Overview

overview

7

Static

static

3

2026-08-31...uk.exe

windows10-2004-x64

7

2026-08-31...uk.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/08/2026, 22:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-31_1ce925ab068a198acb98669ffb3121f6_glassworm_icedid_njrat_ryuk.exe
  • Size 50.7MB
  • Sample260831-2fgp4aae86
  • SHA256 733de722f33ad8818d44cc21e87554036ad6113715a7d1c4cdb15a0adb2af4e6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-31_1ce925ab068a198acb98669ffb3121f6_glassworm_icedid_njrat_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-31_1ce925ab068a198acb98669ffb3121f6_glassworm_icedid_njrat_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4476
    • C:\Users\Admin\AppData\Local\Temp\2026-08-31_1ce925ab068a198acb98669ffb3121f6_glassworm_icedid_njrat_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-31_1ce925ab068a198acb98669ffb3121f6_glassworm_icedid_njrat_ryuk.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:3436

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _Salsa20.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\Crypto\Cipher\_Salsa20.pyd
        • Size 9KB
        • SHA256 641cd85cb60ba8b5cfc305ef72f0620be26775b2079905487d08f7c7c4cd1737
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_cbc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\Crypto\Cipher\_raw_cbc.pyd
        • Size 7KB
        • SHA256 c1618db6bc4b78ca41a1bbeb3daf18170c6cdb2d8b79418223692cdcf47074f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_cfb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\Crypto\Cipher\_raw_cfb.pyd
        • Size 8KB
        • SHA256 793b62f3edbc24ba0e58f39ddaad4d00a846bed044b85d5f8cea4c8a87c84d3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_ctr.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\Crypto\Cipher\_raw_ctr.pyd
        • Size 8KB
        • SHA256 f25526e2fe4c73129184c787ea49b205e5039341e1beff2c855d67f8ccd2a936
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_ecb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\Crypto\Cipher\_raw_ecb.pyd
        • Size 6KB
        • SHA256 074d04c942f4d678502e2c28b9ce5c4115ae2d4257cd893135db2be0cfc030d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_ocb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\Crypto\Cipher\_raw_ocb.pyd
        • Size 9KB
        • SHA256 29b528cbb50b0c3ae24fcce0d5ece37db4ea0249d92edd548c126022e9e3a63e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_ofb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\Crypto\Cipher\_raw_ofb.pyd
        • Size 7KB
        • SHA256 07b836b190d2f6185b859f7be1e5dd712db3b60ea74ca48dcebf95f47c6f8fa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _BLAKE2s.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\Crypto\Hash\_BLAKE2s.pyd
        • Size 9KB
        • SHA256 d719c8452c7e53e423880328c90b5951285c219bf624a2993890eed7af1ca32a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _MD5.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\Crypto\Hash\_MD5.pyd
        • Size 10KB
        • SHA256 456d3d5770eccdb5a18753c7ca70b730179c904e5adf5b88784baa8b3bd07221
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _SHA1.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\Crypto\Hash\_SHA1.pyd
        • Size 13KB
        • SHA256 2c68e98d5648aeddaba58db60bb72070e43e73de491a6a889a1ad440d7f97c00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _SHA256.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\Crypto\Hash\_SHA256.pyd
        • Size 15KB
        • SHA256 986e5ebf328ffa25f8ab8a3f5d9257acc623145a196d8b34d250ab954fae6214
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ghash_clmul.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\Crypto\Hash\_ghash_clmul.pyd
        • Size 8KB
        • SHA256 1dc0d83cee5d1be2beea6a4a0a735096de1e312fd21f7450f59a5011a2ae3612
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ghash_portable.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\Crypto\Hash\_ghash_portable.pyd
        • Size 8KB
        • SHA256 8d3b08ec785fbe01b60431e15b4bdf76e8a56f3d6baed28632742e6910c8b6aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _scrypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\Crypto\Protocol\_scrypt.pyd
        • Size 7KB
        • SHA256 4fff933ffd5ac1e9846d77d74246f395d42e0f5fb04acb5dbac7803d4adaa45f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cpuid_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\Crypto\Util\_cpuid_c.pyd
        • Size 6KB
        • SHA256 d1543efef5c7ab534c38acaf55b09960aefbd31e7d371041cb243815e868c1be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _strxor.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\Crypto\Util\_strxor.pyd
        • Size 6KB
        • SHA256 a4da90d1d1b16630c9fba2d130c52131ed95568d7b126c901abe2225e67b12e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCR100.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\MSVCR100.dll
        • Size 809KB
        • SHA256 1d1a1ae540ba132f998d60d3622f0297b6e86ae399332c3b47462d7c0f560a36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\_bz2.pyd
        • Size 61KB
        • SHA256 a86a89cf3e7e4dbcd1ec879231f043a4f62d00196aa5c8314c484b8bfe53c472
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\_cffi_backend.pyd
        • Size 170KB
        • SHA256 2000e262b6f566a7bf3e3b925e67b1f185dc2ad9da8f4355b77f125c149c6e55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\_ctypes.pyd
        • Size 106KB
        • SHA256 07cd3a390ba1cf1a5d32b72f7d9058dd39e37043652083755f1debcf84089010
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\_hashlib.pyd
        • Size 1.5MB
        • SHA256 643389dcafc777031a87974424568e58bc56a030b6a267ab375eb4a9b5f4bee8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\_lzma.pyd
        • Size 133KB
        • SHA256 e47e5747122542d873a022b69501f011bc8e80af330f54a9e31e04d502606783
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\_socket.pyd
        • Size 51KB
        • SHA256 aa86416277fd46cbfe91a281be11198dde53d6be93728e1d2c3d4a1905c70416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\_tkinter.pyd
        • Size 44KB
        • SHA256 252da7db18b853e03d28785db5ff834d5f551f36c595a9de7d9bb7ea793043fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\base_library.zip
        • Size 747KB
        • SHA256 512094ea3af3d14549bc51dd3ec9086c0bcb2c2404e9ada35565bbe3a293b184
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\pyexpat.pyd
        • Size 164KB
        • SHA256 78c077ad6e7c7febbb0dd021bb1d74f21fce2f77159311d2557c2b3ec355fafa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python34.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\python34.dll
        • Size 3.9MB
        • SHA256 43c8e488bb5f3255c4f861191a3a8f7221b0d808839626b78785de6356014607
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pythoncom34.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\pythoncom34.dll
        • Size 533KB
        • SHA256 56dba534b1f1b2a3a5bb4f6149d6bb1e7f1b2523205c00832310760acf050270
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes34.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\pywintypes34.dll
        • Size 127KB
        • SHA256 a267e547903a0428a6eda37e14481841d2400dc88c60619648698b600e2049fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\tcl86t.dll
        • Size 1.5MB
        • SHA256 4320cac656a9a563840ef8b9a4ff861c960a9bb53baa5861c81df1286e3ccd9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\tcl\encoding\cp1252.enc
        • Size 1KB
        • SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\tk86t.dll
        • Size 1.9MB
        • SHA256 9ea63151dc36f5e0cc05c9df1d7fd4ed28909e7b56044d5de815f3da47aced37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44762\win32api.pyd
        • Size 122KB
        • SHA256 7979ddaa1715567deec4892cda3136d4d4c04053a5ad9dd5521786e74d9054d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3436-1224-0x0000024735B50000-0x0000024735B51000-memory.dmp
        Download