Analysis
- max time kernel
150s - max time network
85s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/08/2026, 04:08
General
- Target 2026-08-15_3f7471ea48d9ad106b1def1a3e7f4f9d_glassworm_icedid_njrat_ryuk.exe
- Size 88.4MB
- Sample260815-eqpr5aydne
- SHA256 d24adc67bff88a53fc8249ab2df8418b83c21fc8f8e8ed24df77ec6bf9b7266b
Malware Config
Signatures
- Loads dropped DLL 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_3f7471ea48d9ad106b1def1a3e7f4f9d_glassworm_icedid_njrat_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_3f7471ea48d9ad106b1def1a3e7f4f9d_glassworm_icedid_njrat_ryuk.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_3f7471ea48d9ad106b1def1a3e7f4f9d_glassworm_icedid_njrat_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_3f7471ea48d9ad106b1def1a3e7f4f9d_glassworm_icedid_njrat_ryuk.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
_raw_cbc.pyd
_raw_cfb.pyd
_raw_ctr.pyd
_raw_ecb.pyd
_raw_ofb.pyd
_BLAKE2s.pyd
_strxor.pyd
MSVCR100.dll
_bz2.pyd
_cffi_backend.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_tkinter.pyd
base_library.zip
cv2.pyd
_multiarray_tests.pyd
_multiarray_umath.pyd
fftpack_lite.pyd
_umath_linalg.pyd
lapack_lite.pyd
mtrand.pyd
p34ctftools74.exe.manifest
pyexpat.pyd
python34.dll
pythoncom34.dll
Conakry
Djibouti
Kigali
Lagos
Curacao
Toronto
Greenwich
London
Oslo
Skopje
PRC
Wallis
Yap
UCT
pywintypes34.dll
binwalk
tcl86t.dll
cp1252.enc
tk86t.dll
win32api.pyd
memory/1636-2364-0x000000005B890000-0x000000005B8A5000-memory.dmp
memory/1636-2466-0x000000005B740000-0x000000005B782000-memory.dmp
memory/1636-2381-0x000000005B900000-0x000000005B9E0000-memory.dmp
memory/1636-2378-0x000000005B9E0000-0x000000005BDE6000-memory.dmp
memory/1636-2379-0x000000005B790000-0x000000005B82F000-memory.dmp
memory/1636-2375-0x000000005B830000-0x000000005B85B000-memory.dmp
memory/1636-2373-0x000000005B860000-0x000000005B887000-memory.dmp
memory/1636-2407-0x00000223636A0000-0x000002236916E000-memory.dmp
memory/1636-2369-0x00007FFAAE840000-0x00007FFAAE870000-memory.dmp
memory/1636-2367-0x00007FFAAE870000-0x00007FFAAE899000-memory.dmp
memory/1636-2359-0x00007FFAACB50000-0x00007FFAACCDA000-memory.dmp
memory/1636-2353-0x000000005B8D0000-0x000000005B8F3000-memory.dmp
memory/1636-2357-0x000000005B8B0000-0x000000005B8C7000-memory.dmp
memory/1636-2349-0x000000005B900000-0x000000005B9E0000-memory.dmp
memory/1636-2347-0x000000005B9E0000-0x000000005BDE6000-memory.dmp
memory/1636-2423-0x00007FFAACB50000-0x00007FFAACCDA000-memory.dmp
memory/1636-2424-0x000000005B890000-0x000000005B8A5000-memory.dmp
memory/1636-2443-0x000000005B740000-0x000000005B782000-memory.dmp
memory/1636-2446-0x00007FFAAA420000-0x00007FFAAA433000-memory.dmp
memory/1636-2447-0x000000005B540000-0x000000005B739000-memory.dmp
memory/1636-2448-0x000000005B3A0000-0x000000005B536000-memory.dmp
memory/1636-2442-0x00007FFA8F9D0000-0x00007FFA8FC0F000-memory.dmp
memory/1636-2439-0x00007FFA8FE40000-0x00007FFA900BB000-memory.dmp
memory/1636-2441-0x00007FFA8FC10000-0x00007FFA8FE32000-memory.dmp
memory/1636-2427-0x000000005B9E0000-0x000000005BDE6000-memory.dmp
memory/1636-2445-0x00007FFA99340000-0x00007FFA993E5000-memory.dmp
memory/1636-2444-0x00007FFAAE7D0000-0x00007FFAAE7E8000-memory.dmp
memory/1636-2440-0x00007FFAAE7F0000-0x00007FFAAE812000-memory.dmp
memory/1636-2436-0x000000005B830000-0x000000005B85B000-memory.dmp
memory/1636-2435-0x000000005B860000-0x000000005B887000-memory.dmp
memory/1636-2429-0x000000005B8D0000-0x000000005B8F3000-memory.dmp
memory/1636-2428-0x000000005B900000-0x000000005B9E0000-memory.dmp
memory/1636-2438-0x00000223636A0000-0x000002236916E000-memory.dmp
memory/1636-2384-0x000000005B8D0000-0x000000005B8F3000-memory.dmp
memory/1636-2462-0x00007FFA8FE40000-0x00007FFA900BB000-memory.dmp
memory/1636-2470-0x000000005B540000-0x000000005B739000-memory.dmp
memory/1636-2471-0x000000005B3A0000-0x000000005B536000-memory.dmp
memory/1636-2450-0x000000005B9E0000-0x000000005BDE6000-memory.dmp
memory/1636-2456-0x00007FFAAE870000-0x00007FFAAE899000-memory.dmp
memory/1636-2453-0x000000005B8B0000-0x000000005B8C7000-memory.dmp
memory/1636-2452-0x000000005B8D0000-0x000000005B8F3000-memory.dmp
memory/1636-2451-0x000000005B900000-0x000000005B9E0000-memory.dmp
memory/1636-2473-0x000000005B900000-0x000000005B9E0000-memory.dmp
memory/1636-2492-0x000000005B540000-0x000000005B739000-memory.dmp
memory/1636-2493-0x000000005B3A0000-0x000000005B536000-memory.dmp
memory/1636-2483-0x00000223636A0000-0x000002236916E000-memory.dmp
memory/1636-2515-0x000000005B3A0000-0x000000005B536000-memory.dmp
memory/1636-2514-0x000000005B540000-0x000000005B739000-memory.dmp
memory/1636-2537-0x000000005B3A0000-0x000000005B536000-memory.dmp
memory/1636-2536-0x000000005B540000-0x000000005B739000-memory.dmp
memory/1636-2559-0x000000005B3A0000-0x000000005B536000-memory.dmp
memory/1636-2558-0x000000005B540000-0x000000005B739000-memory.dmp
memory/1636-2581-0x000000005B3A0000-0x000000005B536000-memory.dmp
memory/1636-2580-0x000000005B540000-0x000000005B739000-memory.dmp
memory/1636-2604-0x000000005B3A0000-0x000000005B536000-memory.dmp
memory/1636-2603-0x000000005B540000-0x000000005B739000-memory.dmp
memory/1636-2625-0x000000005B540000-0x000000005B739000-memory.dmp
memory/1636-2626-0x000000005B3A0000-0x000000005B536000-memory.dmp
memory/1636-2648-0x000000005B3A0000-0x000000005B536000-memory.dmp
memory/1636-2670-0x000000005B3A0000-0x000000005B536000-memory.dmp
memory/1636-2669-0x000000005B540000-0x000000005B739000-memory.dmp
memory/1636-2692-0x000000005B3A0000-0x000000005B536000-memory.dmp
memory/1636-2691-0x000000005B540000-0x000000005B739000-memory.dmp
memory/1636-2714-0x000000005B3A0000-0x000000005B536000-memory.dmp
memory/1636-2716-0x000000005B900000-0x000000005B9E0000-memory.dmp
memory/1636-2736-0x000000005B3A0000-0x000000005B536000-memory.dmp
memory/1636-2735-0x000000005B540000-0x000000005B739000-memory.dmp
memory/1636-2726-0x00000223636A0000-0x000002236916E000-memory.dmp