Analysis
- max time kernel
149s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 08:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
- Size 27.2MB
- Sample261024-j2dapagx5w
- SHA256 87367e0ff3a686ba59301561c44a21278bf0a44a13514f9e08d7ce8145037b5e
- MD5 775197d081b649e9e7c87241c0f48fa1
- SHA1 bfbfb03c6196da90de387eecd6e92555a58a8c8f
- SHA512 35f3fe0100fdc93cb1d20f91513e2d368fcc8a9615c4d490b80235a81bd94e14a382d26875ca89ba13d19d65fcaf683e5e652ab6e430c7b4c8f809bb5aa9fc9d
- SSDEEP 24576:DxbQlzkvx9HQy5Sk2Ew/r1JVJTt4D7/SAOZi+5v48cKfQs1DetKMT7yVv:DxElovxB92F7VBXdcr0ecMTuR
- TLSH T198576B12B6A4C27AC07385B4C9A6DBAAE9317D511F3099CB53C47B6C2F336C29536336
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\colorcpl.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\curl.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cacls.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\expand.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\diskusage.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Dism.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\more.com 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PING.EXE 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tree.com 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\control.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sc.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\userinit.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\hh.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\clip.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\LogonWebHostProduct.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.26100.1591_none_19642579da3d47f4\r\AgentService.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-choice_31bf3856ad364e35_10.0.26100.1_none_c05a936cf44f86b0\choice.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-expand_31bf3856ad364e35_10.0.26100.1_none_556624dcc06d0b8d\expand.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\oobeldr.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.26100.1150_none_68a5bbed8a1f4ed6\r\uwfmgr.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\ScriptRunner.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_09edd29348b6b707\Magnify.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.26100.1742_none_07d5a4b5643ebc7c\ntoskrnl.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.26100.1591_none_80585f5752dd6955\r\EoAExperiences.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_9a5fa07ba58b88a8\DWWIN.EXE- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_ab188e2525bde8ce\mmc.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.26100.1591_none_b7cec9dc382cb5f1\r\WmsManager.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\TextInputHost.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_10.0.26100.1150_none_26313857ae07f88d\Eap3Host.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.26100.1150_none_78cec33b8cc1ebd0\r\cmdkey.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\r\UpdateNotificationMgr.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.26100.1150_none_d0d1e07b8681fa6b\r\dllhost.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.26100.1150_none_ed4ab399a05c1619\umount.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\MiniSearchHost.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.26100.1591_none_495d0e173be5ed63\r\SpeechRuntime.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.26100.1591_none_5bd9bd7b9da089d6\MuiUnattend.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packageinspector_31bf3856ad364e35_10.0.26100.1_none_6775b02f27bc2b3e\PackageInspector.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\WmiApSrv.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.26100.1150_none_73e2ba5833894ee6\wbemtest.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.26100.1591_none_09563e96d43be8d8\conhost.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.26100.712_none_41fcc82854bc2b0c\r\credwiz.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.26100.1150_none_b5f3ecb264c23d6b\r\mcbuilder.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1150_none_e5966fa8c7a04cf1\win32calc.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_d4511ac951bbf539\powershell_ise.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.26100.1150_none_5952ab67e391cc12\ofdeploy.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\r\lodctr.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\r\spoolsvworker.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\cscript.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.26100.1591_none_99f9c6049c838786\r\TpmTool.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.26100.1742_none_d23b4ab50f085fd0\r\vmms.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\AccountsControlHost.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.26100.1_none_d11ede0471c43ced\help.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_ab188e2525bde8ce\r\mmc.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.26100.1150_none_1ab61fff20240053\r\EASPolicyManagerBrokerHost.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\tpmvscmgr.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\FESearchHost.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.26100.1591_none_9e69ab15e1442616\Utilman.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.26100.1301_none_0b8f997b84f03748\winlogon.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_10.0.26100.1_none_ddaf5dc661e91ea5\aspnet_state.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.26100.1591_none_09563e96d43be8d8\r\conhost.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmdiag.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1591_none_754be8247547f871\esentutl.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.26100.1_none_e3264f8001c7dc21\isoburn.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-k..el-la57-setuphelper_31bf3856ad364e35_10.0.26100.1150_none_6e7a8527eaac2aa2\la57setup.exe- 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_775197d081b649e9e7c87241c0f48fa1_amadey_elex_icedid_luca-stealer_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4228
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 28.2MB
- SHA256 07bd3b60515791907baa5146a179e2ea15305b1fabb19a83c903313a7aee7b29
- MD5 79374aacaa357faa96569b6987085e07
- SHA1 311f1525a89f82292b36905c012612166a9a545b
- SHA512 fe165258df9f77dac60ae49db0fee2accd55cfebaced343679eb63acb5ec60f1e4e636a40f3b110051271fbebed24d83e2d55e0e96b841601e6da9abc86eb6c5
- SSDEEP 49152:DxElovxB92F7VBXdcr0ecMTuq/ezSC6vUzPvMHjyU:yleB6XdRD+ezSC6v2XMHd
- TLSH T147572915B574C236D0B3D1B9C5E6ABAAF9323C411B3089CB5385BB6C2E336D28536736
- MD5 SHA1 SHA512 SSDEEP TLSH