Analysis
- max time kernel
150s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
29/07/2026, 02:47
General
- Target 2026-07-29_4f09c6b3b1372af4670a6b040c0ae483_amadey_glassworm_icedid_vidar.exe
- Size 17.0MB
- Sample260729-c94z2sfm21
- SHA256 b74f1ea44466fce60a53a3ae7d9b04aa12c2fe2631baf2f803076804dde43a07
Malware Config
Signatures
- Detects executables Discord URL observed in first stage droppers 1 IoCs
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
- Detects executables manipulated with Fody 1 IoCs
- Detects executables packed with Babel 2 IoCs
- Detects executables packed with Dotfuscator 2 IoCs
- Detects executables packed with Goliath 2 IoCs
- Detects executables packed with SmartAssembly 2 IoCs
- Detects executables packed with Yano Obfuscator 2 IoCs
- Detects executables packed with dotNetProtector 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Costura .NET executable packer 1 IoCs
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_4f09c6b3b1372af4670a6b040c0ae483_amadey_glassworm_icedid_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_4f09c6b3b1372af4670a6b040c0ae483_amadey_glassworm_icedid_vidar.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
N712C1D7NCNE445AFN8A24NBN94FAFE2.dll
0x7RT.dll
memory/4636-15-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/4636-16-0x00000258D9CF0000-0x00000258DAB80000-memory.dmp
memory/4636-1-0x00000258BE400000-0x00000258BF4FC000-memory.dmp
memory/4636-13-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/4636-2-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/4636-14-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/4636-0-0x00007FFC2A97F000-0x00007FFC2A980000-memory.dmp
memory/4636-3-0x00000258BF9C0000-0x00000258BFA00000-memory.dmp
memory/4636-17-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/4636-18-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/4636-19-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/4636-20-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp
memory/4636-21-0x00000258C1460000-0x00000258C1514000-memory.dmp
memory/4636-22-0x00000258DACC0000-0x00000258DACE2000-memory.dmp
memory/4636-23-0x00007FFC2A7F0000-0x00007FFC2B194000-memory.dmp