Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 09:26
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-14_ea2a5ae16120bda1fe07cab5f4940690_glassworm_icedid_njrat_ryuk.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_ea2a5ae16120bda1fe07cab5f4940690_glassworm_icedid_njrat_ryuk.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-08-14_ea2a5ae16120bda1fe07cab5f4940690_glassworm_icedid_njrat_ryuk.exe
- Size 4.7MB
- Sample260814-ld9p4azfpc
- SHA256 6425e502762b5cbb690607313d0e17cc59907b00848ece01625f1ad5e4fab932
- MD5 ea2a5ae16120bda1fe07cab5f4940690
- SHA1 0e4977880d87044b72b57dc26df0f0d96f601905
- SHA512 b7abea0ab10544a8e15ed2103f1a97fcdb5b444cd0e626fa30c8cfe7d2af6ad5dfd71ec674a66017106c46ea94a04b03419da33ee26792d7461a73ba529ac668
- SSDEEP 49152:rjN9OHIDpF11E+DZgS/+prlnOLDEde6GLvI4ewoVrchbQCZxPlvTjBkO7DEeA34h:Zb/I4Q4NvTtJ81ME5RUT9
- TLSH T157366B53F3B611F8C01EC9B54B1E5522A9647C464734A3EF0AE877221A76ED86F3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp\yandex_browser_service_update.log 2026-08-14_ea2a5ae16120bda1fe07cab5f4940690_glassworm_icedid_njrat_ryuk.exe File opened for modification C:\Windows\SystemTemp\yandex_browser_service_update.log 2026-08-14_ea2a5ae16120bda1fe07cab5f4940690_glassworm_icedid_njrat_ryuk.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2620 wrote to memory of 1976 2620 2026-08-14_ea2a5ae16120bda1fe07cab5f4940690_glassworm_icedid_njrat_ryuk.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_ea2a5ae16120bda1fe07cab5f4940690_glassworm_icedid_njrat_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_ea2a5ae16120bda1fe07cab5f4940690_glassworm_icedid_njrat_ryuk.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\2026-08-14_ea2a5ae16120bda1fe07cab5f4940690_glassworm_icedid_njrat_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_ea2a5ae16120bda1fe07cab5f4940690_glassworm_icedid_njrat_ryuk.exe" --statistics=https://api.browser.yandex.ru/installstats/send/dtype=stred/pid=457/cid=72992/path=extended_stat/vars=-action=service_unused,-brand_id=unknown,-error=UNKNOWN_COMMAND,-installer_type=service,-launched=false,-old_style=1,-old_ver=,-result=0,-stage=error,-ui=B4C9B915_F7C5_48B1_94D3_D16DDE27D6E6/*2⤵
- Drops file in Windows directory
PID:1976
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SystemTemp\yandex_browser_service_update.log
- Size 2KB
- SHA256 bdf86b890b91be159207d3dc14298a1121d55d566ca734f89e90ee9cfbe4b533
- MD5 b9b375e9ee7de2169e13c9c7df5c67dc
- SHA1 aa1a3ce030868b6a70bcb97a5b74ddf0aead0761
- SHA512 9bddfe572082a6f2e92c218d2321d28d96a4a5a94a83d69adbd187e09563cc1567e67f4075452a3a514215e981badff4fa5a8867f2e7e8afcd7f9b78e805a720
- TLSH T10B51DF5489E429762F2D82EBDAE71B630D50B0969D1C02B07EEF94CD1D934972DAE02D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\yandex_browser_service_update.log
- Size 3KB
- SHA256 f2d71b41cca829f5dcad307744e2709b29d79e2ffdc917010abf48335ae9b77a
- MD5 7eb8a59601452ab58b550e2476fa92ce
- SHA1 ae3fc8e1a200d2edbdb56c0c4b0c30915a57ebcc
- SHA512 310259d73d0b99109a68863b6206c4361f2520c2e018df5cac175b2f54ee0ac2676294b6f803a609e4ce2d610c8d8d1d2b64c7947a68cdcce645939bbc2cbb66
- TLSH T14271FF2489E0297A2E2D42FB9EE61B630E50B0569D1C02B07AEF94DD1DD34962DAE02D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\yandex_browser_service_update.log
- Size 5KB
- SHA256 a2f04c4d206220e2cf0290c5af326ccb82a6e2eeea0ecf8e206fb92585c1e568
- MD5 3aa96c2cac9d4d1df04dc14bb0347038
- SHA1 a7c93dd444a2abe1cc9f7007f9c2051cb38e5e5d
- SHA512 30aea6457ad0f817e4b40bdbaa94703b62f3ddfdd4bb4e1697584f425caaf4840c44c0a41a901db8eb9e4ffd779ab2f341ba23161e8135b888e7c7fee7a7f297
- SSDEEP 96:KvHvZHlRQB5Bw90dQ22r8RIsVeL+0/por8+0/poqHuZHyOzL+0/povcoL+0/povF:bHa5BcgmiyPuPs
- TLSH T1D0B166248AD029BA6F1D42FB9EF72B630950B0569D1842B079EF94CD1DD38872DAE02C
- MD5 SHA1 SHA512 SSDEEP TLSH