Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/04/2026, 15:00
Behavioral task
behavioral1
Sample
2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe
- Size 8.0MB
- Sample260419-sdggwadv2q
- SHA256 c9b4710bf3dc13422a845254a86bdc445f826af57d456514bb1c43fa9ecf368e
- MD5 ea26b1eb0368273f6b7df87ebd7e7f2b
- SHA1 00022fbea3915e299917fa74da2ba2411fa01b07
- SHA512 520f4a443c975166478f0b85a968169fc1f33546c312937b7768747e09496e516977b867692a8a0bcd044ee52f6b4053c67a6063ca256ff9f17642f5086c9f45
- SSDEEP 98304:esNPpfrZ9JdXN0B7+swUbYZfgs0Qlxjjou:7RrZ1U64s3ou
- TLSH T1888627026EAC46B5E16FBE308C61C3B5E5717C114932AA1B1DD0BE5EAE339D17D2E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\compact.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\hh.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\convert.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\tar.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\chcp.com 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\choice.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\print.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\choice.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\fontview.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\instnm.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe -
resource yara_rule behavioral2/memory/4828-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001d00000002b1d4-5.dat upx behavioral2/memory/4828-591-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4828-3211-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.22000.348_none_790557e9d75b5a9c\f\SpeechModelDownload.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_6b5eb3c4c1ffcde9\WerFaultSecure.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.22000.1_none_f7606706a9708e33\wslconfig.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.22000.1_none_ae9fb5eb30be85c5\WFServicesReg.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.22000.1_none_265218c0114195b8\dpnsvr.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.22000.65_none_2d03a3ca59967a09\f\WpcMon.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_c24a28fb71aa07c9\Robocopy.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-secinit_31bf3856ad364e35_10.0.22000.1_none_ddfb8e1dd1c74c7f\secinit.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\f\AuditShD.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.22000.282_none_c78a68497548f374\f\fsutil.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..executionprevention_31bf3856ad364e35_10.0.22000.1_none_20270749296283d2\SystemPropertiesDataExecutionPrevention.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.22000.65_none_f3a35be8937453f0\f\TabTip.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.22000.282_none_66112670800af37c\vds.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\tscon.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.22000.120_none_30f8a86da4d47388\f\sfc.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_regasm_b03f5f7f11d50a3a_4.0.15806.0_none_9be8d99ac1f7c734\RegAsm.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.22000.348_none_88dc8ff6981e1a22\r\VmComputeAgent.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.22000.1_none_2bf4b35abb6a6b63\EDPCleanup.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.22000.318_none_a3d287795cb1ca0f\f\IESettingSync.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.22000.41_none_506d5972b4817c83\Magnify.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.22000.120_none_9c5aa041b6a59db2\RMActivate.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.120_none_0e11f85980658aa8\r\ShellAppRuntime.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\TextInputHost.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.22000.120_none_3023ad156f648a5a\CapturePicker.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.22000.1_none_90ab24a4e0ddab72\ielowutil.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.22000.1_none_b6a86607fc0d3ad5\netbtugc.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.22000.1_none_b563dd17654ea05f\cmmon32.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setx_31bf3856ad364e35_10.0.22000.1_none_02ba73751dd9765e\setx.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winver_31bf3856ad364e35_10.0.22000.1_none_0c951be2a141ecff\winver.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_ddb5359fa07e69e6\doskey.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\f\SearchProtocolHost.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.22000.282_none_e0bcdfd0611d6514\r\WindowsSandbox.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.22000.1_none_e15064631f259cdf\cmd.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.258_none_dfe62f4e03f8472a\f\LsaIso.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_f9601eae71d90785\f\TpmTool.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.22000.469_none_aa2bb1f81a06280c\r\UsoClient.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.22000.1_none_3d7fbabd1601d8b8\cmdkey.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.100_none_f82676266a17f522\r\ApplySettingsTemplateCatalog.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.22000.65_none_9f7612893c144c09\r\smartscreen.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-logcollector_31bf3856ad364e35_10.0.22000.1_none_f6661d429feb51c4\LogCollector.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.22000.1_none_5640d9ef21678ad0\sftp.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.22000.434_none_6dc3a5a2d0fafee9\certreq.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.22000.37_none_be275aadedb23f4a\f\userinit.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.22000.71_none_eba5201bcfa1aa33\f\licensingdiag.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.493_none_2b6ddb5beae8ce90\f\hvax64.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.22000.1_none_4dc986ddab447f27\IMJPUEX.EXE- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.282_none_75821ac4f6866a77\r\WerFault.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_c1bbc2c937fef3c3\relog.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.22000.1_none_8270b443c99f06ee\dpnsvr.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.22000.1_none_72d0f19d01454ec8\ieinstal.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\4833c22ad03dd801643e0000585e205e.nfsclnt.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.22000.318_none_9f38aa7663fcbf45\f\control.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_037bca9e287fff5c\quickassist.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_659b5b6317001d2c\r\runas.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15806.0_none_aae08517a75cb984\aspnet_regsql.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.100_none_f82676266a17f522\Microsoft.Uev.SyncController.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.22000.65_none_2d03a3ca59967a09\WpcMon.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_f9601eae71d90785\r\TpmTool.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.22000.194_none_841924fc9a413271\f\wimserv.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.22000.282_none_88ab4ca49843f4b5\f\VmComputeAgent.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.22000.71_none_c26272ecb066f6ab\ByteCodeGenerator.exe- 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_ea26b1eb0368273f6b7df87ebd7e7f2b_amadey_darkgate_elex_glassworm_icedid_njrat_rhadamanthys_stop_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4828
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 8.5MB
- SHA256 628e617030afc3645066f425f8a97191e0ce424d05f72970427d4b77c00d0a1c
- MD5 2279db26dd36051079eb7e7d0bc708c9
- SHA1 68d711619c663c16351ef418ec43afc8a9822d5e
- SHA512 2eef536546c7a453d53652503dc4d40ad55e93c9326165c75030275e1c59eb4e50da197b68b2fd3ffcf773a34b07ddf06f7dfad83ded0d7397a22f8f5823afb0
- SSDEEP 98304:esNPpfrZ9JdXN0B7+swUbYZfgs0Qlxjjoijo2:7RrZ1U64s3oUo2
- TLSH T1B49628126EAC46B5D06FBD3088A1C3B9E5717C114A32AA0B1DD0FE5EAE739D17D2D321
- MD5 SHA1 SHA512 SSDEEP TLSH