Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/05/2026, 09:21
Behavioral task
behavioral1
Sample
2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
- Size 13.2MB
- Sample260503-lbbehsew2s
- SHA256 20756b4e9eea3b92fd7eccb7c75320d72f26ef1921181b773cfa579b838a1bb6
- MD5 a6bd9a743ab4e226aabd7afde215eed2
- SHA1 249a46e8b6c42ffcda7f8911c129a181cd3bc785
- SHA512 75a002b868c2a793637d1277ce783e206a630b77fe10ac2523cb97f6607fa101a752ff4db83837b570ab451942aaa9160631a1febf348b5a52eaad7b17eab358
- SSDEEP 98304:SIaIDQIoWDqnstLEmHrUbYZfgs0QlxSTIOSAa:wuQDeqnhmLU64siTfG
- TLSH T1FDE619036EAC45BAD86FBD344D24C6B9D5607D156D22AA0BBDC0BE4EFA325C1781D332
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x000a00000002275b-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x000a00000002275b-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\iexpress.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\attrib.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\net.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\setx.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\fc.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\setup16.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\explorer.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\systray.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\secinit.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe -
resource yara_rule behavioral1/memory/4692-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000a00000002275b-5.dat upx behavioral1/memory/4692-545-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4692-3209-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.19041.844_none_3a7392af5414371e\f\CCG.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_8f1e438c6737a711\r\wscadminui.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snmp-trap-service_31bf3856ad364e35_10.0.19041.1_none_857c0c60dec56103\snmptrap.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.19041.1_none_7ab192ed7079aec0\verifiergui.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_d38e81565538dedf\f\logagent.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.746_none_c291aefd01a5d6d6\r\EoAExperiences.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\InputPersonalization.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.19041.84_none_dc38e61c21c1b710\NetEvtFwdr.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.844_none_9b62a70f9278f2cd\f\ofdeploy.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\r\PrintBrmUi.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.19041.1266_none_69f1a169b4d96a7c\r\pcwrun.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.19041.1151_none_cf9de3ecb3a8f61c\r\BrowserCore.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\f\icsunattend.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6a67731cf3e151f2\r\pcaui.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.19041.1_none_f1d9ebd2fe6dc15b\reg.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.928_none_85ac1b118ff2a924\r\dxgiadaptercache.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.746_none_dbfd31e3890afb72\SensorDataService.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1_none_6df323382219b604\PickerHost.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\notepad.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icacls_31bf3856ad364e35_10.0.19041.1_none_f2fa56e679b879d1\icacls.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.1266_none_c4b179e0b12fe4b9\r\winload.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_813ba58adb6e7f68\r\GameBarPresenceWriter.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\r\wmpshare.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_be3404fb0dff5d84\r\TSTheme.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_4.0.15805.0_none_429bcf7adb8e23ed\AddInProcess32.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_4.0.15805.0_none_faee98a3c711fae7\AddInProcess32.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.1202_none_c0150a0a443c0ffc\r\wbadmin.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.19041.746_none_cabafbc5834ab93f\f\DisplaySwitch.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\f\hvsirpcd.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.19041.1_none_d908336e5b82be3e\chkntfs.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\ScriptRunner.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.572_none_3e399e76562f6053\netbtugc.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_10.0.19041.1_none_3f67a7384812df13\ComSvcConfig.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_f827f008f8832bd5\rasautou.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\x86_netfx-dw_b03f5f7f11d50a3a_10.0.19041.1_none_8e850c52ac392ae6\dw20.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_12e3d70535675c5f\f\dllhost.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.19041.1023_none_d3d892f3280079d7\MdmDiagnosticsTool.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-makecab_31bf3856ad364e35_10.0.19041.207_none_cef5032ec7ecd573\makecab.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.1266_none_1abb9653828c3f41\f\SecurityHealthHost.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\f\SearchFilterHost.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_f3a9dc0fe254a157\wmplayer.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.1_none_7e3d02e24c15fe88\IEChooser.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3\r\fontdrvhost.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.19041.572_none_846686e46b73c8e3\PnPUnattend.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.264_none_51891893184281d8\LaunchWinApp.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.572_none_90e9bab3cbbfd71a\r\djoin.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.867_none_099246ae3a45708c\f\printfilterpipelinesvc.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1_none_f03957c94950f5c5\raserver.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\r\hcsdiag.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\f\conhost.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\ByteCodeGenerator.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.264_none_87b4b95ab967b582\f\fontdrvhost.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.19041.1_none_3451e3c68828f3da\smss.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1_none_ef1691668a233417\appidtel.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3fe90cdb6667211e\wevtutil.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\f\msinfo32.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\f\VmComputeAgent.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.746_none_79bfc5cb57157e98\f\WindowsActionDialog.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4692
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 13.8MB
- SHA256 21c115a239442bf549df14921513da299a1f6fb1cb3f02b03eb86736540f9981
- MD5 e7ed088c51a0c067e867c0c465344b95
- SHA1 3b293c9e6877ffb6cf83a4c8e1cffab741c0459a
- SHA512 cfadb1f8bd854b75fcfbd35e33f4724d84c69caf562c9c66d2490f5a8e6c3d5ab3afe572e940c3d22c1c07484531bc580df0a1a73b8ae5cee53944d823d0ae08
- SSDEEP 98304:SIaIDQIoWDqnstLEmHrUbYZfgs0QlxSTIOSAmjoG:wuQDeqnhmLU64siTfcoG
- TLSH T18AE618036EAC45BAD86FBD344924C6B9D5603D156922AA0BBDC0BE5EFE335C1781D332
- MD5 SHA1 SHA512 SSDEEP TLSH