Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/05/2026, 17:16
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe
- Size 5.0MB
- Sample260524-vs87jsb13r
- SHA256 494fa84a1c6fafec9cfb7efc1345292136d75f93f0eabd91ccda5bbbc600ebd0
- MD5 9452c26336b8441259b9ebc88a6ae389
- SHA1 9fe286c4a11f6b86b8026ab48e02f48aa45eb25c
- SHA512 da4fd76d798f7ff2b0179634a2d21f1a4827f0b6f424bb7e67ead41cc463989b78777e50892b283d3b50abb3a29c83a3bedca93eab0c1f771735e935376a7fdd
- SSDEEP 98304:7fkZclW0MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMf:zPlWuTfLd5
- TLSH T1E3367D1273F88627E0BA927EC0715A79A7757C2B9B32C74F3104B65E1D727828927723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000d000000025e21-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000d000000025e21-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\where.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\msra.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\fontview.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\wscript.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\tree.com- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\winrs.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\tar.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\expand.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\attrib.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\at.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\calc.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\notepad.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\compact.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\7-Zip\7zG.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\r\ScreenClippingHost.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.22000.282_none_d1df129ba9a9b56f\f\fsutil.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.22000.1_none_d4af4db521f3ebaf\curl.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.22000.65_none_6e6aca3ab1161ee5\f\pcaui.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.22000.65_none_5df9e0d1a9b3658b\f\Spectrum.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.22000.469_none_82154d2009b8e727\f\MoUsoCoreWorker.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.22000.1_none_3fc7d56a6d567d99\DataExchangeHost.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.469_none_83da02152447c976\f\CustomShellHost.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.22000.1_none_463f193e37cf0011\IEExec.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\msil_ieexec_b03f5f7f11d50a3a_10.0.22000.1_none_1baa132fc64be8aa\IEExec.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_3d11f25cbb74100a\r\sdchange.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.22000.120_none_30f8a86da4d47388\r\sfc.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.22000.71_none_c26272ecb066f6ab\ByteCodeGenerator.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.22000.1_none_83943f096879c6b9\MigRegDB.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.22000.1_none_e4591039f91b38e2\CompMgmtLauncher.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_10.0.22000.1_none_a4046dd80a1bed7d\RelPost.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.22000.41_none_1d0a15319901359b\r\PinEnrollmentBroker.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.22000.1_none_53953f4ad73d0675\csc.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.22000.1_none_88ecf796c4c1d042\AssignedAccessGuard.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.22000.1_none_6f96a08b64cc0ef2\msdtc.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.348_none_04e0603a0d245e07\r\ie4uinit.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.22000.71_none_123327ab91644184\raserver.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.22000.434_none_ae734c6bf20696b6\djoin.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15806.0_none_5fe3df7e2920f4bd\ilasm.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15806.0_none_d4aecc3168a74ea1\aspnet_regsql.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.22000.1_none_428c3541faeaf85a\autochk.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_10e4c14208d6d2d3\f\wmplayer.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.22000.348_none_88dc8ff6981e1a22\r\VmComputeAgent.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\r\Taskmgr.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\chglogon.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.22000.37_none_46638c67a45b1942\MusNotification.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.22000.120_none_05dfd9bc9f8bc6b6\Win32WebViewHost.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_wcf-wsatconfig_b03f5f7f11d50a3a_10.0.22000.1_none_a03bdcb625ffa5d4\WsatConfig.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_a2190a6cc64fec46\r\mfpmp.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\SenseCncProxy.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.22000.282_none_a92d755764592be1\f\TokenBrokerCookies.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.22000.348_none_8c1cd5f65f938380\r\DataStoreCacheDumpTool.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.22000.1_none_6c7a140d3670631f\winrs.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseIR.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.22000.1_none_833f67c8d584d19c\dplaysvr.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_9b4fcb543bd21a13\f\LaunchTM.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\r\wmplayer.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.22000.434_none_e6157b76b496d682\refsutil.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.22000.376_none_fd0b376d9072c88a\f\rdpclip.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.22000.1_none_d0b58ed08fdbb9ff\cliconfg.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.22000.1_none_88db7a29937b79fa\tasklist.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.22000.120_none_8c1e5976c0145439\r\PkgMgr.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.22000.1_none_1788ef5112142c1f\DeviceEnroller.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.22000.37_none_ac96ecb2523a6a01\InputSwitchToastHandler.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.282_none_04af1ce80d4a389a\r\ie4uinit.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.22000.1_none_fc8dfad861947ee8\consent.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\tscon.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.22000.1_none_46b096804233c6b5\ThumbnailExtractionHost.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-attrib_31bf3856ad364e35_10.0.22000.1_none_132662a9c55e557b\attrib.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\notepad.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\cmimageworker.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.22000.282_none_ed4920c9a3fd8bd2\adamsync.exe- 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-24_9452c26336b8441259b9ebc88a6ae389_amadey_elex_glassworm_hijackloader_icedid_njrat_rhadamanthys_stop_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3204
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 5.5MB
- SHA256 565cc91028343be3d1fe11d02cfcb096a25d066964bfbf6fdfef67ffc50330ff
- MD5 18ce13829a5050a0b4d7bb92aed112ac
- SHA1 55ab0f46b9700f4f1ca01c09265345a9ac43e1bc
- SHA512 eba091634382782e82e8cee46dcf5a86892b0e96c5b239511008ac2d64bb98a8e9d675aa000f9ca312778514039a39eaa4541f2af94f40fd7147bcf8345749e1
- SSDEEP 98304:7fkZclW0MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMC:zPlWuTfLdpoH
- TLSH T1C8466D12B3F88627E0BB927EC0B15A79E771782A9B31C68F3144B65D1D737828527723
- MD5 SHA1 SHA512 SSDEEP TLSH