaljx7
- TLSH T1BCD31A336E10506FE811C9F12CB5D7AABA164E390FA57C4B365BBB1129B6243B5F420F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\svchost.exe
- Size 135KB
- SHA256 b6f1df5b3fc29cd4aefcb443710febe9bec7c32edec8b4c00f8e31a4ae2da7a0
- MD5 ed90d1d2e8fc2b4d140bafb9e0a2f723
- SHA1 20a2fb419a4f863a0104007ea40fff95a80a58f7
- SHA512 ff0447e71f723822cf01220972224be80afb98da7860f15e8a817d5b4d08c244bf572960ddbb885c875543b7ebd2e476ac29eaba69c1e2d426125669eb96f307
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVdxa:UVqoCl/YgjxEufVU0TbTyDDaljxa
- TLSH T1FBD30B136F24143EE81686F198A5C6ADF7211E361BA1AE0773E3BF5464B1647B2F021F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\svchost.exe
- Size 35KB
- SHA256 20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
- MD5 9e3c13b6556d5636b745d3e466d47467
- SHA1 2ac1c19e268c49bc508f83fe3d20f495deb3e538
- SHA512 5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
- SSDEEP 768:tkOumaoDu3hAyN95/KTSZsOTb/Kc6H0anc6HEvT66vlm3GWBk5hr2C56r:SmaoDu3BN95/g4byc6H5c6HcT66vlm3j
- TLSH T122F2F72B5491EC7AC8A212F026BD0F26C376C9B0B854E58ADBC42D6B75A11D2F1B431F
- MD5 SHA1 SHA512 SSDEEP TLSH