darksiderat | d33829615820c3087338a48a8f4d10875a9bd024e279a4ff9519cbd1b7891e0f

Analysis

max time kernel
150s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 14.6MB
Sample260905-nl78catclf
SHA256 d33829615820c3087338a48a8f4d10875a9bd024e279a4ff9519cbd1b7891e0f
MD5 4c8f75599fce103a1b7a1f4e2e79a7fd
SHA1 041dc64ccfedb366f54142099ee2a62201f12121
SHA512 87b4327088c557fafdbd7586c16b5d12422fd7bb6c6113d38d0c3cc82297d95e4c458127949771d7d3c52c8317df4386f0ce3042d89f78448741de39ec33ec1a
SSDEEP 98304:VUWc6ndSKCm7GHOp09KXTqU6Zb9JxpWsLsZBbChgHohog/pzjyUnu:VUW/RCjH00UXTv6VnLsPChgISYz
TLSH
T1EDF6AD62ABAD469DE06EB038C5875217E7F17C0C0360DFDB55D08D675E3BAD0BA3A218
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

darksiderat trojan

Malware Config

Signatures

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 16 IoCs

resource	yara_rule
behavioral2/memory/2604-63-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1232-61-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2164-60-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3068-58-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4464-56-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4364-55-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2868-52-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/5516-57-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1712-51-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/5420-49-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2020-45-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/4188-42-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/3280-29-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/1228-25-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2528-20-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2868-7-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Loads dropped DLL 1 IoCs

pid	Process
264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of SetThreadContext 30 IoCs

description	pid	Process	procid_target
PID 264 set thread context of 808	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	89
PID 264 set thread context of 2868	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	90
PID 264 set thread context of 932	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	91
PID 264 set thread context of 3804	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	93
PID 264 set thread context of 4364	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	94
PID 264 set thread context of 5516	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	92
PID 264 set thread context of 4488	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	95
PID 264 set thread context of 4464	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	96
PID 264 set thread context of 2976	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	97
PID 264 set thread context of 2840	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	98
PID 264 set thread context of 2528	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	99
PID 264 set thread context of 1016	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	100
PID 264 set thread context of 1228	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	101
PID 264 set thread context of 1848	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	102
PID 264 set thread context of 3280	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	103
PID 264 set thread context of 3068	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	104
PID 264 set thread context of 2000	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	105
PID 264 set thread context of 2472	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	107
PID 264 set thread context of 716	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	106
PID 264 set thread context of 2164	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	108
PID 264 set thread context of 1232	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	109
PID 264 set thread context of 4516	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	112
PID 264 set thread context of 2604	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	111
PID 264 set thread context of 5712	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	113
PID 264 set thread context of 4188	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	110
PID 264 set thread context of 2548	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	114
PID 264 set thread context of 2020	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	115
PID 264 set thread context of 5700	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	116
PID 264 set thread context of 5420	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	117
PID 264 set thread context of 1712	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	118

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 808	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	89
PID 264 wrote to memory of 808	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	89
PID 264 wrote to memory of 808	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	89
PID 264 wrote to memory of 808	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	89
PID 264 wrote to memory of 808	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	89
PID 264 wrote to memory of 808	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	89
PID 264 wrote to memory of 808	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	89
PID 264 wrote to memory of 2868	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	90
PID 264 wrote to memory of 2868	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	90
PID 264 wrote to memory of 2868	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	90
PID 264 wrote to memory of 2868	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	90
PID 264 wrote to memory of 2868	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	90
PID 264 wrote to memory of 2868	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	90
PID 264 wrote to memory of 2868	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	90
PID 264 wrote to memory of 932	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	91
PID 264 wrote to memory of 3804	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	93
PID 264 wrote to memory of 3804	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	93
PID 264 wrote to memory of 3804	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	93
PID 264 wrote to memory of 3804	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	93
PID 264 wrote to memory of 3804	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	93
PID 264 wrote to memory of 3804	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	93
PID 264 wrote to memory of 3804	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	93
PID 264 wrote to memory of 932	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	91
PID 264 wrote to memory of 932	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	91
PID 264 wrote to memory of 932	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	91
PID 264 wrote to memory of 932	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	91
PID 264 wrote to memory of 932	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	91
PID 264 wrote to memory of 932	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	91
PID 264 wrote to memory of 4364	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	94
PID 264 wrote to memory of 5516	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	92
PID 264 wrote to memory of 5516	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	92
PID 264 wrote to memory of 5516	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	92
PID 264 wrote to memory of 5516	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	92
PID 264 wrote to memory of 5516	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	92
PID 264 wrote to memory of 5516	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	92
PID 264 wrote to memory of 5516	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	92
PID 264 wrote to memory of 4364	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	94
PID 264 wrote to memory of 4364	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	94
PID 264 wrote to memory of 4364	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	94
PID 264 wrote to memory of 4364	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	94
PID 264 wrote to memory of 4364	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	94
PID 264 wrote to memory of 4364	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	94
PID 264 wrote to memory of 4488	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	95
PID 264 wrote to memory of 4464	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	96
PID 264 wrote to memory of 4464	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	96
PID 264 wrote to memory of 4464	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	96
PID 264 wrote to memory of 4464	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	96
PID 264 wrote to memory of 4464	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	96
PID 264 wrote to memory of 4464	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	96
PID 264 wrote to memory of 4464	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	96
PID 264 wrote to memory of 4488	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	95
PID 264 wrote to memory of 4488	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	95
PID 264 wrote to memory of 4488	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	95
PID 264 wrote to memory of 4488	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	95
PID 264 wrote to memory of 4488	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	95
PID 264 wrote to memory of 4488	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	95
PID 264 wrote to memory of 2976	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	97
PID 264 wrote to memory of 2976	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	97
PID 264 wrote to memory of 2976	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	97
PID 264 wrote to memory of 2976	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	97
PID 264 wrote to memory of 2976	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	97
PID 264 wrote to memory of 2976	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	97
PID 264 wrote to memory of 2976	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	97
PID 264 wrote to memory of 2528	264	2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:264
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:808
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:2868
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:932
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:5516
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:3804
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:4364
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:4488
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:4464
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:2976
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:2840
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:2528
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:1016
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:1228
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:1848
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:3280
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:3068
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:2000
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:716
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:2472
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:2164
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:1232
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:4188
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:2604
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:4516
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:5712
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:2548
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:2020
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:5700
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:5420
- C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-04_4c8f75599fce103a1b7a1f4e2e79a7fd_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
  2⤵
  PID:1712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\Telstar\d3dcompiler_47.dll
Size 4.7MB
SHA256 2c661b59eda230ab48643a4a54b69b4a40d21c4eab2e850e6dd3a757eeba5009
MD5 2d71f494fdeec59229244c5868483801
SHA1 591520de958904282599fa5a7c8bf0dee9616cc3
SHA512 26c515f1749aaf980f1e000293c86ef40e208105c078e6f08ea916063f208bf30f0fc4d6ccdaa5c1931117c4730d8586dbb11f1c96bce2bfc702137cff4c5103
SSDEEP 49152:4yZnRO4XyM53RkH4yCbqdoRpDruB0YGkaRwv1iD0NLY8z2Iog/Rfzja148HJAv1o:XZBbChgHohog/pzjyUnu1
TLSH
T188367C5673F940A9C1ABC178CE879213EBB1781413345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/264-65-0x0000000140000000-0x0000000140EE6000-memory.dmp

Download

memory/264-3-0x0000000140000000-0x0000000140EE6000-memory.dmp

Download

memory/716-35-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/808-1-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/808-2-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/932-53-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/1016-21-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/1228-25-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1232-61-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1712-51-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/1848-27-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2000-32-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2020-45-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2164-60-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2472-59-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2528-20-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2548-46-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2604-63-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2840-23-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2868-7-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2868-52-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2976-17-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/3068-58-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3280-29-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/3804-54-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4188-42-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4364-55-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4464-56-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/4488-14-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/4516-62-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/5420-49-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5516-57-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5700-50-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/5712-64-0x0000000140000000-0x0000000140050000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads