881cdb216cd2a2d91865a4a4a96e06d8a2631d88943fbdabcf49cadecaa982ce

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_73ec995f8a2741dd790c76364499bbe3_dcrat_glassworm_icedid_stealc_vidar.exe
Size 11.9MB
Sample260730-stf62sck9s
SHA256 881cdb216cd2a2d91865a4a4a96e06d8a2631d88943fbdabcf49cadecaa982ce
MD5 73ec995f8a2741dd790c76364499bbe3
SHA1 6f2fb978ce7ada3360692d801db7894d81b1bad8
SHA512 118cc8d07fc46f01003272f0881b5837734abeed99e9ac9eff51290197fb469f19384bf7a77d8f05d91507e32eac74e00f7b932b45f940f0abd1bfa82a78dc6a
SSDEEP 98304:2BFE0i5v6Qc2rFyaF6xqoKcFYP307yiAW2UD3NPVr9bA4MvPx:200iwKsr7qP307yHqfAJvPx
TLSH
T138C66A1173F88A2AF5FF1B78A97041258BB6FD52AB22E34D155C65BD2C72B408D603B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5788	2026-07-30_73ec995f8a2741dd790c76364499bbe3_dcrat_glassworm_icedid_stealc_vidar.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5788 wrote to memory of 4444	5788	2026-07-30_73ec995f8a2741dd790c76364499bbe3_dcrat_glassworm_icedid_stealc_vidar.exe	89
PID 5788 wrote to memory of 1544	5788	2026-07-30_73ec995f8a2741dd790c76364499bbe3_dcrat_glassworm_icedid_stealc_vidar.exe	91
PID 5788 wrote to memory of 1252	5788	2026-07-30_73ec995f8a2741dd790c76364499bbe3_dcrat_glassworm_icedid_stealc_vidar.exe	93
PID 5788 wrote to memory of 1232	5788	2026-07-30_73ec995f8a2741dd790c76364499bbe3_dcrat_glassworm_icedid_stealc_vidar.exe	94
PID 5788 wrote to memory of 2012	5788	2026-07-30_73ec995f8a2741dd790c76364499bbe3_dcrat_glassworm_icedid_stealc_vidar.exe	97
PID 5788 wrote to memory of 2484	5788	2026-07-30_73ec995f8a2741dd790c76364499bbe3_dcrat_glassworm_icedid_stealc_vidar.exe	98
PID 5788 wrote to memory of 1228	5788	2026-07-30_73ec995f8a2741dd790c76364499bbe3_dcrat_glassworm_icedid_stealc_vidar.exe	101
PID 5788 wrote to memory of 2088	5788	2026-07-30_73ec995f8a2741dd790c76364499bbe3_dcrat_glassworm_icedid_stealc_vidar.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-30_73ec995f8a2741dd790c76364499bbe3_dcrat_glassworm_icedid_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_73ec995f8a2741dd790c76364499bbe3_dcrat_glassworm_icedid_stealc_vidar.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version
  2⤵
  PID:4444
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe" -version
  2⤵
  PID:1544
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java.exe" -version
  2⤵
  PID:1252
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java.exe" -version
  2⤵
  PID:1232
- C:\Program Files\Java\jdk-1.8\bin\java.exe
  "C:\Program Files\Java\jdk-1.8\bin\java.exe" -version
  2⤵
  PID:2012
- C:\Program Files\Java\jdk-1.8\bin\java.exe
  "C:\Program Files\Java\jdk-1.8\bin\java.exe" -version
  2⤵
  PID:2484
- C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\java.exe" -version
  2⤵
  PID:1228
- C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
  "C:\Program Files\Java\jdk-1.8\jre\bin\java.exe" -version
  2⤵
  PID:2088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 b847f5f2c23cd7276edfe26b1c780e66e19fe8f484beee9fff607cb4d1d43378
MD5 490eebf68fb0031f089963a5fc7aa918
SHA1 e741f2089057a2f7bcdcd1b06e4b8d800e01e224
SHA512 c619ee7ca574b72f16f7756fe62dea88e2d5232208450bebfdef417f5655e825fd7bc37c37c5bd8beb6a4b6e8b0381e8ab5f9d2aecff021ec47b8a3c835b04be
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 d861b8e85d50298b7370f23984d222b9083e3812db503765c116f58e27861058
MD5 3a37a7038daa92699b38611a6cbabfce
SHA1 afd127675f83dcadcda5e106152d2e162e112906
SHA512 70bb69698f581c0e25785b72dc94fc74f922d541f961bfc9668d09e833032ad744bd3e78a5307f5f7205b06e8525752280f3bfe1d256c4ac3987ea577eb98db8
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 93390e7d15d5e525cdb8f5e691fd6cdf08183eab00f9e862daace16696e67663
MD5 32ec9a569ef0d0f6e5cdc529277af225
SHA1 474c990eb7ec682fa558e2432a61605d8b05e037
SHA512 ce1a94faedb5bfc4486021795748ba48e582df93b9a242a1a5438e18f6880102d7096a61ac26269d956fc9f2eada8b00d334b9ff1daba334d68ee9c7c5017eab
MD5 SHA1 SHA512

Submit Download

905ebba3a8fc8cc.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp
Size 50B
SHA256 4c34c1107e0355404a21bfdb6f2cd6329fe6117bd77d95abba2a23e99870f9d6
MD5 694b10f4491d669b6b8f3ebc31e26a93
SHA1 bd604f9fa6d53f5b5e93158996bca6132ab5d0bd
SHA512 26a7d6cfabc97ba25b1036b196b69002e302bdeecf700695f0ffac78a5445a313c5fceffa0202edced96023f48de3644f522cee4aaf5e6fa6fe341358fd31ba9
TLSH
T1F49002689C15E541314511895B016A7503D95444164D041992899787DCA19145515960
MD5 SHA1 SHA512 TLSH

Submit Download

905ebba3a8fc8cc.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp
Size 50B
SHA256 3c2807b73a9dd1660aaf35f5eb958da316484e36054c219be4ff9ea492826ec2
MD5 3ee1ce9c2cf16d8820412906e2ce0ab2
SHA1 9e9d3463916bc390fb55255997b9ed1ddbf9b1f3
SHA512 da943ef407523a0aa02f87a7fe727d9bc32175b64a0a0063926110c169c9416b1c2b4a373372a360b9d07f8ace37a6ea98471b39346128146c7eee040adfd0c3
TLSH
T123900268EC04E681318511855B416A5603C94444164E101992898B87D9A05189515960
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Local\Temp\BHL\settings.json
Size 1KB
SHA256 eb2a5c8de2f638cb4e96768d62522f81b2aae39d696d4041dbee2e3e7c5e04c1
MD5 b55da7bf0cef5e0080c5174c1766b878
SHA1 8b73654dfee9dad25d92ccb68b81f0cba06eb65a
SHA512 7a2b73a89bb2aaf39c31e9ab9dae585143051d60be4fbdbb179e2c967c459642bed38bf04c912e96cfd78696028c9a32fd97c5bc234f239bb32f8be70324ba1e
TLSH
T1D021EB12E206E67F37B9210856B9595350320F8F61303D6FBDBB6C4853AA92B24C7F67
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1228-107-0x000002207DEE0000-0x000002207DEE1000-memory.dmp

Download

memory/1232-46-0x0000021E66EC0000-0x0000021E66EC1000-memory.dmp

Download

memory/1252-55-0x000001FCEC480000-0x000001FCEC481000-memory.dmp

Download

memory/1544-29-0x000001C50DAD0000-0x000001C50DAD1000-memory.dmp

Download

memory/2012-80-0x000001B0F93F0000-0x000001B0F93F1000-memory.dmp

Download

memory/2088-104-0x0000026A42B80000-0x0000026A42B81000-memory.dmp

Download

memory/2484-76-0x000001DD6B080000-0x000001DD6B081000-memory.dmp

Download

memory/4444-6-0x0000020F10F60000-0x0000020F111D0000-memory.dmp

Download

memory/4444-22-0x0000020F10F60000-0x0000020F111D0000-memory.dmp

Download

memory/4444-20-0x0000020F0F6C0000-0x0000020F0F6C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads