Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/05/2026, 17:16
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe
- Size 5.0MB
- Sample260524-vs87jsb13r
- SHA256 494fa84a1c6fafec9cfb7efc1345292136d75f93f0eabd91ccda5bbbc600ebd0
- MD5 9452c26336b8441259b9ebc88a6ae389
- SHA1 9fe286c4a11f6b86b8026ab48e02f48aa45eb25c
- SHA512 da4fd76d798f7ff2b0179634a2d21f1a4827f0b6f424bb7e67ead41cc463989b78777e50892b283d3b50abb3a29c83a3bedca93eab0c1f771735e935376a7fdd
- SSDEEP 98304:7fkZclW0MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMf:zPlWuTfLd5
- TLSH T1E3367D1273F88627E0BA927EC0715A79A7757C2B9B32C74F3104B65E1D727828927723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x000d000000024385-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x000d000000024385-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\netbtugc.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\chcp.com- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\help.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\runas.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\sc.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\wscript.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\autoconv.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\curl.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\relog.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\certutil.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\control.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\net1.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\attrib.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\dialer.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\finger.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\raserver.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.1_none_45fd6972631ff67c\IMESEARCH.EXE- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.19041.1202_none_ddf8c4144200f5b4\f\winresume.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.19041.1_none_d9b4a5b5fd217f4b\dxdiag.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.19041.1_none_9470ed79dcf5eade\help.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_c47fb20821633815\f\imecfmui.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.19041.746_none_0119299746221375\f\XBox.TCUI.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_9fa94241ef63ceb4\r\wermgr.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\FXSSVC.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_20a89186aedb6af7\r\msinfo32.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\f\PrintBrm.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\r\MsSense.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_813ba58adb6e7f68\r\GameBarPresenceWriter.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1_none_a068a30a6853aaec\ByteCodeGenerator.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_a8b46aaa6c07ca3d\f\CredentialUIBroker.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.746_none_b8eadbf8a9c907b3\r\psr.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\r\iisrstas.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_fbaeb6d5afb287f7\gpresult.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.746_none_bd9bc99304595128\f\ReAgentc.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_27f9f931a79d1cbe\mavinject.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\WpcUapApp.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\phoneactivate.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.84_none_809ebfa242fbf368\r\wimserv.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.1_none_255ef7c1a8ec5bf0\fsquirt.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-charmap_31bf3856ad364e35_10.0.19041.1_none_b29f753478196f5e\charmap.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.19041.1_none_da52541188969d5e\mcbuilder.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.264_none_c1c396da5ea1410f\f\wbengine.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1_none_c36f57b8a28f2fbc\msoobe.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.1266_none_bfb5312df2d5c960\r\WpcMon.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.19041.264_none_7dd490aa65cdf624\r\runexehelper.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.746_none_4b1a1978d1832a5f\r\OpenWith.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ribbons_31bf3856ad364e35_10.0.19041.1_none_3ea5f185c75971c2\Ribbons.scr- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\f\ResetEngine.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.662_none_0070027dab4e4ffe\r\UtcDecoderHost.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.19041.1_none_16cc981df6cf3111\WmsUserAgent.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\subst.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.1_none_4475a86a4f1da227\BackgroundTransferHost.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_fb3ba1752084c5cf\rrinstaller.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.19041.264_none_7a40d01e6ba302b9\mfpmp.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.84_none_42927ae06bc1dce9\WpcMon.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_e73f0197262d9fec\TiFileFetcher.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1202_none_5b834788c0d17953\f\iexplore.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.84_none_40bd4149a6d52edb\r\AppVClient.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1_none_cc2783ead104d62a\winrs.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_ccf6cb6d0aa9a822\r\mstsc.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_680d56683fad152b\f\isoburn.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.1_none_24a9c1e1e1b0f793\ttdinject.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\TCPSVCS.EXE- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\MRINFO.EXE- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.746_none_eaf7a50dc46d5592\f\Utilman.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.1288_none_e25de9f9d964cdad\r\conhost.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1_none_e9b79397c28488a5\pcalua.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_state_exe_b03f5f7f11d50a3a_10.0.19041.1_none_420589df53dc49e5\aspnet_state.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3\f\fontdrvhost.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.1_none_6bac6724a4ab4460\svchost.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseNdr.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.19041.746_none_cabafbc5834ab93f\f\DisplaySwitch.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4520
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 5.5MB
- SHA256 565cc91028343be3d1fe11d02cfcb096a25d066964bfbf6fdfef67ffc50330ff
- MD5 18ce13829a5050a0b4d7bb92aed112ac
- SHA1 55ab0f46b9700f4f1ca01c09265345a9ac43e1bc
- SHA512 eba091634382782e82e8cee46dcf5a86892b0e96c5b239511008ac2d64bb98a8e9d675aa000f9ca312778514039a39eaa4541f2af94f40fd7147bcf8345749e1
- SSDEEP 98304:7fkZclW0MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMC:zPlWuTfLdpoH
- TLSH T1C8466D12B3F88627E0BB927EC0B15A79E771782A9B31C68F3144B65D1D737828527723
- MD5 SHA1 SHA512 SSDEEP TLSH