Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/05/2026, 09:21
Behavioral task
behavioral1
Sample
2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
- Size 13.2MB
- Sample260503-lbbehsew2s
- SHA256 20756b4e9eea3b92fd7eccb7c75320d72f26ef1921181b773cfa579b838a1bb6
- MD5 a6bd9a743ab4e226aabd7afde215eed2
- SHA1 249a46e8b6c42ffcda7f8911c129a181cd3bc785
- SHA512 75a002b868c2a793637d1277ce783e206a630b77fe10ac2523cb97f6607fa101a752ff4db83837b570ab451942aaa9160631a1febf348b5a52eaad7b17eab358
- SSDEEP 98304:SIaIDQIoWDqnstLEmHrUbYZfgs0QlxSTIOSAa:wuQDeqnhmLU64siTfG
- TLSH T1FDE619036EAC45BAD86FBD344D24C6B9D5607D156D22AA0BBDC0BE4EFA325C1781D332
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000500000002a738-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000500000002a738-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\compact.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\certutil.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\cttune.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\newdev.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\charmap.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\choice.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\dccw.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\mshta.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\replace.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\resmon.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SysWOW64\fc.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe -
resource yara_rule behavioral2/memory/3316-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000500000002a738-5.dat upx behavioral2/memory/3316-630-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3316-3178-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.22000.1_none_d8ef654968ad6d9d\regsvr32.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-o..eminputhost-process_31bf3856ad364e35_10.0.22000.120_none_842c9d9e843cf6c7\f\ISM.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.22000.120_none_3fbde764cc71982b\ShellLauncherConfig.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\r\lpksetup.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.22000.1_none_6dc8af5cc18b0564\auditpol.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4dda7ffaba1d5c31\cscript.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.22000.1_none_5d8b0964af4f5e05\LockScreenContentServer.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.469_none_71e2bda169e58aea\f\SpatialAudioLicenseSrv.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.22000.194_none_d171c2327b4ef3a7\f\printui.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.22000.100_none_bac6834bfb16b20d\f\SecurityHealthSystray.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.22000.1_none_d4af4db521f3ebaf\curl.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.22000.493_none_31b28f9ae4503c95\f\vmms.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.22000.1_none_2302091cdefe79c3\uwfmgr.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.22000.1_none_9ff8aada90ee79bf\Fondue.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_b7671877039e31c8\typeperf.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.22000.1_none_a3f177b107b8418a\dmclient.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.22000.65_none_99e34b544b7754a7\provtool.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.22000.469_none_e574fa2e821169ac\f\SystemSettingsBroker.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_5fa2feeecc138dd4\poqexec.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.22000.1_none_49632d3770877d59\TSMKUFIL.CMD- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_3.5.22000.1_none_ac5cd13c097cdc14\MSBuild.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.22000.120_none_05dfd9bc9f8bc6b6\f\Win32WebViewHost.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.22000.1_none_20febd84120198e8\CredentialUIBroker.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.22000.1_none_156c36971612d61e\CompatTelRunner.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_6b5eb3c4c1ffcde9\r\WerFaultSecure.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.22000.1_none_04376727db53ed5d\setup_wm.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-locator_31bf3856ad364e35_10.0.22000.1_none_257830d2f16108b0\Locator.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.22000.1_none_a4e82f5676e0e198\odbcad32.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_3353a48da9fe01a4\AssignedAccessLockApp.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dlna-mdeserver_31bf3856ad364e35_10.0.22000.1_none_2c4bd0ba27aaecad\MDEServer.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_555ad0e288836a51\f\SearchIndexer.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.22000.120_none_ef0bb92fa937f7ee\RMActivate_isv.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.22000.194_none_5c736727c3870f49\r\bcdboot.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_6b23f06ce93f4f52\r\RMActivate_ssp.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_10.0.22000.1_none_5a923992d494427e\dplaysvr.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup360-media-base_31bf3856ad364e35_10.0.22000.469_none_259c259bf9e2d267\f\SetupPrep.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\r\Taskmgr.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.22000.1_none_3b4f9cda237a17ee\ChsIME.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.22000.65_none_cc4646d618bda56e\r\SystemSettingsBroker.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.22000.258_none_570e91ed5ac8ebe3\Microsoft.AAD.BrokerPlugin.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.22000.1_none_052acbc0b687a114\SecEdit.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchFilterHost.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.22000.1_none_31352ed24fc2d65e\psr.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.22000.318_none_83a303ac2a49c928\bcdedit.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.22000.348_none_67702744b34d2d9d\HelpPane.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\wmpconfig.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.22000.282_none_9ed8cb052ff869e6\TokenBrokerCookies.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\msil_wsatconfig_b03f5f7f11d50a3a_10.0.22000.1_none_a5a77d19762002a4\WsatConfig.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.22000.434_none_4634d5a384238dfd\f\dsmgmt.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ls-adschemaanalyzer_31bf3856ad364e35_10.0.22000.1_none_2a3c82413b9bc4eb\ADSchemaAnalyzer.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.22000.1_none_909c5510a5987a0e\colorcpl.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.22000.1_none_6cbbdad227c57e28\sihost.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.22000.1_none_950babc05063dd9e\vbc.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15806.256_none_7593da10f932a980\mscorsvw.exe- 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_a6bd9a743ab4e226aabd7afde215eed2_darkgate_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3316
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 13.8MB
- SHA256 21c115a239442bf549df14921513da299a1f6fb1cb3f02b03eb86736540f9981
- MD5 e7ed088c51a0c067e867c0c465344b95
- SHA1 3b293c9e6877ffb6cf83a4c8e1cffab741c0459a
- SHA512 cfadb1f8bd854b75fcfbd35e33f4724d84c69caf562c9c66d2490f5a8e6c3d5ab3afe572e940c3d22c1c07484531bc580df0a1a73b8ae5cee53944d823d0ae08
- SSDEEP 98304:SIaIDQIoWDqnstLEmHrUbYZfgs0QlxSTIOSAmjoG:wuQDeqnhmLU64siTfcoG
- TLSH T18AE618036EAC45BAD86FBD344924C6B9D5603D156922AA0BBDC0BE5EFE335C1781D332
- MD5 SHA1 SHA512 SSDEEP TLSH