Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/05/2026, 12:52
Behavioral task
behavioral1
Sample
2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe
- Size 3.7MB
- Sample260506-p37tksbs8z
- SHA256 f8a980709b720bda70f98fe2cccfcb88fb609cc476390347521df988d72293e8
- MD5 07647a527ffa34e5223228d760c9ee3e
- SHA1 6c56bc954045374195b47b2bb5e4c002286b7a4a
- SHA512 9f4991c414c8d1f2424e4f1942f45366057ae9a69ea73675526ec95f0a0d86fe3554d45d524cbe59866a88f6b07b8e64b431a46ebe65f3b3f8a18d9188841a95
- SSDEEP 49152:8vbO5gYxE89+ApwXk1QE1RzsEQPaxHNQw9dH40N5WZRuiuw9dH40N5DVBXdcB:qYg293wXmoKxdH4AxizdH4Afde
- TLSH T14D06BF0272A408A1D177E23AE596CB16E2B17C114BA197DF4255239F1F33AE1BD3E732
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\diskpart.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\hh.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\subst.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\comp.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\fc.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\net.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\chcp.com- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\mmc.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\winver.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\label.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\cipher.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\write.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\help.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe -
resource yara_rule behavioral1/memory/1976-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x0009000000021698-5.dat upx behavioral1/memory/1976-920-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1976-3200-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.19041.662_none_746c3bfaa509091f\r\dtdump.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\r\SearchIndexer.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1266_none_7e2b6be969016c27\licensingdiag.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.1_none_4e633e7ac2500190\mspaint.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.19041.84_none_f80970fc24265338\BioEnrollmentHost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.1202_none_c0150a0a443c0ffc\r\wbadmin.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_e2f3aaf24de135ec\Magnify.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-setspn_31bf3856ad364e35_10.0.19041.1_none_35f6aeed7d8158f9\setspn.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_477a57e55b61aba8\r\SyncHost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.207_none_00b5dbdfab19326f\UtcDecoderHost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15805.0_none_646d7347043be71c\aspnet_regbrowsers.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\SyncAppvPublishingServer.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.264_none_29367e02ede71097\f\wbadmin.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.19041.1151_none_f0b5afbf42eaff75\r\Spectrum.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.19041.1_none_71d7deb9b2d1d29b\verclsid.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.264_none_e85c49c0793f9f24\Win32WebViewHost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.19041.1_none_7d903181d06247f1\CastSrv.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\f\gpupdate.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\ssh-keygen.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\r\tracerpt.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_af1474f55f209109\r\raserver.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\r\CredentialEnrollmentManager.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\f\WerFault.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\MusNotificationUx.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.746_none_46f79836a0dc7206\f\Dism.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_dc7caa836f08ad57\regedit.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.19041.1_none_4c7da197e5837576\dtdump.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.746_none_a47144c464d15475\r\WSReset.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.19041.1_none_d25dd411ed85e6ba\ksetup.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_816403dd2374fa29\r\dfrgui.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\CredentialEnrollmentManager.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.572_none_3e399e76562f6053\netbtugc.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.19041.1_none_8f9e4094cc5ab626\ApplicationFrameHost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.746_none_5536c5683efe1dad\CameraSettingsUIHost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\SearchFilterHost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.1_none_90e29eafea574969\psr.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1266_none_82441dbab862ff6a\f\msoobe.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_10.0.19041.1081_none_491d51c316b5ea8f\wsqmcons.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\a60e034236e5d701ed9600001815341f.ShellLauncherConfig.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.1_none_255cf058436a8b63\gpscript.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1_none_6e398157aa492263\setup_wm.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_908b22903a403149\newdev.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_regasm_b03f5f7f11d50a3a_10.0.19041.1_none_d7fcc21ca684dcb4\RegAsm.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\f\conhost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.19041.1_none_5dccefa0bb5ef60b\clip.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_ba2b07b5ed02761a\imecfmui.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\f\ShellLauncherConfig.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netsh_31bf3856ad364e35_10.0.19041.1_none_159203c1973658cd\netsh.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1_none_db40687413b90853\wmlaunch.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\shrpubw.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\hvsirpcd.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\msil_edmgen_b77a5c561934e089_10.0.19041.1_none_25aa820b9acb3357\EdmGen.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.19041.1_none_da6b9c85304fbda8\sdiagnhost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\qappsrv.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\r\relog.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.19041.84_none_6461f879a9c4a23e\r\wifitask.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_9204c42a031e28cf\appcmd.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_0f44a2d7a5e3a37a\ChtIME.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1976
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 4.2MB
- SHA256 23fdebbe6f200f67f557b325cc8dded16e2d6f91731b685ecfa1631f672ef6e7
- MD5 52d3648cda2f72cc339c8012b9c60b33
- SHA1 aaa5e7f89cd2dfe722f49e73d0b0e78537694409
- SHA512 d1e5d8bae1686985f4a45bcb905fa41d414683f690b464efbba0b6bf5062f2cc33e5e0b4b3fae5bf3a5a7acfdff43156762b84bb97a35572b8803cd5638e99fc
- SSDEEP 49152:8vbO5gYxE89+ApwXk1QE1RzsEQPaxHNQw9dH40N5WZRuiuw9dH40N5DVBXdclPje:qYg293wXmoKxdH4AxizdH4Afdyjob
- TLSH T11D16AF12B2A408A1D173D13AD592CB5AE6B17C414BB096CF435563AF1F33AE1BD3A732
- MD5 SHA1 SHA512 SSDEEP TLSH