d2ea21a07bc433da07a84fdbf758b67d400e7b22a3a6111067f032489b8a43a0

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_53c01de52b44596b065e2936a64f065e_glassworm_icedid.exe
Size 6.2MB
Sample260807-kex71sam4w
SHA256 d2ea21a07bc433da07a84fdbf758b67d400e7b22a3a6111067f032489b8a43a0
MD5 53c01de52b44596b065e2936a64f065e
SHA1 881a95d7686a1317e56c123a527fa8f34b58b8cc
SHA512 a4a701ee7b6b63bec9b0fb708934b01d02a63c97ad4813be9df9597093f465fa6cb394562925dc3dd11ecee64b691657ed093431e40b6267360a302722b06f69
SSDEEP 98304:RULC6FPYpNONhVPlEgq41c71M3exKWSDcN20kSsrivkD5thYL:2lZ8
TLSH
T1945639902FEC5393DB9B91B381798F45D27ABC96C222E18B35C4678EDD472D0AB27D40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/5412-0-0x0000000140000000-0x000000014062C000-memory.dmp	UPX
behavioral2/memory/5412-9-0x0000000140000000-0x000000014062C000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
4100	Engine.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5412-0-0x0000000140000000-0x000000014062C000-memory.dmp	upx
behavioral2/memory/5412-9-0x0000000140000000-0x000000014062C000-memory.dmp	upx

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{C5D0BB1E-9C8F-427B-BC44-26D47BA38374}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{67501F24-8EA5-4306-BC91-D893ECB372D9}	svchost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4100	Engine.exe
4100	Engine.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4100	Engine.exe
4100	Engine.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4100	Engine.exe
4100	Engine.exe
4676	OpenWith.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5412 wrote to memory of 4100	5412	2026-08-07_53c01de52b44596b065e2936a64f065e_glassworm_icedid.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-07_53c01de52b44596b065e2936a64f065e_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_53c01de52b44596b065e2936a64f065e_glassworm_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5412
- C:\Users\Admin\AppData\Local\Temp\Engine.exe
  "C:\Users\Admin\AppData\Local\Temp\Engine.exe" /force "\\.\pipe\AHKGOCEBMMB"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:4360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Engine.exe

Path C:\Users\Admin\AppData\Local\Temp\Engine.exe
Size 1.3MB
SHA256 effdea83c6b7a1dc2ce9e9d40e91dfd59bed9fcbd580903423648b7ca97d9696
MD5 2d0600fe2b1b3bdc45d833ca32a37fdb
SHA1 e9a7411bfef54050de3b485833556f84cabd6e41
SHA512 9891cd6d2140c3a5c20d5c2d6600f3655df437b99b09ae0f9daf1983190dc73385cc87f02508997bb696ac921eee43fccdf1dc210cc602938807bdb062ce1703
SSDEEP 24576:a3CTQQje6KWjFUsTNEDcN20pah5nQsrivkdhWeWr2O8hYzlj1TNp4j7YoqK:a3CTQQjxKWjFUsTWDcN20k5nQsrivkdq
TLSH
T196559D0633E6C0E8DEB391F6C5299623D772781407389BDB25E0592DDFA3AE05B3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5412-0-0x0000000140000000-0x000000014062C000-memory.dmp

Download

memory/5412-4-0x0000000002F00000-0x0000000003300000-memory.dmp

Download

memory/5412-9-0x0000000140000000-0x000000014062C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads