Overview

overview

10

Static

static

10

2026-08-09...at.exe

windows10-2004-x64

9

2026-08-09...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 16:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_4d60eee44eb1ae6f16cfcf74f3b82263_elex_glassworm_icedid_luca-stealer_njrat.exe
  • Size 2.5MB
  • Sample260809-vdmd8ssbnd
  • SHA256 9694a14117881c6812023da5555f62ff0f463758976ca61e9f4dfd5e378d4800
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discovery

Malware Config

Signatures

  • Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Detects executables manipulated with Fody 1 IoCs
  • Detects executables using Telegram Chat Bot 1 IoCs
  • Loads dropped DLL 14 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_4d60eee44eb1ae6f16cfcf74f3b82263_elex_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_4d60eee44eb1ae6f16cfcf74f3b82263_elex_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:5484
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5484 -s 1168
      2⤵
      • Program crash
      PID:3364
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5484 -ip 5484
    1⤵
      PID:5032

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          aforge.video.directshow.dll
          • Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\aforge.video.directshow.dll
          • Size 71KB
          • SHA256 d789138f067708113636174e74697f7538f2dd49603c46dd3970926519b6c5a8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          aforge.video.dll
          • Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\aforge.video.dll
          • Size 20KB
          • SHA256 52616d3438d2c853d69c68dade7bc280a7ffabdc85f1ce4a47166a98343f61b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dotnetzip.dll
          • Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\dotnetzip.dll
          • Size 468KB
          • SHA256 0e52639dbddef74bc32f25555b193ab336e45e2f856d0424b140048c42b097ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sharpdx.direct3d11.dll
          • Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\sharpdx.direct3d11.dll
          • Size 271KB
          • SHA256 d7617d926648849cbfef450b8f48e458ee52e2793fb2251a30094b778aa8848c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sharpdx.direct3d9.dll
          • Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\sharpdx.direct3d9.dll
          • Size 338KB
          • SHA256 02da4af8cd4a8de19d816000caaae885e676b9e52f136ff071a279c2b8ad34c7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sharpdx.dll
          • Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\sharpdx.dll
          • Size 247KB
          • SHA256 061542ff3fb36039b7bbffdf3e07b66176b264c1dfd834a14b09c08620717303
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sharpdx.dxgi.dll
          • Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\sharpdx.dxgi.dll
          • Size 125KB
          • SHA256 3762d43c83af69cd38c9341a927ca6bd00f6bae8217c874d693047d6df4705bf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/5484-0-0x00000000004F0000-0x000000000077A000-memory.dmp
          Download

          memory/5484-1-0x0000000001060000-0x0000000001070000-memory.dmp
          Download

          memory/5484-37-0x00000000056E0000-0x0000000005C84000-memory.dmp
          Download

          memory/5484-38-0x0000000005240000-0x00000000052D2000-memory.dmp
          Download

          memory/5484-39-0x00000000052E0000-0x0000000005346000-memory.dmp
          Download