Analysis
- max time kernel
150s - max time network
134s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system - submitted
06/05/2026, 12:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
- Size 4.4MB
- Sample260506-pwf3aaa17v
- SHA256 011439b6a2f97157c3c5c648c113463f3ef594ea57fbb4cd98371b0257139645
- MD5 abf6b18a9a20ed63739e2f8af5130ed3
- SHA1 346ff05d88cae810fc6b1175bbae59d36b9b177a
- SHA512 b1e112897a1181e14acf679704065e88493a0ca77ab79e71fd5a6094753246cb97ba0bcdc958f1f6239ef013b2ff31371d44239e9caca4830d14fcf777691c2c
- SSDEEP 49152:tm0QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJb9DN5J8NRV3d:jQvGAdlCEL8c/bRNw5CA
- TLSH T1E0264B656BE880F5E0A7D174897A8572F77A78420D32EF4F0291CA6F3F336904D29729
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\psr.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\systeminfo.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\ipconfig.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hh.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\relog.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\compact.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\PickerHost.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\tzutil.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\eventvwr.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\gpresult.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\verclsid.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\fontview.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\regedt32.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\runas.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\autochk.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\cmmon32.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\cttunesvr.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\fsutil.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\icsunattend.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\replace.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\setx.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\RpcPing.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\TCPSVCS.EXE 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\wsmprovhost.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\chkntfs.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\mobsync.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\Taskmgr.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\tcmsetup.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\calc.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\find.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\findstr.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\notepad.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\systray.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dialer.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\proquota.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\UserAccountBroker.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\SoundRec.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\133.0.6943.60\chrome_pwa_launcher.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\NewsStub.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Todo.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\Windows Mail\wab.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_168343\javaws.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\133.0.3065.69\pwahelper.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\msedge_proxy.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Solitaire.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.22000.434_none_e6157b76b496d682\f\refsutil.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.22000.100_none_1c26ef58a3003bf2\f\SystemSettingsAdminFlows.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.22000.282_none_1a017429cb7fea2c\f\rdpshell.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\f\systemreset.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..-client-aggregators_31bf3856ad364e35_10.0.22000.318_none_701008567a383b30\f\AggregatorHost.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_9b4fcb543bd21a13\f\Taskmgr.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_75b35e16f6608fe4\f\WerFault.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.22000.71_none_bcb9c63bb991a4c6\f\msconfig.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.22000.348_none_a83a13d7c7ca92d4\f\nfsclnt.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.22000.37_none_7461fc8593f740b9\f\ApproveChildRequest.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_987098e149e09f68\f\msinfo32.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.22000.41_none_705d08ab0a6355da\f\mspaint.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.22000.120_none_9ed34dd5b0c53507\f\WpcUapApp.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_0f0554e930e1de1c\f\RMActivate_ssp.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_10e4c14208d6d2d3\f\wmpshare.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_product-containeros__windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_2b1b00237ae1bbca\f\SearchFilterHost.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.318_none_349d8ac96fe3d679\f\appidtel.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_f927204bf41f3d61\f\quickassist.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\MsSense.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.22000.318_none_92049afacb4417d8\f\dtdump.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.22000.41_none_46e53612c0e92204\f\BdeUISrv.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.22000.65_none_f3a35be8937453f0\f\TabTip.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.22000.282_none_f57e785f37294fe2\f\ntprint.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\UUS\amd64\MusNotifyIcon.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.22000.120_none_c073b3a01f4d4399\f\RdpSaUacHelper.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.22000.1_none_d7534de2f1aff751\AddInProcess32.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpksetup.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..platform-media-base_31bf3856ad364e35_10.0.22000.376_none_d0bc762eaa58a5f0\f\SetupPlatform.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_9b4fcb543bd21a13\f\LaunchTM.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\write.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.22000.120_none_8fd8aab412295721\f\wlrmdr.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\f\AuditShD.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..monotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_618940d4a376d501\f\MoNotificationUx.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.22000.282_none_53574bb7dad4a93c\f\mstsc.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.469_none_560fc7f19d1d3ed7\f\VSSVC.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..pickerhost.appxmain_31bf3856ad364e35_10.0.22000.282_none_08c227a0c7c9c4c1\f\ModalSharePickerHost.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\f\audit.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpksetup.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.469_none_83da02152447c976\f\CustomShellHost.exe 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4584 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe 4584 2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_abf6b18a9a20ed63739e2f8af5130ed3_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4584