Analysis
- max time kernel
149s - max time network
99s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/05/2026, 12:52
Behavioral task
behavioral1
Sample
2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe
- Size 3.7MB
- Sample260506-p37tksbs8z
- SHA256 f8a980709b720bda70f98fe2cccfcb88fb609cc476390347521df988d72293e8
- MD5 07647a527ffa34e5223228d760c9ee3e
- SHA1 6c56bc954045374195b47b2bb5e4c002286b7a4a
- SHA512 9f4991c414c8d1f2424e4f1942f45366057ae9a69ea73675526ec95f0a0d86fe3554d45d524cbe59866a88f6b07b8e64b431a46ebe65f3b3f8a18d9188841a95
- SSDEEP 49152:8vbO5gYxE89+ApwXk1QE1RzsEQPaxHNQw9dH40N5WZRuiuw9dH40N5DVBXdcB:qYg293wXmoKxdH4AxizdH4Afde
- TLSH T14D06BF0272A408A1D177E23AE596CB16E2B17C114BA197DF4255239F1F33AE1BD3E732
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\curl.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\msdt.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\attrib.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\compact.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\relog.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\find.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\sc.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\takeown.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\resmon.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\subst.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\regedit.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\logman.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\sethc.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\user.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\whoami.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\clip.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\reg.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe -
resource yara_rule behavioral2/memory/4968-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x001900000002a109-5.dat upx behavioral2/memory/4968-1104-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4968-3182-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.22000.282_none_66112670800af37c\f\vds.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.22000.282_none_31bc5b70e4490cff\vmms.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..sermode-kernel-la57_31bf3856ad364e35_10.0.22000.348_none_e639e7a3fcfcf06b\r\securekernella57.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.22000.120_none_fc8d986a0ba4c584\f\AppResolverUX.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.22000.1_none_156c36971612d61e\CompatTelRunner.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.22000.1_none_1779dd0615e565ea\MicrosoftEdgeCP.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.22000.493_none_674ce99b39869941\f\ntoskrnl.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.22000.282_none_85f8b97e4dbf9185\r\wpnpinst.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.22000.434_none_79ca17dba25cd0c9\r\curl.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.22000.348_none_53ff6ed560767984\f\mighost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-secinit_31bf3856ad364e35_10.0.22000.1_none_ddfb8e1dd1c74c7f\secinit.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-drivepreparation_31bf3856ad364e35_10.0.22000.1_none_f73525016dc68d1a\BdeHdCfg.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\f\systemreset.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.318_none_aa689c124bcde8ee\r\CheckNetIsolation.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.22000.1_none_7b92f89679249548\wmlaunch.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_10e4c14208d6d2d3\wmpconfig.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.22000.1_none_f159656ce5b94cb8\tpmvscmgr.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..monotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_618940d4a376d501\r\MoNotificationUx.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\chglogon.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..platform-media-base_31bf3856ad364e35_10.0.22000.376_none_d0bc762eaa58a5f0\f\SetupPlatform.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.22000.469_none_59f2db2aeb94e019\WpcTok.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.22000.318_none_a3d287795cb1ca0f\r\IESettingSync.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.22000.1_none_5640d9ef21678ad0\ssh.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.22000.1_none_a4e82f5676e0e198\odbcad32.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.22000.1_none_a341a57910bc73cd\wab.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_c58bc93032642398\f\winrm.cmd- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.22000.469_none_647b90a512106929\f\winresume.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.22000.1_none_83943f096879c6b9\MigRegDB.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.22000.1_none_e4591039f91b38e2\CompMgmtLauncher.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.22000.1_none_367e57d4b3f92c2f\TSTheme.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.22000.1_none_16fdfdd9b45d6e53\waitfor.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_5faf7b34bce42c4c\f\SearchIndexer.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_product-containeros__windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_2b1b00237ae1bbca\f\SearchProtocolHost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.22000.1_none_ec970658acde1577\RuntimeBroker.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.22000.1_none_0af1ba5c97d13826\showmount.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.22000.51_none_2158495b1874d95c\f\services.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_bsdtar_31bf3856ad364e35_10.0.22000.1_none_b6c65439a52aae5e\tar.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.22000.1_none_902756b93bcc4aa2\vbc.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.22000.469_none_40856ba085a100c4\f\BioIso.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.22000.120_none_68fb744ea962915c\conhost.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-inputredirection_31bf3856ad364e35_10.0.22000.1_none_5a68555768bbe5b5\rdpinput.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.194_none_3a6786958001450b\wowreg32.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\MsSense.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-managementconsole_31bf3856ad364e35_10.0.22000.1_none_de173b06bfe08f32\InetMgr.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.22000.65_none_cc4646d618bda56e\SystemSettingsBroker.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.22000.469_none_5704c6175ad01b79\Microsoft.AAD.BrokerPlugin.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.22000.1_none_37833ea9df2deb57\scrnsave.scr- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.22000.348_none_0bba55ae109b8677\WmiPrvSE.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.22000.1_none_af37ae793d4cfdf0\xwizard.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.22000.1_none_c5b187e40e57e8e5\fsquirt.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.22000.100_none_bac6834bfb16b20d\f\SecurityHealthSystray.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.22000.1_none_f24d5bd1a5bd0380\perfmon.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.22000.1_none_86b6cff74107116e\SystemPropertiesComputerName.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.22000.282_none_81f8a77609cf735a\f\MoUsoCoreWorker.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.22000.1_none_f29fe3d9ca66cdd6\CloudNotifications.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.22000.1_none_f9ae56b6c96ec8d4\dfrgui.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_multimedia-rrinstaller_31bf3856ad364e35_10.0.22000.1_none_7385f44ec67e947a\rrinstaller.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.22000.1_none_1ec4cdf6958d4fc8\ImagingDevices.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.22000.1_none_2e3f0787886879d3\wbemtest.exe- 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_07647a527ffa34e5223228d760c9ee3e_amadey_elex_icedid_njrat_remcos_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4968
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 4.2MB
- SHA256 23fdebbe6f200f67f557b325cc8dded16e2d6f91731b685ecfa1631f672ef6e7
- MD5 52d3648cda2f72cc339c8012b9c60b33
- SHA1 aaa5e7f89cd2dfe722f49e73d0b0e78537694409
- SHA512 d1e5d8bae1686985f4a45bcb905fa41d414683f690b464efbba0b6bf5062f2cc33e5e0b4b3fae5bf3a5a7acfdff43156762b84bb97a35572b8803cd5638e99fc
- SSDEEP 49152:8vbO5gYxE89+ApwXk1QE1RzsEQPaxHNQw9dH40N5WZRuiuw9dH40N5DVBXdclPje:qYg293wXmoKxdH4AxizdH4Afdyjob
- TLSH T11D16AF12B2A408A1D173D13AD592CB5AE6B17C414BB096CF435563AF1F33AE1BD3A732
- MD5 SHA1 SHA512 SSDEEP TLSH