Analysis
- max time kernel
150s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/08/2026, 11:14
General
- Target 2026-08-01_18f6d4aacb0100630690e381441da686_glassworm_icedid_njrat_vidar.exe
- Size 39.2MB
- Sample260801-nb2mtahh22
- SHA256 e98927e701d4f185cbf0462149a34137ed46be0abdb2f09c10b727d22bca2b2f
Score
9/10
Malware Config
Signatures
- Detects executables Discord URL observed in first stage droppers 2 IoCs
- Detects executables packed with VMProtect. 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_18f6d4aacb0100630690e381441da686_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_18f6d4aacb0100630690e381441da686_glassworm_icedid_njrat_vidar.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
cimgui.dll
memory/1344-0-0x00007FF7BF453000-0x00007FF7BFA46000-memory.dmp
memory/1344-1-0x00007FFBED990000-0x00007FFBED992000-memory.dmp
memory/1344-7-0x00007FF7BCC70000-0x00007FF7C0AB4000-memory.dmp
memory/1344-13-0x0000019A71CD0000-0x0000019A71CE0000-memory.dmp
memory/1344-15-0x00007FF7BF453000-0x00007FF7BFA46000-memory.dmp
memory/1344-16-0x00007FF7BCC70000-0x00007FF7C0AB4000-memory.dmp