Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 01:06
General
- Target 2026-07-18_506cbf8e9c5acc9be4299e69c86d7756_glassworm_icedid_njrat_vidar.exe
- Size 13.2MB
- Sample260718-bf4lrabt5q
- SHA256 527a0b88fe2b8bba4e06e25df95a86765cff33d9dab4d0c7670acb1eada5ac5d
Score
10/10
Malware Config
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Loads dropped DLL 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_506cbf8e9c5acc9be4299e69c86d7756_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_506cbf8e9c5acc9be4299e69c86d7756_glassworm_icedid_njrat_vidar.exe"1⤵
- Modifies firewall policy service
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exe"netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
UIDBypassDll.dll
cimgui.dll
memory/4864-4-0x0000025000300000-0x0000025000310000-memory.dmp
memory/4864-10-0x0000025002BE0000-0x0000025002E7E000-memory.dmp
memory/4864-28-0x0000025002BE0000-0x0000025002E7E000-memory.dmp