Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/05/2026, 14:08
Behavioral task
behavioral1
Sample
2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe
- Size 2.4MB
- Sample260528-rfva3sat4k
- SHA256 eb717f9f7933471c96dd6508e955a2f977e4a59b9eea984de42ad92225a4feb9
- MD5 2455c4a089cfa147a9def16c46618671
- SHA1 ba27fc1c4e8a48058a798f23d6cead773a7a30ef
- SHA512 46e92bcafba0e7329d9fe62a6162608f4f6638214f388073df9c2a62b69ee3850360ca9adc570d20db8e33acfd686bea9a0ead596b6568b46fbfb2a9b91a8fe7
- SSDEEP 24576:TIs/MMpd2JZtc+SlWdvFuP0E5jcAkSYqyET5jcAkSYqyEs5jcAkSYqyEOJVJTt4d:3vqlmWdG06pYqBpYqypYq0VBXdcd
- TLSH T18FC54A15F6648671D073D1B9C5D2AA9AEE3234450B308ACB1386D77D2F277E2C93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\finger.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\notepad.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\recover.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\write.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\finger.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chcp.com 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\expand.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\logman.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runas.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runas.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\raserver.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskusage.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\expand.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\explorer.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{98BD060E-1D1C-40BF-8DA9-CB787874DFC8}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.22000.100_none_cbf7ec6fc0f80985\f\SndVol.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.22000.100_none_791efb09af53b896\f\AgentService.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.100_none_f82676266a17f522\UevTemplateConfigItemGenerator.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.22000.1_none_f24d5bd1a5bd0380\perfmon.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15806.0_none_7d39f9a025126e55\mscorsvw.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.318_none_569ec118f1c50925\winresume.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.22000.469_none_8c502cfed26c810b\TrustedInstaller.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.22000.194_none_a9ffdf7b2efc21ec\f\wuauclt.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.22000.1_none_720e934c89d2ed1e\newdev.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.22000.434_none_a003f3391feff8a5\repadmin.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compact_31bf3856ad364e35_10.0.22000.1_none_5038d870ba5b9cc5\compact.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_4.0.15806.0_none_d67e07390c494773\InstallUtil.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.22000.1_none_f24d5bd1a5bd0380\resmon.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.22000.1_none_b1116c83034868d0\BrowserCore.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.22000.1_none_4cf58bffc2b62840\MBR2GPT.EXE- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.22000.282_none_66112670800af37c\r\vdsldr.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_10e4c14208d6d2d3\wmpshare.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.22000.1_none_b6f59fcb95517038\srdelayed.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_cc9ed34da60ac9c4\f\Robocopy.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.22000.318_none_f32072a930d121b3\vmcompute.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.469_none_5669b3acf1ecab58\f\winresume.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.22000.434_none_823a5b3dd9c522d8\net1.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15806.256_none_06f17267440e308f\aspnet_wp.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.22000.1_none_872834aeb30e11cf\aitstatic.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.22000.1_none_ef59ac64950e06d9\dfrgui.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\f\wmplayer.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.22000.348_none_a83a13d7c7ca92d4\nfsclnt.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.22000.1_none_b2053c61a39b44e8\slui.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.22000.1_none_03206cd676d7ae6a\grpconv.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.22000.1_none_9454ea72d50a2bf6\bootim.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\WebExperienceHostApp.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.22000.1_none_05f7f490e9af5ded\MicrosoftEdgeDevTools.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.22000.376_none_fbeabbf57111df0a\r\vfpctrl.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-takeown_31bf3856ad364e35_10.0.22000.1_none_5a83adc24ec7ef66\takeown.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.22000.100_none_791efb09af53b896\r\AgentService.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.22000.1_none_e4591039f91b38e2\CompMgmtLauncher.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.22000.1_none_91ac9ca5e0bd52f1\gpresult.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.282_none_04af1ce80d4a389a\f\ie4ushowIE.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.22000.1_none_674facc3fa15e905\RunLegacyCPLElevated.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.22000.258_none_570e91ed5ac8ebe3\r\Microsoft.AAD.BrokerPlugin.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.22000.65_none_f3a35be8937453f0\r\TabTip.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.22000.1_none_09c9ecffc9049dc0\PATHPING.EXE- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.22000.376_none_f2dd928d310396ab\f\vmcompute.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.22000.1_none_fe1f7fc320ca8300\clip.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.22000.120_none_285ae36df9fb90ad\f\OOBENetworkConnectionFlow.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.282_none_d171f6f246e51c59\spoolsv.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_3.5.22000.1_none_ac5cd13c097cdc14\MSBuild.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_ddb5359fa07e69e6\chcp.com- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_4.0.15806.0_none_8ce2f3fe679c53cd\RegSvcs.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.22000.1_none_097d69edf72fd893\mavinject.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.469_none_5669b3acf1ecab58\f\winload.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.22000.1_none_a272a22f02d23291\dcdiag.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.22000.1_none_d7fdc61a4a1da73a\PrintBrm.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.22000.120_none_9c5aa041b6a59db2\f\RMActivate.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.22000.1_none_d9e8af91dd649cea\UserAccountControlSettings.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-shell-oneoffs-em_31bf3856ad364e35_10.0.22000.318_none_ed2b4c25cc173a5f\n\EM.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.22000.194_none_dbc66c84afafb5a2\f\printui.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.22000.318_none_7fdfd2b2e06a7af9\nvspinfo.exe- 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe - NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x000600000000d34a-4.dat nsis_installer_2
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_2455c4a089cfa147a9def16c46618671_amadey_cloudeye_elex_glassworm_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2156
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 2.9MB
- SHA256 548c42f9109fb68b80b3a4c95650b2e0030ad8ba20c99b6f219eb852ec1ca548
- MD5 b90b05812e9aa519a330d3640edef342
- SHA1 8c34ff4a00735ba55b7c4db05b742a328048ce38
- SHA512 94ccca106623a8a35ff125f94d94046266a592055125d21ab122e76190c175c602cfe86feb170d5207d3f27fa102dc5230ed7077752f6171de182518b194ced1
- SSDEEP 49152:3vqlmWdG06pYqBpYqypYq0VBXdcZPji0Ajy:3N686r6hdCjoe
- TLSH T118E54A15F6748671D073C1B9C5D2A69AEE7234461B308ACB1386D77C2F277E2893A732
- MD5 SHA1 SHA512 SSDEEP TLSH