Analysis
- max time kernel
149s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/04/2026, 15:02
Behavioral task
behavioral1
Sample
2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe
- Size 18.7MB
- Sample260419-seysjsax2v
- SHA256 2e503ae6ff04478795345c745d726a305c2f01efdec46df3800173c60520a28d
- MD5 ece24de5f469a717939296df8e67555a
- SHA1 b6b7c5d9735f85c0b80871dca19c231405adcb1c
- SHA512 decc3c378502f7cdb9d974ca415d6483f646a484b201143ab3bfab70bf2ce4f583f4d00c6666536e56064d5305260f2e7a1d74bd0548ad7c2ae7a0b21391a58b
- SSDEEP 98304:esQIabjKoh9WcdatLK3BDhtvS0Hpe4zZUbYZfgs0Qlx5FYO+i4:qBnvjeuU64spn4
- TLSH T1AC171982BE64DCEEECB8A1B18859DA72ED753D4939226617F260F71F3E331116A10335
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netsh.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sc.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\curl.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fontview.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\recover.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\relog.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\label.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\print.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icacls.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\setx.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrs.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\certreq.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\autofmt.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\compact.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe -
resource yara_rule behavioral1/memory/1408-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000a000000024140-5.dat upx behavioral1/memory/1408-360-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1408-3200-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1_none_9be54a615e8b9e53\autofmt.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ioningsecureprocess_31bf3856ad364e35_10.0.19041.1_none_4cc7187cbf1ef970\psp.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.153_none_dbdeec75cdd2a4d1\f\DataUsageLiveTileTask.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\LicensingUI.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_e20a2c618eea3856\r\agentactivationruntimestarter.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_e9349b06dfab6fdc\imjpuexc.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.746_none_63b0fc68ee30f2cb\f\IMESEARCH.EXE- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_9202844cd514ab44\aspnet_compiler.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.1_none_9c23b4a33898c817\isoburn.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_f5ba41fece31d7fe\SpatialAudioLicenseSrv.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.19041.1151_none_7233d7a171b1272a\pnputil.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\f\hvix64.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\hvax64.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.19041.746_none_11e04cec24452336\r\dwm.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_d8ed4acdd3960fad\f\wecutil.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.19041.1_none_de17915d5c62b62d\mqtgsvc.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_dfsvc_b03f5f7f11d50a3a_4.0.15805.0_none_c0d2d1227427864f\dfsvc.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.19041.1_none_339537d6c993f72b\AgentService.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\r\ByteCodeGenerator.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.1_none_8df65f134a48195f\rundll32.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_addinutil_b77a5c561934e089_4.0.15805.0_none_fcd173bc1b434b81\AddInUtil.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_bd769d14dfd7d29d\r\sdbinst.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-write_31bf3856ad364e35_10.0.19041.1_none_1fc88a05b0d625c5\write.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1081_none_8b145c40e6c6207f\winrshost.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_b321f2c2ab7710a2\sdbinst.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_ba2b07b5ed02761a\imecfmui.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\r\FXSUNATD.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\f\ssh-keyscan.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1151_none_c86feb6936a97173\omadmclient.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkping-setup_31bf3856ad364e35_10.0.19041.1_none_6e5126083c2c0ea6\NDKPing.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.572_none_b322aa88d0148356\f\ReAgentc.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.19041.1_none_67494c7cd91d4b47\odbcconf.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.19041.264_none_52f277f293540161\WinBioDataModelOOBE.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1_none_cc2783ead104d62a\winrs.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\f\sethc.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.19041.1_none_53029e0f94a11c6d\WUDFHost.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.19041.1_none_16cc981df6cf3111\WmsUserAgent.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.19041.1_none_2da6c69fad3fdf0b\DsmUserTask.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\iisreset.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-tool-exe_31bf3856ad364e35_10.0.19041.1_none_b00bcb3b56b3d8e3\manage-bde.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.19041.1202_none_fd57358454385601\CustomShellHost.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.19041.746_none_8d7110d8c33b651f\r\TieringEngineService.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_dc7caa836f08ad57\f\regedit.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\r\wsmprovhost.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.746_none_3f7ee0a8ee28ef7d\f\netiougc.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_ffd303094ff1fe66\f\auditpol.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\r\relog.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.844_none_64d33f8fb364398c\f\net1.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.19041.1202_none_33e8c5dac6801a49\f\CompatTelRunner.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.84_none_90b92bf6be625d1b\r\dfrgui.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1266_none_8fc08423f52c1606\r\wmlaunch.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.264_none_91c1d6c40350b1b6\iissetup.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_30274b64fe158ec9\f\sxstrace.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.1_none_8b021141ec175d3e\sdbinst.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.19041.746_none_045e85893c117e35\f\wksprt.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_wpf-xamlviewer_31bf3856ad364e35_10.0.19041.1_none_afe0be8163ecf7d4\XamlViewer_v0300.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.746_none_bd9bc99304595128\f\ReAgentc.exe- 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_ece24de5f469a717939296df8e67555a_amadey_elex_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1408
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 19.3MB
- SHA256 0a86830c0ad82ebc14b53606964f80469549dcd8755f54dc92a22a6ef6492597
- MD5 d15735391ada3c0107dad97af5879190
- SHA1 0b4a2ebbcc5b0c256cc87620aebf268b17593abb
- SHA512 eaf46be167000d9b805b37a0efd2aecf39208ef334693cabd707662c1538426809424e4846b5e1bfa375f825189fbc8d9e89a6fbce062a9bbae79eac610115c3
- SSDEEP 98304:esQIabjKoh9WcdatLK3BDhtvS0Hpe4zZUbYZfgs0Qlx5FYO+iwjoI:qBnvjeuU64spnCoI
- TLSH T12D172A82BE74DDEEECB8A1B18499DA72ED753D4939226607F260F71E3E335116A10334
- MD5 SHA1 SHA512 SSDEEP TLSH