Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/05/2026, 14:08
Behavioral task
behavioral1
Sample
2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe
- Size 2.4MB
- Sample260528-rfva3sat4k
- SHA256 eb717f9f7933471c96dd6508e955a2f977e4a59b9eea984de42ad92225a4feb9
- MD5 2455c4a089cfa147a9def16c46618671
- SHA1 ba27fc1c4e8a48058a798f23d6cead773a7a30ef
- SHA512 46e92bcafba0e7329d9fe62a6162608f4f6638214f388073df9c2a62b69ee3850360ca9adc570d20db8e33acfd686bea9a0ead596b6568b46fbfb2a9b91a8fe7
- SSDEEP 24576:TIs/MMpd2JZtc+SlWdvFuP0E5jcAkSYqyET5jcAkSYqyEs5jcAkSYqyEOJVJTt4d:3vqlmWdG06pYqBpYqypYq0VBXdcd
- TLSH T18FC54A15F6648671D073D1B9C5D2AA9AEE3234450B308ACB1386D77D2F277E2C93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\colorcpl.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\explorer.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wscript.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ftp.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\systray.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\whoami.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\charmap.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\control.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\newdev.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sc.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hh.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PING.EXE 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\net.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\autoconv.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_10.0.19041.1_none_41668bdd85c44640\InetMgr6.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\f\eshell.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.84_none_65d0f4a4c6cd4975\r\Magnify.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\PeopleExperienceHost.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.19041.1_none_20798db5235046f8\provlaunch.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\MRINFO.EXE- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.746_none_49d38afb2289b178\f\netiougc.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\phoneactivate.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_425d54d86cc1f3e2\r\tttracer.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.19041.1_none_238f55dfbfb45941\Register-CimProvider.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_d9e841974c1d46e8\f\setupugc.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.572_none_90e9bab3cbbfd71a\djoin.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.19041.1_none_15692775b14712c0\forfiles.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\r\msinfo32.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\qappsrv.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.746_none_c291aefd01a5d6d6\r\EoAExperiences.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.84_none_809ebfa242fbf368\f\wimserv.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\SyncAppvPublishingServer.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_8a7b0186743e499b\runonce.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1081_none_8b145c40e6c6207f\winrshost.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_be98bb8265bc211a\mmgaserver.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\subst.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.19041.789_none_b38221af158e5881\f\EDPCleanup.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.19041.1266_none_92496ac84272f5f1\f\LegacyNetUXHost.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.1_none_8b3ee1f81086d0e3\ReAgentc.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\aspnetca.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_a06b29f6c4bab99e\shrpubw.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_abd26b7610cb738e\f\AddSuggestedFoldersToLibraryDialog.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\f\CustomInstallExec.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1_none_efa641d58a943e71\dmcertinst.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_d9e841974c1d46e8\r\setupugc.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\r\hvsimgr.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_e95531bdadf3df5c\wmpshare.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1_none_595f2a7acaf53bba\WpcUapApp.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\f\gpupdate.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\r\hvsiproxyapp.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.1_none_4b527e92ee1ad1e5\cmd.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_wcf-servicemodelreg_b03f5f7f11d50a3a_10.0.19041.1_none_2d88affdefab54a8\ServiceModelReg.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-secinit_31bf3856ad364e35_10.0.19041.1_none_47fda84da0bc8185\secinit.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_4cb1ff2aa122b5dd\r\tttracer.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\f\SearchIndexer.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_c171e0be75e709de\dsdbutil.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.1_none_37ab35f7e4b21a45\PrintBrmUi.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.19041.153_none_95ba73d08e5f739c\provtool.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.264_none_6ea6dfb6393e5f06\DataStoreCacheDumpTool.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\r\ByteCodeGenerator.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_f15a0c837b51c5fc\gpupdate.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.19041.153_none_7799fc2afae9a500\MDMAppInstaller.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.264_none_a71c9f7fdcd899c5\f\SearchApp.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.264_none_7517ff6e147bc8a9\f\pacjsworker.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.423_none_2cade1bc915dca0d\r\Microsoft.AsyncTextService.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1110_none_4f46693352ed3250\msconfig.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_b2e64138c9682982\InputSwitchToastHandler.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\UevTemplateBaselineGenerator.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\r\phoneactivate.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_7862ecae0548fb54\shrpubw.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\f\cmimageworker.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1266_none_110072d23cfc00d3\UwfServicingShell.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_a4bfcaa32abfcf0e\r\raserver.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - NSIS installer 1 IoCs
resource yara_rule behavioral1/files/0x000c00000002434e-4.dat nsis_installer_2
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4440
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 2.9MB
- SHA256 548c42f9109fb68b80b3a4c95650b2e0030ad8ba20c99b6f219eb852ec1ca548
- MD5 b90b05812e9aa519a330d3640edef342
- SHA1 8c34ff4a00735ba55b7c4db05b742a328048ce38
- SHA512 94ccca106623a8a35ff125f94d94046266a592055125d21ab122e76190c175c602cfe86feb170d5207d3f27fa102dc5230ed7077752f6171de182518b194ced1
- SSDEEP 49152:3vqlmWdG06pYqBpYqypYq0VBXdcZPji0Ajy:3N686r6hdCjoe
- TLSH T118E54A15F6748671D073C1B9C5D2A69AEE7234461B308ACB1386D77C2F277E2893A732
- MD5 SHA1 SHA512 SSDEEP TLSH