Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/04/2026, 15:00
Behavioral task
behavioral1
Sample
2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe
- Size 8.0MB
- Sample260419-sdggwadv2q
- SHA256 c9b4710bf3dc13422a845254a86bdc445f826af57d456514bb1c43fa9ecf368e
- MD5 ea26b1eb0368273f6b7df87ebd7e7f2b
- SHA1 00022fbea3915e299917fa74da2ba2411fa01b07
- SHA512 520f4a443c975166478f0b85a968169fc1f33546c312937b7768747e09496e516977b867692a8a0bcd044ee52f6b4053c67a6063ca256ff9f17642f5086c9f45
- SSDEEP 98304:esNPpfrZ9JdXN0B7+swUbYZfgs0Qlxjjou:7RrZ1U64s3ou
- TLSH T1888627026EAC46B5E16FBE308C61C3B5E5717C114932AA1B1DD0BE5EAE339D17D2E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\convert.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\print.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\raserver.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\takeown.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\relog.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\user.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\cipher.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\print.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\tree.com 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\certreq.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\wusa.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\logagent.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\secinit.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe -
resource yara_rule behavioral1/memory/4656-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x001300000001efa2-5.dat upx behavioral1/memory/4656-681-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4656-3200-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{4A94AA11-90CA-4C29-90D1-DFB13A8291E4}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\7-Zip\7z.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_e73f0197262d9fec\TiFileFetcher.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\f\SpeechModelDownload.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.1_none_9b3749021eb80b64\psr.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_220320d2c4216035\poqexec.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15805.0_none_468e01fabfc37212\ComSvcConfig.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.1266_none_3e00d223332897b8\SearchApp.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_8a469514405342ff\r\PasswordOnWakeSettingFlyout.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\f\AuditShD.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.1_none_c8deb9da2cb2458a\rrinstaller.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.1151_none_23c0aa3b7bd960cd\f\CheckNetIsolation.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseCncProxy.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\r\wmpconfig.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.746_none_b6b8620636970859\r\PerceptionSimulationService.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-prompt_31bf3856ad364e35_10.0.19041.1_none_a6007aa58351ad08\fveprompt.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1060d2d22df7c6eb\r\WWAHost.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.19041.1_none_d1d4cd9c4b409594\TabTip32.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.19041.1_none_9d2d2a9ab0964bc3\cmdkey.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\r\WSManHTTPConfig.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.19041.1_none_0f750b10a0559386\IMTCPROP.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_813ba58adb6e7f68\GameBarPresenceWriter.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_01dba454b887ba53\fltMC.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-corruptedfilerecovery_31bf3856ad364e35_10.0.19041.1_none_3daac563c824d4e0\cofire.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_10.0.19041.1081_none_491d51c316b5ea8f\f\wsqmcons.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.19041.1_none_d908336e5b82be3e\chkntfs.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.1_none_f509d2f29c00c5f0\services.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_477a57e55b61aba8\SyncHost.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_908b22903a403149\f\newdev.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\f\audiodg.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-jsc_b03f5f7f11d50a3a_10.0.19041.1_none_014838ef8bea39e9\jsc.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\winhlp32.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\r\CustomInstallExec.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_e9349b06dfab6fdc\f\imjpuexc.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.264_none_0f23d07ed2574292\DiagnosticsHub.StandardCollector.Service.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_c2a2211ad648e627\mstsc.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.19041.1_none_10bddbfab734fa42\VSSVC.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.19041.153_none_7799fc2afae9a500\r\MDMAppInstaller.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.1052_none_323c9a9ad543e3a3\smartscreen.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.746_none_e873f3aa792d8bb3\r\Win32WebViewHost.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\ScreenClippingHost.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.1_none_4a6487592c595dd4\wlrmdr.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.19041.1_none_afb33d8068b0adc0\ie4ushowIE.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_d22800313aa7eb5c\f\regedit.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_22b99d078bbc3016\unregmp2.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\r\AuditShD.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_5940d1a4fc4ad8f3\r\backgroundTaskHost.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.746_none_bd9bc99304595128\f\ReAgentc.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_c171e0be75e709de\r\dsdbutil.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-baaupdate_31bf3856ad364e35_10.0.19041.1_none_ec3fd410728598b3\baaupdate.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\r\ScreenClipping\ScreenClippingHost.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_171488549e32a4d3\relog.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.117_none_7879d5035b0edfac\f\nltest.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.84_none_809ebfa242fbf368\r\wimserv.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_2afd3bd8e33c2cf2\r\msinfo32.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\WSManHTTPConfig.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.19041.1_none_fc9bfaeba32d6cd5\dpnsvr.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.264_none_62496caeba2daa52\nvspinfo.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4656
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 8.5MB
- SHA256 628e617030afc3645066f425f8a97191e0ce424d05f72970427d4b77c00d0a1c
- MD5 2279db26dd36051079eb7e7d0bc708c9
- SHA1 68d711619c663c16351ef418ec43afc8a9822d5e
- SHA512 2eef536546c7a453d53652503dc4d40ad55e93c9326165c75030275e1c59eb4e50da197b68b2fd3ffcf773a34b07ddf06f7dfad83ded0d7397a22f8f5823afb0
- SSDEEP 98304:esNPpfrZ9JdXN0B7+swUbYZfgs0Qlxjjoijo2:7RrZ1U64s3oUo2
- TLSH T1B49628126EAC46B5D06FBD3088A1C3B9E5717C114A32AA0B1DD0FE5EAE739D17D2D321
- MD5 SHA1 SHA512 SSDEEP TLSH