Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 21:26
Behavioral task
behavioral1
Sample
2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
- Size 3.9MB
- Sample260801-1accrahb85
- SHA256 3e2aebde64d7462378040815ebe44dff8bdab30ecdb9a5f4f392d7a948aee955
- MD5 498ab0b41a1df995fca5befd633a6c72
- SHA1 9292282566640f85847ade05d7dda6ae9477f876
- SHA512 85bb79c233fac251a13642616bb6c2dd3316531a7e523707ff72486755c1dd553eb074934900861de32a881e6be70dd89e67e794b7e313529b6f585279472130
- SSDEEP 98304:6sGiIabjKoh9Wis9iJdXN0B7+sBFYO+Adk:I1xdk
- TLSH T1C0160743AA70DC32F02C34F5D89996590D6D7C208AA3BE1276B5BEDDEBF35415B12232
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\convert.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\net.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\choice.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\subst.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\comp.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mode.com- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\regedit.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe -
resource yara_rule behavioral2/memory/2528-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001200000001c450-5.dat upx behavioral2/memory/2528-810-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/2528-2912-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.26100.1_none_f1eb80676c3fbe87\eventvwr.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\unlodctr.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-secinit_31bf3856ad364e35_10.0.26100.1_none_84ab98d8358ad394\secinit.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.26100.1_none_c99b7f92812c4030\iexplore.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mystify_31bf3856ad364e35_10.0.26100.1150_none_8bf8eb890f472d80\r\Mystify.scr- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.26100.1591_none_efe288270f8c9b0b\r\pacjsworker.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\msil_jsc_b03f5f7f11d50a3a_10.0.26100.1_none_4c13a06c8b009cc4\jsc.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.26100.1_none_a2b84bade0a375ce\csc.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.26100.1150_none_0d9d250a9ce416ba\r\ExtExport.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.26100.1150_none_0b01ddf21fe9a3f6\notepad.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\tpmvscmgr.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1591_none_4593139f0a8d3490\r\fontdrvhost.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_457f9751bea691f1\find.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.26100.1591_none_a6992e1af01c7fb5\r\SppExtComObj.Exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1591_none_c68b578eea4bd528\r\wermgr.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1_none_1831c57751bfb3cc\aspnetca.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.26100.1_none_f4516e08d8dbd686\w32tm.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.27000.360_none_ec5dcd352cf057e6\aspnet_regbrowsers.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmproxyd.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.26100.1150_none_a3d1faf3bbc1c7d8\rekeywiz.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\r\wmpshare.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-setuphelper_31bf3856ad364e35_10.0.26100.1150_none_83f057581aec64ac\OOBEFodSetup.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.26100.1150_none_7de38ebb78ccb039\tcmsetup.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.26100.1591_none_965659d18ab48b28\r\SpaceAgent.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.26100.1_none_a9f439dd812975b1\wusa.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\HelpPane.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..microsoftedgebchost_31bf3856ad364e35_10.0.26100.1150_none_faa81bed523ab303\MicrosoftEdgeBCHost.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1150_none_b29361d684a1914e\r\UserAccountBroker.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_jsc_b03f5f7f11d50a3a_4.0.15912.0_none_2e8b40428114406d\jsc.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_161bc21b2130ea78\WerFault.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_620ce84c3dbaadff\fsquirt.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.26100.1150_none_9cab7767030559d4\repadmin.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.26100.1591_none_e9f27dc23b0bf8db\r\FileHistory.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.26100.1150_none_4d28a605d2d4d62b\r\EduPrintProv.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.26100.1_none_2f836f38379760e2\WWAHost.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_netfx-netfxsbs10_exe_31bf3856ad364e35_10.0.26100.1_none_dc63fc515e239427\NETFXSBS10.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_10.0.26100.1_none_8e6ef7811b80d32a\RegSvcs.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.26100.1591_none_f467d2d98b46d418\r\mighost.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.0_none_61c655cc264adc4b\ilasm.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_f7c94c8b5e2407fe\r\explorer.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\splwow64.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.26100.1591_none_97aef1f19d54d967\setupugc.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.26100.1_none_dee795aa2a4dbd74\autochk.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_70d0fee4fcc0ae07\r\sdbinst.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..teelevatedinstaller_31bf3856ad364e35_10.0.26100.1150_none_21762269bb195f5b\WindowsUpdateElevatedInstaller.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.26100.1000_none_6715fee261171762\wevtutil.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_20d2a02f892fa68f\PrintDialog.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.26100.1150_none_20634ae8638b2e34\recdisc.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_10.0.26100.1150_none_6ddb91cebfef2c08\repair-bde.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_fe803a2025222595\EaseOfAccessDialog.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_b74a2f61ab292fb3\WPDShextAutoplay.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe- 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_498ab0b41a1df995fca5befd633a6c72_coinminer_elex_icedid_luca-stealer_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2528
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 4.8MB
- SHA256 3b4f1310f7954345bdfd85f072c86ad4d648fcad4df089a829d193a94c83a49f
- MD5 fda3996ded10b9258c85191024043ed9
- SHA1 46b7c6bd940576e09aced23922744287d029e6a0
- SHA512 fc65a38eee1095e70345c2cfa7b9f709a7cfd2c3da5edf5e5c3d8c2a1d2afebe08b636e8e7ac10ade027ff7e152dd660daf35e7244fc1df13766c13f758e7c5a
- SSDEEP 98304:6sGiIabjKoh9Wis9iJdXN0B7+sBFYO+Ad9ezSC6v2XMHK:I1xd6p
- TLSH T1FE363902BA74CE32F07D70F5C8959659AD293C108B636E9732B5BB9CBBB35914B21331
- MD5 SHA1 SHA512 SSDEEP TLSH