Analysis
- max time kernel
149s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/04/2026, 13:22
Behavioral task
behavioral1
Sample
2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe
- Size 6.1MB
- Sample260419-qmbxmsgw4t
- SHA256 b46c96122aa6aeb488ac9b9b8e40338161326108a829231b32520616b14a2c60
- MD5 6e93e05dd0e0f8eb6cf90ea158618dd5
- SHA1 774467f399fa64c338a74666918389e9b54dcd87
- SHA512 2dc43227e2739a0b36d4da11f7d808986ef08cab15d64ce5fd3e2e24a476731431dd6bb7d1be0e7dcf0e4efba16253a50229353d329106be4c6bc7c3cbadcef6
- SSDEEP 49152:fsHF+3j5D78OBU635DMnCIjtAyKxzv2mSdbDUAsHpD+bsxctZE+OM2EsT/HBJJdE:fgCs1955SUbYZfgs0Qlxy
- TLSH T17A565A11BBE441F6D1B7D174C96286B6E6B1BC510E31EB8F0264D71E2F33AD18D2A326
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ARP.EXE 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sort.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\choice.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\format.com- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\user.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmd.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\curl.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mode.com 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\replace.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mode.com- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\attrib.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msra.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\replace.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/4924-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000700000000d3ef-5.dat upx behavioral2/memory/4924-942-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4924-3178-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7z.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.22000.318_none_b139c7be49b8cbb9\FsIso.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.22000.1_none_c5af807aa8d61858\gpscript.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15806.0_none_1bb1d4f67da2d938\ngentask.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.22000.1_none_c0cc1dd788bbd3ed\provlaunch.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\r\TextInputHost.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.22000.282_none_66112670800af37c\f\vdsldr.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.22000.1_none_c40db8f2fa975bbd\RdpSaProxy.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_curl_31bf3856ad364e35_10.0.22000.434_none_841ec22dd6bd92c4\f\curl.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.22000.469_none_59f2db2aeb94e019\r\WpcTok.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\SearchHost.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_9b4fcb543bd21a13\f\LaunchTM.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rpc-ping_31bf3856ad364e35_10.0.22000.1_none_fe52560879e25943\RpcPing.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\f\sdchange.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.22000.37_none_ac96ecb2523a6a01\InputSwitchToastHandler.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.22000.1_none_383fdbeacdabdb26\tcmsetup.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.22000.1_none_3a7d76304b5fadc7\dialer.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.22000.100_none_bac6834bfb16b20d\r\SecurityHealthSystray.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.22000.71_none_ccb71d3ee4c7b8a6\f\ByteCodeGenerator.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15806.0_none_c8fad3ab465564d6\aspnet_regiis.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.22000.282_none_3891f56e17aabe62\r\lsass.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.22000.1_none_2c18bbe89f9c63f0\nslookup.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15806.256_none_bd4110e80daed286\mscorsvw.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.22000.194_none_213203c52af71b4b\r\bfsvc.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.22000.1_none_3a25939e0488fc49\wbengine.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.22000.1_none_404d1be794382b1e\comrepl.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.22000.71_none_ccb71d3ee4c7b8a6\f\ByteCodeGenerator.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.22000.469_none_40856ba085a100c4\f\BioIso.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.22000.434_none_ae734c6bf20696b6\r\djoin.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.22000.1_none_bfb8876999af625a\cmstp.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.22000.469_none_265cec8f409ba4eb\r\HealthAttestationClientAgent.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.22000.1_none_da2a87582afb2453\UserOOBEBroker.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..-client-aggregators_31bf3856ad364e35_10.0.22000.318_none_701008567a383b30\f\AggregatorHost.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_10.0.22000.1_none_5a923992d494427e\dplaysvr.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-o..eminputhost-process_31bf3856ad364e35_10.0.22000.120_none_842c9d9e843cf6c7\f\ISM.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.22000.1_none_0bc8a5933825a63c\certutil.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.194_none_3012dc434ba08310\f\wowreg32.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..teelevatedinstaller_31bf3856ad364e35_10.0.22000.1_none_dbd26f990ff88a48\WindowsUpdateElevatedInstaller.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.22000.1_none_0f97a0bb2461b363\WmiApSrv.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15806.0_none_d4049e1f6926b032\ngentask.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.22000.1_none_0e8c117a0fb4af58\unregmp2.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.22000.1_none_a7a700c8f53b4106\mount.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\msil_inspectvhddialog6.3_31bf3856ad364e35_10.0.22000.1_none_1e1cb41b23f7b2cb\InspectVhdDialog6.3.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.282_none_75821ac4f6866a77\f\WerFaultSecure.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_03b4c900a639c980\f\TpmTool.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.22000.120_none_dd24c7cd1fc6d4b1\f\PeopleExperienceHost.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.22000.120_none_898d9e6ac325eeaf\AccountsControlHost.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.22000.1_none_31352ed24fc2d65e\psr.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.22000.1_none_3fc7d56a6d567d99\DataExchangeHost.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.120_none_f6a11a34378fa70f\f\StartMenuExperienceHost.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-oneoffs-em_31bf3856ad364e35_10.0.22000.318_none_ed2b4c25cc173a5f\n\EM.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-where_31bf3856ad364e35_10.0.22000.1_none_b416d6c5e2f3a677\where.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe- 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_6e93e05dd0e0f8eb6cf90ea158618dd5_darkgate_elex_glassworm_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4924
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 6.7MB
- SHA256 31fb77ced12eb3e69f464d70324b94fa5d5e848a7f540a29f40fa2d54f6a48a0
- MD5 f6df473f33576e6aa657c5de935fa696
- SHA1 8c618c2a83cfec6e550b2aa8fb64cb1df376c815
- SHA512 19b0cb7507f828a0a94581d61a32ff50036f5120d50663b30c1498f5092d5263687dd7bd6d70fd2f34615d8d936ffef70249b9f954f1f8e353b2e321d6223bab
- SSDEEP 49152:fsHF+3j5D78OBU635DMnCIjtAyKxzv2mSdbDUAsHpD+bsxctZE+OM2EsT/HBJJdG:fgCs1955SUbYZfgs0Qlx+jo0
- TLSH T1E8664A11BBA442F5D0B6D174C9A286B6E6B1BC510F31DB8F0265D75E2F33AD18D3A322
- MD5 SHA1 SHA512 SSDEEP TLSH