fad5cdb675b04dd8c1fa903bc1d7bb710662b8f531b74103b89853d4045f3055

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
Size 4.9MB
Sample260808-fepteszhmf
SHA256 fad5cdb675b04dd8c1fa903bc1d7bb710662b8f531b74103b89853d4045f3055
MD5 bf460be8ec8dbbd588da72d7a9b0d8f8
SHA1 e64482f5a25151d5d747a2f4b73d5668690de4d6
SHA512 c07e252e811642fab7197f1ee6fe9648ee451f1ac85d96a0517efffbb6217370bc0c42506c4e70c9996bd497177d087d5cd142e2c0fd013a72b8262424045a8b
SSDEEP 49152:NgrfGh2j4s5M1hiakTi7hzSZfOVgcFarQsX7ysOtnDdlH8wQAxx22dqhl9qPURPz:G152OEt7H87oS9qMRPld
TLSH
T1B436070673F81388E1F7867C96B65616CA76BC198B21C7CF0160A15E1E33AE58D79B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Executes dropped EXE 9 IoCs

pid	Process
5980	svchost.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
3400	svchost.exe
1360	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
4176	icsys.icn.exe
4316	explorer.exe
5096	spoolsv.exe
1172	svchost.exe
3704	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Program Files directory 54 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	svchost.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	svchost.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	svchost.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\svchost.exe	svchost.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	C:\Windows\svchost.exe	explorer.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4176	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4316	explorer.exe
1172	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
4176	icsys.icn.exe
4176	icsys.icn.exe
4316	explorer.exe
4316	explorer.exe
5096	spoolsv.exe
5096	spoolsv.exe
1172	svchost.exe
1172	svchost.exe
3704	spoolsv.exe
3704	spoolsv.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 5980	2748	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe	89
PID 5980 wrote to memory of 5816	5980	svchost.exe	90
PID 5816 wrote to memory of 1360	5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe	92
PID 5816 wrote to memory of 4176	5816	2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe	93
PID 4176 wrote to memory of 4316	4176	icsys.icn.exe	94
PID 4316 wrote to memory of 5096	4316	explorer.exe	95
PID 5096 wrote to memory of 1172	5096	spoolsv.exe	96
PID 1172 wrote to memory of 3704	1172	svchost.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5816
  - - \??\c:\users\admin\appdata\local\temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
      c:\users\admin\appdata\local\temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
      4⤵
      Executes dropped EXE
      PID:1360
  - - C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4176
    - - \??\c:\windows\resources\themes\explorer.exe
        
        c:\windows\resources\themes\explorer.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4316
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe SE
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        7⤵
        Modifies visibility of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1172
        
        \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3704

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
Size 4.9MB
SHA256 b35fe47a0db83e6210f6b1f6f5d412d67d681c8da4c3de301f50da3618eeadf5
MD5 c0943f28102b51179c91209fd03c1c9e
SHA1 7ee65fbe5745e5738095ec2378d3106330acccba
SHA512 4bbac38814e53a71233c1e51575826d4d5fd8a2c2a469b7f92aa3ebc0755ce13a7494846138f4a5e793235287d238893a4a0eca9337fdd9172ca23fcf7e34a8a
SSDEEP 49152:t+rfGh2j4s5M1hiakTi7hzSZfOVgcFarQsX7ysOtnDdlH8wQAxx22dqhl9qPURP8:0152OEt7H87oS9qMRP8
TLSH
T15D36071673F81288E1F7867C96B75616CA72BC198B21C7CF0160A15E1E33AE58D79B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf460be8ec8dbbd588da72d7a9b0d8f8_cobalt-strike_elex_glassworm_icedid_jeefo_njrat_vidar.exe
Size 4.7MB
SHA256 e3da865f647be700491743ec3a602246e64ef578237f51224c695d474cc5063b
MD5 501c4e4c3faecedd48a760af69dcd44d
SHA1 bddeb644072071fc04fcc8d87273efa83d5b5da6
SHA512 0de6d6d91b6b4664d129dfeaa0e40aed38de5e55af8c524710592f86e9cdf739927844de308f62eba12903221d20d09bc121e147d986f608c4b71807e243d256
SSDEEP 49152:wrfGh2j4s5M1hiakTi7hzSZfOVgcFarQsX7ysOtnDdlH8wQAxx22dqhl9qPURPGg:Y152OEt7H87oS9qMRP3
TLSH
T1E036060673F81388E1F7967C96B75616CA72BC198B21C7CF0160915E1E33AE58D7AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 135KB
SHA256 2ec7f04c389e729e7429ac6706738f9acd2aa6af787359e4a38aeb7edb7b2977
MD5 81752b18337c1e3409ae07f087075ab5
SHA1 40d54f7513cbe3e1e0969550a4693c7736126cfe
SHA512 4dfe59efe8259d104709280a057de77e1a4b73987c5eb2f8aad1f11ed046197c1b261286caffa039742a7314c774c700195ec76220a2f3b970ce3065a7d2ac42
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVdxO:UVqoCl/YgjxEufVU0TbTyDDaljxO
TLSH
T1DCD3E823BE20582FE8128AF56CB5DA5EB6321F251B94BC473796FB1029B164775F020F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 135KB
SHA256 9b03c28b5b5a8cd6a1b798d6df26a8b8816d370014dd42fcbf21d620876f6b62
MD5 a03d5de936cda8ad1242c1f29cc92f9f
SHA1 941d6665013e2acaf380d59c5616fb7c2357f245
SHA512 6004bdddbc64903ae27665cf5c2aa726923a67ac08e3c33c0a887716b752ed11d9f3798cbd21b99ea7caa1c21f9094d5898f4ba22db8b0d63ea4774f998f2c58
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVdxR:UVqoCl/YgjxEufVU0TbTyDDaljxR
TLSH
T132D308236E10546FE81286F268E5DB2EBA255E361BF5AD0733A2FB1525B1143B1F130F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 135KB
SHA256 a191ac9f2cb700c68f9d89a7834c525d7f69878c0e2d65b139abb291e13c7d1b
MD5 d2556f0a452bef60f6e2b89e1f80a26c
SHA1 12b938ab81d655151587dd9cd2e6b4ae160c277b
SHA512 10b8bdab3c1dfa727a18e325bd5bf2e5bbedcdc715f2f9ad08cefc83a0be2de2a49c40fd1471d26d605278f70d4ae3e2b3e3cba6b08ee65de97b90315fe42c2f
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVdxk:UVqoCl/YgjxEufVU0TbTyDDaljxk
TLSH
T165D30B13BE50502FDC1189F16CEDE769BA255F360BA0AE4772A6B71439B2143B6F120F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 135KB
SHA256 07a8f0d93da9bdd17ea375b15b47cc2f26f70eef9a590f47ecfdfdf87fc5f6f1
MD5 cb38d7731ef27c2adbe4d1e1bd03b567
SHA1 2ccd9a2a29771a3a0690828808f96010de5f4eb2
SHA512 0cb4e03aba94f16b3380649c815f0838b14ba1be4f4c903dd9b24c696be2db848f379ac6af3670f1ae4d103c7c99b00cf00fb4ca41f197ba7a8a0e19b0eae5f1
SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVdxH:UVqoCl/YgjxEufVU0TbTyDDaljxH
TLSH
T1C0D30A677E24207ED9128DF268A6D61FBA225D391FE0AC4732577B482670243B2F531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\svchost.exe
Size 35KB
SHA256 20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
MD5 9e3c13b6556d5636b745d3e466d47467
SHA1 2ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA512 5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
SSDEEP 768:tkOumaoDu3hAyN95/KTSZsOTb/Kc6H0anc6HEvT66vlm3GWBk5hr2C56r:SmaoDu3BN95/g4byc6H5c6HcT66vlm3j
TLSH
T122F2F72B5491EC7AC8A212F026BD0F26C376C9B0B854E58ADBC42D6B75A11D2F1B431F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1172-77-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2748-5-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3400-68-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3400-73-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3704-64-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4176-67-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4316-75-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4316-40-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5096-65-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5816-66-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5816-11-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5980-13-0x0000000000400000-0x000000000040D000-memory.dmp

Download