Overview

overview

10

Static

static

10

2026-08-09...at.exe

windows10-2004-x64

9

2026-08-09...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 16:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_4d60eee44eb1ae6f16cfcf74f3b82263_elex_glassworm_icedid_luca-stealer_njrat.exe
  • Size 2.5MB
  • Sample260809-vdmd8ssbnd
  • SHA256 9694a14117881c6812023da5555f62ff0f463758976ca61e9f4dfd5e378d4800
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discovery

Malware Config

Signatures

  • Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Detects executables manipulated with Fody 1 IoCs
  • Detects executables using Telegram Chat Bot 1 IoCs
  • Loads dropped DLL 14 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_4d60eee44eb1ae6f16cfcf74f3b82263_elex_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_4d60eee44eb1ae6f16cfcf74f3b82263_elex_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:3352
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3352 -s 1224
      2⤵
      • Program crash
      PID:3808
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3352 -ip 3352
    1⤵
      PID:4840
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:4312

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            aforge.video.directshow.dll
            • Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\aforge.video.directshow.dll
            • Size 71KB
            • SHA256 d789138f067708113636174e74697f7538f2dd49603c46dd3970926519b6c5a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            aforge.video.dll
            • Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\aforge.video.dll
            • Size 20KB
            • SHA256 52616d3438d2c853d69c68dade7bc280a7ffabdc85f1ce4a47166a98343f61b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnetzip.dll
            • Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\dotnetzip.dll
            • Size 468KB
            • SHA256 0e52639dbddef74bc32f25555b193ab336e45e2f856d0424b140048c42b097ad
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sharpdx.direct3d11.dll
            • Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\sharpdx.direct3d11.dll
            • Size 271KB
            • SHA256 d7617d926648849cbfef450b8f48e458ee52e2793fb2251a30094b778aa8848c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sharpdx.direct3d9.dll
            • Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\sharpdx.direct3d9.dll
            • Size 338KB
            • SHA256 02da4af8cd4a8de19d816000caaae885e676b9e52f136ff071a279c2b8ad34c7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sharpdx.dll
            • Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\sharpdx.dll
            • Size 247KB
            • SHA256 061542ff3fb36039b7bbffdf3e07b66176b264c1dfd834a14b09c08620717303
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sharpdx.dxgi.dll
            • Path C:\Users\Admin\AppData\Local\Temp\Costura\AE8DDD6C7BED471C6F37F2DC312D5130\sharpdx.dxgi.dll
            • Size 125KB
            • SHA256 3762d43c83af69cd38c9341a927ca6bd00f6bae8217c874d693047d6df4705bf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/3352-9-0x00000000748A0000-0x000000007505C000-memory.dmp
            Download

            memory/3352-1-0x0000000000F70000-0x00000000011FA000-memory.dmp
            Download

            memory/3352-0-0x00000000748B2000-0x00000000748B3000-memory.dmp
            Download

            memory/3352-39-0x0000000005F30000-0x0000000005FC2000-memory.dmp
            Download

            memory/3352-38-0x00000000063F0000-0x00000000069AA000-memory.dmp
            Download

            memory/3352-40-0x0000000005FD0000-0x0000000006036000-memory.dmp
            Download

            memory/3352-41-0x00000000748A0000-0x000000007505C000-memory.dmp
            Download