Overview

overview

10

Static

static

10

2026-05-23...at.exe

windows10-2004-x64

9

2026-05-23...at.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    23/05/2026, 04:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-23_fb1fccdfd54d887156ec3584509e6419_glassworm_hijackloader_icedid_krakenkeylogger_njrat_poet-rat.exe
  • Size 74.6MB
  • Sample260523-e1q3yacy9j
  • SHA256 558a9aa5efed3aed89aac7af6c11cfaafad371764d50f426bc3cf41935633f6e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10

Malware Config

Signatures

  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Detects executables referencing virtualization MAC addresses 1 IoCs
  • Loads dropped DLL 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-23_fb1fccdfd54d887156ec3584509e6419_glassworm_hijackloader_icedid_krakenkeylogger_njrat_poet-rat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-23_fb1fccdfd54d887156ec3584509e6419_glassworm_hijackloader_icedid_krakenkeylogger_njrat_poet-rat.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5048

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Equicorde.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-05-23_fb1fccdfd54d887156ec3584509e6419_glassworm_hijackloader_icedid_krakenkeylogger_njrat_poet-rat\a04XVKo6NfJ8\Equicorde.dll
        • Size 137KB
        • SHA256 aa4c7b50d2861ac2465a6bfbad8790d7843959adb52ee0c10123bb23a711c931
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Win32.Registry.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-05-23_fb1fccdfd54d887156ec3584509e6419_glassworm_hijackloader_icedid_krakenkeylogger_njrat_poet-rat\a04XVKo6NfJ8\Microsoft.Win32.Registry.dll
        • Size 114KB
        • SHA256 4a5ad5d9875a2fd3e47f3204e95facaffe9d09bc638e1e52768e7512434ccf42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-05-23_fb1fccdfd54d887156ec3584509e6419_glassworm_hijackloader_icedid_krakenkeylogger_njrat_poet-rat\a04XVKo6NfJ8\System.Collections.dll
        • Size 290KB
        • SHA256 a57462b3c32583e56af7c1702e9a280084a33a3354f3658fbcce5173a17b235c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-05-23_fb1fccdfd54d887156ec3584509e6419_glassworm_hijackloader_icedid_krakenkeylogger_njrat_poet-rat\a04XVKo6NfJ8\System.ComponentModel.Primitives.dll
        • Size 78KB
        • SHA256 6cd3ca7994c8bee36c7423c0f3292ff83a3c665ee3d40f520cefe1b41da73172
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.Process.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-05-23_fb1fccdfd54d887156ec3584509e6419_glassworm_hijackloader_icedid_krakenkeylogger_njrat_poet-rat\a04XVKo6NfJ8\System.Diagnostics.Process.dll
        • Size 322KB
        • SHA256 a317e37efc1506ab3434ab8d1ecdb5616e7e0978456429240246c07ebb60e279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Memory.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-05-23_fb1fccdfd54d887156ec3584509e6419_glassworm_hijackloader_icedid_krakenkeylogger_njrat_poet-rat\a04XVKo6NfJ8\System.Memory.dll
        • Size 158KB
        • SHA256 e6111b18cedbb219f96774e13c7ef62143979814473ba1512b915e625b9ae49c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.CoreLib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-05-23_fb1fccdfd54d887156ec3584509e6419_glassworm_hijackloader_icedid_krakenkeylogger_njrat_poet-rat\a04XVKo6NfJ8\System.Private.CoreLib.dll
        • Size 15.3MB
        • SHA256 ede47f0d881557d10cb1d91adc27bcd60f8507cf61e63baec0e4ff0e6e04c0ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.InteropServices.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-05-23_fb1fccdfd54d887156ec3584509e6419_glassworm_hijackloader_icedid_krakenkeylogger_njrat_poet-rat\a04XVKo6NfJ8\System.Runtime.InteropServices.dll
        • Size 110KB
        • SHA256 2fcc6bfb33b5035bcd44c9e78364fd6564bea13450ba460507ca2c8b5d535f67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Text.Encoding.CodePages.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-05-23_fb1fccdfd54d887156ec3584509e6419_glassworm_hijackloader_icedid_krakenkeylogger_njrat_poet-rat\a04XVKo6NfJ8\System.Text.Encoding.CodePages.dll
        • Size 842KB
        • SHA256 b4c157f43aa1d6974f704b723dd0e59358a60fb909801a1dd3b16a1c80adb801
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\2026-05-23_fb1fccdfd54d887156ec3584509e6419_glassworm_hijackloader_icedid_krakenkeylogger_njrat_poet-rat\a04XVKo6NfJ8\System.Threading.dll
        • Size 82KB
        • SHA256 d0ee84626b381f25eded96d5a8a249d18f6e7b7644261a6dcf59d1853508633b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download