Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
- Size 3.7MB
- Sample260810-e5z7eabj8v
- SHA256 78d8f5f4eb3a3a0722f089e59e69bf6de37b2cbeaebaad8537ac14a5f2f32fb5
- MD5 855c1a0f5dbdffa5bf1d8907d591882a
- SHA1 076d4face4ce724f820fe4b5a66c763f53f3cbe9
- SHA512 54374cdb67453590018e6ddcefaeb0dabcd79041615c0b21ae8b65a39abd586fcd864052b8bf4563f13ffce0b36a1ddcddf9b3823e22ba44ef49010503b2575a
- SSDEEP 49152:UbQyXmmfxtRhZ/9WBLzW2dNuRrnM9ILRvbLEb0g4fBKfKrbZsrDAdrQiF3n2/d0c:6Xm2bJgBdfGLEACfKhdrQU2/yk
- TLSH T112064A03F29900D8D05DD1B8CB568632EAB6BC850B35A2DF0790B7562E77EE86B7D710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 30 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\RCXCBDD.tmp 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXD74C.tmp 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXD68E.tmp 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXD6FD.tmp 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXDA7A.tmp 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXD64D.tmp 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXD69F.tmp 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXDAE8.tmp 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\RCXC976.tmp 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXC996.tmp 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXCB9D.tmp 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXD65E.tmp 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\RCXDB09.tmp 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXCAFF.tmp 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\RCXCB3E.tmp 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_855c1a0f5dbdffa5bf1d8907d591882a_cobalt-strike_elex_glassworm_icedid_njrat_vidar.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2820
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 554KB
- SHA256 00e8c9c6ec0c93e0dd3c7d1d6e4a123b5dc236acb9da349ed9053baf90e3b2a4
- MD5 d8dafcec5b7bc77acfd122b32a0942c5
- SHA1 f0a7f9bfb6e07efe1d9e8297806309c4e93217ab
- SHA512 c26aec9159330844a97f29f1049c43339064aaa72705830319ebbd3f9ab45c66c303d2a4192f43bec13502b91b5023336710697febeeba872773139ec912fef2
- SSDEEP 6144:EGQLO76tlVr1Il5HlrJHU7kfLeeHVlK8SQBJ9LBKJwgdAmKa5rL:E5S86nHrUA9HVlK8SQBJ9t4f15rL
- TLSH T11AC49E41F7D847E9E07AC534CA428546EAB178960B61F6DF03A0427A2F376E54F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
- Size 7.1MB
- SHA256 afe985675d0117314d4af5e25a26a63035b173fc11b1fef839167bab53b94250
- MD5 369c92f85d2279cc068e26c822eafe89
- SHA1 353d37a463d4daa07d0cb5659b07db27eecdaaaa
- SHA512 4eb9d5d43dbdbc5d549cf6e16438ccf6533026df25adc7c56c45a8ff9dd97be6a8756f0b9fe923e808b32f4a45ebaa925af15a95ac477020537ed7f374de9d86
- SSDEEP 98304:86CZetahq+WZxcpwCsJB2++fGOOxRj2vJzRN+T6frX:fCZetaEMGIG5xVqzRdDX
- TLSH T136766C47E3E600A8E46ED970CF2A9521DA353C8E47B492EF169476E41A32FD47B38F11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
- Size 3.8MB
- SHA256 289ef1f862c77123db78a94ea6d22ee0140906790f30b32d4885886d81b399d3
- MD5 084a5f12626eca63cb7b33300414d0af
- SHA1 8bce37f5f5af12b5e6cb344d27bad7b2e42147e4
- SHA512 928edaf229c588e8722df13daf99326765af7a38f89d12449dd0bac945192ecae8dc6589334e90b214de58f059bea420a071d871230c373c87cf88ce67e5a1d2
- SSDEEP 49152:O6gu3VyrBme/hqvxbmhLbKqm006NPpIupEoEVu+e6NqcXToRzvUqIzYHBigdQBD:73mMsYvRmCCENUhIUBbM
- TLSH T146064803F29900E8E05DD5B8C7568122EAB2BC854B35B2DF0750B7562E7BEE4AB3D750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
- Size 1.9MB
- SHA256 5a1c92b7072f248331af9f00a240bfcfac9799fc975c1d32175c9cb99c4bc736
- MD5 6f041914e76aba1fd2da964ac9345724
- SHA1 100001b2772689c5cac9b37d838a2fd9447f30af
- SHA512 1a5059941e32b193de6930a7771611ddebad9ad5de213a81edcc7b3de6ffcaed7ab1118b9f3a78dbd0322f7c8fe5faa860d0bd9ef8b3c2cde1eda791740b18d3
- SSDEEP 24576:W3I5kAGu6McqpA7D9ruO3O7Q7OBLLMdus7CtW7KSdHBxmRkkkkkkklQXBysWAb:YIZGu6qG13O7Q7gLYduZrSdHBAVfb
- TLSH T1D7958D03F6DA80E5E05DC2B8CB768B35DAB17C555F20A6DF0680BA652E77AD04B3D390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
- Size 4.6MB
- SHA256 de261c3715f5590006931f634f96c0201f00139a80da1711ff55f8f98c2ccad1
- MD5 715e3d06078e9872da4c6a956d7fd7fc
- SHA1 73ebb18d5c3fad55078231b297e4df9d52bfb57b
- SHA512 566b864e3b693c4649f5e3a163361944bcc72d2ead83f6191fd0d4ffa09d50b7408c17ffc278142867d9c53da49c92ffe393b62a5ced1eab4fb6f6c4ca9d03f1
- SSDEEP 49152:qX6YRJJudQuVyBvNszCnSgVdQM3/+TjER7zExldDwUIDtaZHWRdpev2y/Baj:qxbijnUdYd+RaAj
- TLSH T19E264803B28984D4D049C074CE1AD232AB617C9947F161EF36D4BBEA3A73AD47A3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
- Size 1.5MB
- SHA256 7580c0e83f3a0252d2a6cb3d1236335cc13db57e5db69f2e070e5513469ab377
- MD5 3c3d68915ab5a47ff16d1d5ee1852b0e
- SHA1 a25bd3a7e78f8ac7b3ab313724ef90ba58c0d8be
- SHA512 9868ff35208bcaa13ff3217e4631937b1c24dcfe2a53a71322bd07ab63f623debc40f3b47a2e743e3b27632b86d2351980732840e0e387b0889c5c382aad55e9
- SSDEEP 24576:Xyoteh6euUHmEhK7eTuNdfxINakEtv9kWG2L1oaedpEukUoygGmq/Sl:XfehjvHHKTdfxINPEt99G2Bo7EukU1a
- TLSH T15E657B03B2D901E8D06AD1B8C7468536EAB2BC450B24A6EF0B90B7551F7BFE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
- Size 1.4MB
- SHA256 d4988a29326a022493615e5f2ca46c2fdc7ce8f4321e23ee4ed3061bfb936527
- MD5 f035a7f47e64eeb0868486458bed7449
- SHA1 78ac0c773301cbab5f7cdc4e678012d603b5f0ea
- SHA512 b7919560e55f32a20af8e3b22c17e8e1e9c6f3bdc508c4d543f8872bed428253dee3e47c5e45e6016f9af22825132a99368f9bc877ae3a23303175e52b9ac9ab
- SSDEEP 24576:aZGY26UEU3RyRPW+uSmS86IU8Gc7QGsVa4i6h27d3WlN:hY2fF8FhmS86IUJWQn+6h27d6
- TLSH T110657C03F69900E8D059D1B4CB56853AEAB2BC460B34A6EF0B90B7552F77EE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e58c8ba.tmp
- Size 2.8MB
- SHA256 aa0a34300a93a2882b241b7fbf23e590f594f811fabfb8fccbc789796b7fa80e
- MD5 5fb303dcaf8de9324c9e4824718c0195
- SHA1 068710eaefe9da6aac750553546c08d2ad723b3e
- SHA512 1b117e044862a9a6bfc55984e6fd5093e0baa413507ca3055becd321ee602dbd5fb41c1bfa5e21327390e83ed50f6d1dabfea6e84896c11bb284578df8e7e7ee
- SSDEEP 49152:jY2fF8FhmS86IUJWQn+6h27d+Y2fF8FhmS86IUJWQn+6h27d6:jbOjjst4bOjjsts
- TLSH T1B6D57B03F69900E8D059D1B4CB56853AEAB2BC450B34A6EF0B90B7552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wctEADD.tmp
- Size 40.6MB
- SHA256 2dbccb9fc6e3eb2470eb732e28c3f33df1039120888ac7891476aa4411bb122a
- MD5 afd327764bef1a4637c1b1fc828ea0e9
- SHA1 df3f31880ce38257fd4ffcdb38ca08e5870229e0
- SHA512 c3ba45df73ef7708d620be5f41a0addc187c55b6e88e4e503196173ce94707ddf49452a86631a70ad36612cd1f8d15c609035f813d2fa8e80d37f094a0adb197
- SSDEEP 786432:DwQNeYDxVRrMPJy7LVV4NDDmdrZy9wOtg5gGOdjtjSNu4GIluUNj56I59w:cQcWxDMPnN+dk65gGUjku4vNjLjw
- TLSH T105972252ABD48176F2AAD170297B73B8467ABD343F62CACF62843E5D17309C19931723
- MD5 SHA1 SHA512 SSDEEP TLSH