Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 14:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe
- Size 2.4MB
- Sample261002-rl82es1s2k
- SHA256 4ccde0d170ec5ec3e0ee3a124e9934805160c46a2deb29bee8a335f947e526e1
- MD5 57f61085ab811a3b42381da2e1b78df2
- SHA1 517edb625a3f1a7d1976c36b8793c2e941d05687
- SHA512 906d18e6531875bdd961b423f3bb6c35a2624c729031ae603b34a86b3bd0af2218472266b0e74aac5ee36740adb39e46c62cc9fa19ff124f3d64b464f3ff8200
- SSDEEP 24576:uUfXS+xbQouAIfxvnwF2mHSgAhFxeQaTtOhdsQMCkBQcinQifQa6DnZp:hC+x8ouAIfGF24OhmfQ9QhFj
- TLSH T146C5400367FC0518F5F36B789A7A88409A37BC660F38E59F01581D5D0B73A928DB6B72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 6036 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\ime\imetc\imtcprop.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\msra.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\netstat.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\subrange.uce 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\systeminfo.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\bitsadmin.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\findstr.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\ime\imetc\imtclnwz.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\ntprint.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\srdelayed.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\systempropertiesperformance.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\wsmprovhost.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\chkdsk.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\convert.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\ddodiag.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\pickerhost.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\setx.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\wevtutil.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\arp.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\msiexec.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\eventcreate.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\instnm.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\passwordonwakesettingflyout.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\dpnsvr.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\fc.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\hostname.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\netcfgnotifyobjecthost.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\nslookup.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\searchfilterhost.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\clip.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\sndvol.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\spatialaudiolicensesrv.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\xwizard.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\backgroundtaskhost.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\efsui.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\iscsicpl.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\isoburn.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\magnify.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\rasdial.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\tcpsvcs.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\mobsync.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\printui.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\reg.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\tzutil.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\useraccountcontrolsettings.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\wbem\wmiprvse.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\wpdshextautoplay.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\gamepanel.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\calc.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\checknetisolation.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\cscript.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\dvdplay.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\fontview.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\ime\shared\imecfmui.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\launchwinapp.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\devicepairingwizard.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\mavinject.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\msinfo32.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\runonce.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\sdiagnhost.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\setupugc.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\subst.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\wusa.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\SysWOW64\dllhst3g.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\wudfhost.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.26100.1150_none_e9952a81b2d9169d\dmclient.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\hvsisettingsworker.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-ndkperf-setup_31bf3856ad364e35_10.0.26100.1150_none_862cccb1155d1695\r\ndkperfcmd.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.26100.1591_none_86770ed0df6bb53c\refsutil.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_dual_kdnic.inf_31bf3856ad364e35_10.0.26100.1150_none_0d22cb5713b04a04\kdnicctrl.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_installutil_b03f5f7f11d50a3a_10.0.26100.1_none_d80a0abbc02dc6d0\installutil.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.26100.1150_none_37adcb75a8302256\r\windowsactiondialog.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\ie4uinit.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-p..ioningsecureprocess_31bf3856ad364e35_10.0.26100.1150_none_32bd5b6fcfab5b78\psp.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\upgraderesultsui.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.26100.1_none_8c35e9ae895560fc\wkspbroker.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\scriptrunner.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1301_none_970881ba6260e29a\startmenuexperiencehost.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.26100.1150_none_a91ae2d49210b003\r\msspellcheckinghost.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.26100.1591_none_e29fcb0e6345d56d\r\rstrui.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.1591_none_8e19b8855461fe2c\korean.uce 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.26100.1150_none_7710eb15b3cf4c31\extrac32.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-autofstx_31bf3856ad364e35_10.0.26100.1591_none_4acfacd4985a9f74\autofstx.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\microsoft.net\framework\v2.0.50727\aspnet_regiis.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.1591_none_8e19b8855461fe2c\kanji_2.uce 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-o..nframework-pairtool_31bf3856ad364e35_10.0.26100.1150_none_ae401f21d0cb1063\r\pairtool.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_73c54cb65af16a28\rundll32.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.26100.1150_none_f6b51f53ae693de3\r\browsercore.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\microsoft.net\framework\v3.5\csc.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.26100.1150_none_cccbe77f5e2ee6e2\r\aitstatic.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.1591_none_8e19b8855461fe2c\subrange.uce 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\r\lpksetup.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.26100.1591_none_4606dbfb8b0028fd\dashost.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.26100.1591_none_467cce9309f588c5\r\osk.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.26100.1_none_6c3a7829113ddd25\rasphone.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\r\rdpshell.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\microsoft.net\framework\v3.5\addinutil.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.26100.1150_none_63632032763f629f\r\defrag.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\tpmvscmgrsvr.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\xamlviewer\xamlviewer_v0300.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.26100.1591_none_e9f27dc23b0bf8db\r\filehistory.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.26100.1150_none_f10ac0168d72b2cd\r\forfiles.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\wdagnetdiag.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\subst.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-p..ioningsecureprocess_31bf3856ad364e35_10.0.26100.1150_none_32bd5b6fcfab5b78\r\psp.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.26100.1150_none_4d28a605d2d4d62b\eduprintprov.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-securestartup-tool-exe_31bf3856ad364e35_10.0.26100.1_none_f70e66181fe2eced\manage-bde.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.5\addinutil.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v4.0.30319\caspol.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.26100.1591_none_756d2e37dd0406ef\applicationframehost.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\upgraderesultsui.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\microsoft.net\framework\v4.0.30319\csc.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\splwow64.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.26100.1742_none_200d0ee10b67fc30\nvspinfo.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.26100.1742_none_d0e5d15b0fe45285\r\vmwp.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1150_none_abc14f2d153d07e6\rasautou.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\assembly\gac_msil\presentationfontcache\3.0.0.0__31bf3856ad364e35\presentationfontcache.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\assembly\publisherpolicy.tme 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\microsoft.net\framework\v3.0\windows communication foundation\wsatconfig.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.26100.1150_none_5ce3f0df6c2eb9bb\r\verifier.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\r\windeploy.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.26100.1150_none_0f016472f35d0135\r\ieunatt.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\mobsync.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\r\mobsync.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.26100.1591_none_1fa6e4d8d638e827\useroobebroker.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\microsoft.net\framework\netfxsbs10.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\microsoft.net\framework\v3.0\windows communication foundation\smsvchost.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe File opened for modification \??\c:\windows\winsxs\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_71da000f2a392039\r\imccphr.exe 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 5428 1948 WerFault.exe 89 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1948 wrote to memory of 6036 1948 2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe"C:\Windows\2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe"2⤵
- Executes dropped EXE
PID:6036
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 1189722⤵
- Program crash
PID:5428
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1948 -ip 19481⤵PID:6120
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe
- Size 2.4MB
- SHA256 4ccde0d170ec5ec3e0ee3a124e9934805160c46a2deb29bee8a335f947e526e1
- MD5 57f61085ab811a3b42381da2e1b78df2
- SHA1 517edb625a3f1a7d1976c36b8793c2e941d05687
- SHA512 906d18e6531875bdd961b423f3bb6c35a2624c729031ae603b34a86b3bd0af2218472266b0e74aac5ee36740adb39e46c62cc9fa19ff124f3d64b464f3ff8200
- SSDEEP 24576:uUfXS+xbQouAIfxvnwF2mHSgAhFxeQaTtOhdsQMCkBQcinQifQa6DnZp:hC+x8ouAIfGF24OhmfQ9QhFj
- TLSH T146C5400367FC0518F5F36B789A7A88409A37BC660F38E59F01581D5D0B73A928DB6B72
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\2026-10-01_57f61085ab811a3b42381da2e1b78df2_elex_icedid_njrat_nymaim_rhadamanthys_vidar.exe
- Size 2.4MB
- SHA256 513d2fa724c6fce73168d69f7257eaf5a37bbfe237524f44072654961ef4ec06
- MD5 0307c15b6b19f0922cbad4ef5306560a
- SHA1 a45c951887e15cd891871431b8a3eb2725eac854
- SHA512 ed80a9fdcf791631e4ef9c013a93152ba6d20009847e9ecf1ca6ca10ad936aa56279f85ba619d19670f4979ce0c56c412bb9448be3b0cf8b3ab2f6803b67e104
- SSDEEP 24576:RXS+xbQouAIfxvnwF2mHSgAhFxeQaTtOhdsQMCkBQcinQifQa6DnZp:RC+x8ouAIfGF24OhmfQ9QhFj
- TLSH T18FB5400367FC0508F5F36B789A7A88509A37BC660F38E59F01581D5D0B73A928DB6B72
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\msbuild.exe
- Size 128KB
- SHA256 bf3e5c5d83c801200bf693442dddcdb3eb8b278a23d12c444fb82df8a8682066
- MD5 f1a855ac7a7b2e0a04efb254da046125
- SHA1 8e83ded13315f926f485c15584e16ca387ca627c
- SHA512 447040fb58991f54235ca480c5818f9693d59f50e980d0215907235b8c3922edc3ad44d9ff00ecc9f1d53436c46a6a3967da65ad281f2526d32c8ddfa21331ba
- SSDEEP 1536:uixOVfhWKdggaEko0A96ZJwk1oO+huJs4HN0Auo7G+DKSOaPFMVO3GGvv9:uaOddgHEko0zMFCHV1G+DKSOaPFIu9
- TLSH T1C5D36C12BBE84136F5FA49B068784B119A3BF9A32C22D24F78CC76581F72690ED31757
- MD5 SHA1 SHA512 SSDEEP TLSH