Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 12:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
- Size 4.0MB
- Sample260910-pepcbssgkb
- SHA256 e6ae94df5ebe3cd1ab3759b9a3b8087a077a6c12b94e90452cc30be743aa452d
- MD5 ac1401bd1a5605cd82657ed663493600
- SHA1 8011ee06e0916b877f160eeec1c5b5b3fc2ca33f
- SHA512 657cd34d44816e4e3d3ad5b17989947014ac5e4e5a386ed5ff5ad1dc89980839c84f61d988ae4bfca06cf521d39b486db0f4c5b1124ae7473925d00846a1df02
- SSDEEP 49152:P/ahew2Eh/ahew2EpCbRquA/m2yL5zbfFiV+XenmE3/zfy6i1zuajsauZnJ3:P5g5/oq2VjnmOtn
- TLSH T1A1165B19F6A841E4D1AEC278C7A28652F273782547B196DF12D0C63D1F33AD05EBA723
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1360 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1360
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 6.2MB
- SHA256 af801aa88f77578165250dbb248ea871a60d2639e84a98754a4d17949b9dc64f
- MD5 a2ab8235f884ca55734b34f4ac95e618
- SHA1 818694c8637b1f9c3810a34abf5353186e35a693
- SHA512 44753861a27e815e0c651710a7e563361d4a7e1bea99f9ef318a1ca30b626bacc54e383dd57db1ced137834e23bb1191906410a5589038e4a332021b5c8c30b5
- SSDEEP 49152:P/ahew2Eh/ahew2EpCbRquA/m2yL5zbfFiV+XenmE3/zfy6i1zuajsauZnJWCbRw:P5g5/oq2VjnmOtroq2Vjnm6
- TLSH T157565D19B6A881E4D1FAC278C7A28542F37378154B7097EF1295C63E1F33AD05E7A722
- MD5 SHA1 SHA512 SSDEEP TLSH