Analysis
- max time kernel
148s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 00:22
Behavioral task
behavioral1
Sample
2026-07-06_e49f229e4c3f6cc0630d21ad3d3878b7_amadey_elex_glassworm_icedid_vidar.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_e49f229e4c3f6cc0630d21ad3d3878b7_amadey_elex_glassworm_icedid_vidar.exe
Resource
win11ltsc2024-20260706-en
3 signatures
150 seconds
General
- Target 2026-07-06_e49f229e4c3f6cc0630d21ad3d3878b7_amadey_elex_glassworm_icedid_vidar.exe
- Size 4.3MB
- Sample260707-anx89set3s
- SHA256 a3e70c7bd76bbdbbd0bdedf2cf3885358b576b7ba6696761be943c2a67b0776a
- MD5 e49f229e4c3f6cc0630d21ad3d3878b7
- SHA1 7eaa1280c5d886a0a7d73973f876f2c964e1dff7
- SHA512 9cb59c5c5b84a83b845b64a45a8e46ca6b5edfaa161e507d24503161d7155bc05cd659feeb979ab3009d290cb4e0b970bfa3cd5709baf3cfbca7c940cd654afc
- SSDEEP 98304:MtHVekzplXbCxhxQwrTGiBYOsH+zG07hhzl:MtHVe8plLCxhx9Gi8Ve
- TLSH T18426E0603771C0EEC06BEB374445C515BD78AD02AB62C29D9F30B0C2DE732993F5A99A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables Discord URL observed in first stage droppers 1 IoCs
resource yara_rule behavioral2/memory/4056-1-0x0000000000200000-0x000000000064E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_DiscordURL - Detects executables manipulated with Fody 1 IoCs
resource yara_rule behavioral2/memory/4056-1-0x0000000000200000-0x000000000064E000-memory.dmp INDICATOR_EXE_Packed_Fody - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_e49f229e4c3f6cc0630d21ad3d3878b7_amadey_elex_glassworm_icedid_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_e49f229e4c3f6cc0630d21ad3d3878b7_amadey_elex_glassworm_icedid_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_e49f229e4c3f6cc0630d21ad3d3878b7_amadey_elex_glassworm_icedid_vidar.exe"1⤵
- System Location Discovery: System Language Discovery
PID:4056