Analysis
- max time kernel
149s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
14/07/2026, 22:41
General
- Target 2026-07-14_15ccc08cbd3f8888254f36df9e78bcc4_glassworm_icedid_njrat_vidar.exe
- Size 13.2MB
- Sample260714-2mfrdahs3y
- SHA256 cc852989e19cf88fab9440f50b7ebcf1727196aa6fa7c8ed42c3a4fcdf3ebe34
Score
10/10
Malware Config
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Loads dropped DLL 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_15ccc08cbd3f8888254f36df9e78bcc4_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_15ccc08cbd3f8888254f36df9e78bcc4_glassworm_icedid_njrat_vidar.exe"1⤵
- Modifies firewall policy service
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exe"netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c title KeyAuth Error && color 0C && echo Error: Application not found && echo. && echo Press any key to exit... && pause > nul2⤵
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
UIDBypassDll.dll
cimgui.dll
memory/2408-4-0x0000022180300000-0x0000022180310000-memory.dmp
memory/2408-18-0x0000022186EE0000-0x0000022187F12000-memory.dmp