Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 12:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
- Size 4.0MB
- Sample260910-pepcbssgkb
- SHA256 e6ae94df5ebe3cd1ab3759b9a3b8087a077a6c12b94e90452cc30be743aa452d
- MD5 ac1401bd1a5605cd82657ed663493600
- SHA1 8011ee06e0916b877f160eeec1c5b5b3fc2ca33f
- SHA512 657cd34d44816e4e3d3ad5b17989947014ac5e4e5a386ed5ff5ad1dc89980839c84f61d988ae4bfca06cf521d39b486db0f4c5b1124ae7473925d00846a1df02
- SSDEEP 49152:P/ahew2Eh/ahew2EpCbRquA/m2yL5zbfFiV+XenmE3/zfy6i1zuajsauZnJ3:P5g5/oq2VjnmOtn
- TLSH T1A1165B19F6A841E4D1AEC278C7A28652F273782547B196DF12D0C63D1F33AD05EBA723
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5020 2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_ac1401bd1a5605cd82657ed663493600_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5020
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 6.2MB
- SHA256 af801aa88f77578165250dbb248ea871a60d2639e84a98754a4d17949b9dc64f
- MD5 a2ab8235f884ca55734b34f4ac95e618
- SHA1 818694c8637b1f9c3810a34abf5353186e35a693
- SHA512 44753861a27e815e0c651710a7e563361d4a7e1bea99f9ef318a1ca30b626bacc54e383dd57db1ced137834e23bb1191906410a5589038e4a332021b5c8c30b5
- SSDEEP 49152:P/ahew2Eh/ahew2EpCbRquA/m2yL5zbfFiV+XenmE3/zfy6i1zuajsauZnJWCbRw:P5g5/oq2VjnmOtroq2Vjnm6
- TLSH T157565D19B6A881E4D1FAC278C7A28542F37378154B7097EF1295C63E1F33AD05E7A722
- MD5 SHA1 SHA512 SSDEEP TLSH