Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 04:36
General
- Target 2026-08-12_5c9246b3def74e832db064ff80b5e291_glassworm_icedid_njrat_vidar.exe
- Size 39.2MB
- Sample260812-e79tmaae45
- SHA256 011fa0f7b869f68441b935997374de40b5e6d89349a185ba5f519588f51a86f2
Score
9/10
Malware Config
Signatures
- Detects executables Discord URL observed in first stage droppers 2 IoCs
- Detects executables packed with VMProtect. 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_5c9246b3def74e832db064ff80b5e291_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_5c9246b3def74e832db064ff80b5e291_glassworm_icedid_njrat_vidar.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
cimgui.dll
memory/4304-0-0x00007FF78D954000-0x00007FF78DF4A000-memory.dmp
memory/4304-1-0x00007FFD04F50000-0x00007FFD04F52000-memory.dmp
memory/4304-2-0x00007FF78B170000-0x00007FF78EFBC000-memory.dmp
memory/4304-12-0x00000197EE9F0000-0x00000197EEA00000-memory.dmp
memory/4304-14-0x00000197F0970000-0x00000197F0C0E000-memory.dmp
memory/4304-15-0x00007FF78B170000-0x00007FF78EFBC000-memory.dmp