Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/04/2026, 12:14
Behavioral task
behavioral1
Sample
2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe
- Size 12.1MB
- Sample260419-pea5psex8v
- SHA256 4d15aa3e14f50b8774b9e679d2a02e7b7c08201445e129c1fa92d859252a7245
- MD5 87f326ad32fea0868d4099a389c03ef4
- SHA1 b9a4b6333a5b8e7d33854abb81e28b9778df2916
- SHA512 51b17614cf8c18afdb860db84d95333cd525dcaf4628ac0441fe8370bcaa417528d10c8aa264eb3c37ae3c10a2d2d191daa4d301cf637d557b9f814827c795cf
- SSDEEP 98304:fgCs1955SUbYZfgs0QlxyOgKUbYZfgs0Qlx2fkZcW:Zc5SU64ssKU64swPW
- TLSH T155D67B11BBF882F6D0B7D174C9A286B6E6B1BC514E31DB4F0265C72E2F336914D2A325
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\psr.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winver.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\compact.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\help.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\user.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Dism.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wscript.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\certutil.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msdt.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runas.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sc.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\write.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ftp.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/4692-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000700000000d3f6-5.dat upx behavioral2/memory/4692-581-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4692-3191-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\dotnet.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.22000.282_none_88ab4ca49843f4b5\f\VmComputeAgent.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.22000.100_none_b998a9a728d6401f\f\Narrator.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.22000.1_none_7abe2ca795bb4a9d\sdiagnhost.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.22000.65_none_99e34b544b7754a7\f\provtool.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_3d11f25cbb74100a\f\sdchange.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\f\ScriptRunner.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_0f681b8c9b834caa\r\PinningConfirmationDialog.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.120_none_f6a11a34378fa70f\f\StartMenuExperienceHost.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.22000.493_none_157ddf72a65679bf\r\sppsvc.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.194_none_15db8cfb1c6a6b33\SystemSettings.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.22000.120_none_dd24c7cd1fc6d4b1\r\PeopleExperienceHost.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.22000.37_none_be275aadedb23f4a\f\userinit.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.22000.1_none_7a25fafa5e81834c\fltMC.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.22000.1_none_16b2561948e7dd92\ieinstal.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.22000.65_none_4f258ec343f09686\r\oobeldr.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.22000.318_none_2cba3682f8941339\f\DiagnosticsHub.StandardCollector.Service.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-more_31bf3856ad364e35_10.0.22000.1_none_029dee111dd7c2ad\more.com- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.132_none_f836cc528422524b\ShellExperienceHost.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.22000.469_none_aa2bb1f81a06280c\r\UsoClient.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.22000.282_none_f57e785f37294fe2\r\ntprint.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\hh.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_d3608b4d6c1da7eb\chcp.com- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.22000.120_none_26a3fe1b7073b18d\r\sfc.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.318_none_aa689c124bcde8ee\r\CheckNetIsolation.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\r\audit.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\SearchFilterHost.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.22000.434_none_6dc3a5a2d0fafee9\f\certreq.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.120_none_576e8243334ab082\r\explorer.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.22000.348_none_790557e9d75b5a9c\r\SpeechModelDownload.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_d037578ed2162e06\f\sdbinst.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.22000.434_none_2ca09768f8a7e2e6\DiagnosticsHub.StandardCollector.Service.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.22000.318_none_67a8688739413b45\f\ntoskrnl.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.22000.1_none_53953f4ad73d0675\csc.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.22000.1_none_ae9fb5eb30be85c5\WFServicesReg.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_wcf-smsvchost_b03f5f7f11d50a3a_10.0.22000.1_none_9033bf3e0d1a2461\SMSvcHost.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\msil_ieexec_b03f5f7f11d50a3a_10.0.22000.1_none_1baa132fc64be8aa\IEExec.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_f927204bf41f3d61\f\quickassist.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.22000.1_none_0367376385127fe1\FXSUNATD.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_eb1a21d23daf2030\f\NcsiUwpApp.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.22000.100_none_1c26ef58a3003bf2\r\SystemSettingsAdminFlows.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_890a915053a73623\MRINFO.EXE- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.22000.1_none_0b6ad273acba9ca1\w3wp.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.469_none_5669b3acf1ecab58\winload.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.22000.71_none_152ef1c98c20fad4\r\fodhelper.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.22000.1_none_0f97a0bb2461b363\WMIADAP.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\SearchProtocolHost.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.22000.37_none_7461fc8593f740b9\f\ApproveChildRequest.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\msra.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.22000.120_none_f07c0067839c600d\RMActivate_ssp_isv.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.22000.1_none_f49ae11ddec89744\LicensingUI.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.22000.1_none_f49ae11ddec89744\UpgradeResultsUI.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.120_none_0e11f85980658aa8\r\ShellAppRuntime.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_da8c01e10676f001\r\sdbinst.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_3d11f25cbb74100a\f\msra.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\bfsvc.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.22000.100_none_cbf7ec6fc0f80985\f\SndVol.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\splwow64.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.22000.41_none_ea5a28018e2bb582\f\hvsimgr.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..teelevatedinstaller_31bf3856ad364e35_10.0.22000.1_none_dbd26f990ff88a48\WindowsUpdateElevatedInstaller.exe- 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_87f326ad32fea0868d4099a389c03ef4_amadey_darkgate_elex_glassworm_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4692
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 12.6MB
- SHA256 8c51ee32e4f49d2d8a77a7e40f123711e846b0b71af77f12f9f07c20710ad952
- MD5 fa94451061101f40a77692e1e576c7c1
- SHA1 6ebe44a950e53e457c5d967e2b01c2d3636a56e9
- SHA512 0c945f1b30bba86df3191d232bf189c72ad80c0755e07ccbf2a64af74b2cc6f93f153082c4dcca49c9d6d4ac10b6c787ccec83ad23fa5fb8601888d84a2a5cfe
- SSDEEP 98304:fgCs1955SUbYZfgs0QlxyOgKUbYZfgs0Qlx2fkZcqjoA:Zc5SU64ssKU64swPMoA
- TLSH T10ED66B11BBF882F6D0B7D174C9A286B6E6B17C514E31DB4F0265C72E2F336918D2A325
- MD5 SHA1 SHA512 SSDEEP TLSH