Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/04/2026, 14:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
- Size 657KB
- Sample260422-ry87yshs4k
- SHA256 ea8f9777b35d5dc03f9df02a58ac2d381955c2e85f17bc28b54d9e19fd00c524
- MD5 365d8286001f9ca393be28536e53b006
- SHA1 190164a039eeb504ca8a667dcd232d5c66a17df5
- SHA512 b15ad9d0541fedc5d29023cf2bfc9ea8191de13d5d5b73e6fd607ba6161573a2a55fec06649e71345ba7a3952de10179ae1308df32a90b51a3304ef0df22da72
- SSDEEP 12288:NW4m8ntl5OLpdNQD+k3HVJ5xDfp4D7/SAOZi+5v4+rcKftS:w4mWzmXCJVJTt4D7/SAOZi+5v48cKfQ
- TLSH T147E49E15B3E044F6E0B79638CEA65721E9767C155B30D74F13A8866E0F237609E3BB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\unregmp2.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\wusa.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\Fondue.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\ctfmon.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\RpcPing.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cttune.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icacls.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\sfc.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\winver.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\regedt32.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\DWWIN.EXE 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\systray.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\bthudtask.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\certutil.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\takeown.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sethc.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\wlanext.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\net.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\AtBroker.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\calc.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\TapiUnattend.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\taskkill.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\clip.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\CloudNotifications.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msra.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hh.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\efsui.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\verifiergui.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cacls.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\ndadmin.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_79593\java.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\r\vmcompute.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.19041.1_none_13a24884d12d6915\vmplatformca.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.19041.746_none_e540b68b09558f5a\LockScreenContentServer.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-alg_31bf3856ad364e35_10.0.19041.746_none_86e29cecb9edce01\alg.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\f\winload.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\VmComputeAgent.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.153_none_c283d2cf01b0b7d8\f\EoAExperiences.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\ScriptRunner.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.19041.1_none_e6d5a48c4da284da\aitstatic.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\f\audiodg.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_4eec2752c7ea16f8\backgroundTaskHost.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.19041.1_none_15ad78a57833209d\CompPkgSrv.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7000e6adf00c3d30\r\CloudNotifications.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.84_none_8ea6a37043f4ae90\ClipUp.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\LaunchTM.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.19041.1_none_c5908742e55dbfeb\CredDialogHost.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.19041.1_none_77d767642c0e040b\chkdsk.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compact_31bf3856ad364e35_10.0.19041.1_none_afe6484e54f00fd0\compact.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\r\cmdiag.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_119b1e415d838a28\r\autoconv.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.1_none_f4db83a870443aa2\CloudExperienceHostBroker.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.1_none_b719750f25d4cc37\AppResolverUX.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\CredentialEnrollmentManager.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_b321f2c2ab7710a2\f\sdbinst.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\f\LaunchTM.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\Taskmgr.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\winresume.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.19041.844_none_de5d9fe254d9f8c4\BioEnrollmentHost.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.1_none_1b0a4d6f748b99f5\fsquirt.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.423_none_6c3451a09cba3850\f\AccountsControlHost.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_119b1e415d838a28\autoconv.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.1266_none_ab5bdb26141e0be5\f\vmms.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\AppVDllSurrogate.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\r\ByteCodeGenerator.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\notepad.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.1_none_44197b0fdd55f562\AccountsControlHost.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_abd26b7610cb738e\f\AddSuggestedFoldersToLibraryDialog.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.264_none_40d14f6c04397868\agentactivationruntimestarter.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.264_none_de5e254ba7caf399\r\tcblaunch.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.423_none_841c30f68571c385\r\hnsdiag.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.746_none_c1db40c45e8f2d9e\r\wbengine.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.1_none_9b8799837b1e944c\WindowsSandbox.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1266_none_aa0661cc14f9fe9a\vmwp.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.84_none_40bd4149a6d52edb\f\AppVClient.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\r\ApplyTrustOffline.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.19041.1_none_03029e85abc99279\bitsadmin.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4872 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe 4872 2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_365d8286001f9ca393be28536e53b006_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4872