Analysis
- max time kernel
149s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/09/2026, 21:03
General
- Target 2026-09-03_d9825feaa15743a5d19291268526c8e4_glassworm_icedid.exe
- Size 1.2MB
- Sample260905-zv5pcssfph
- SHA256 b4dc613a50a72bcb0e6d2a4772aff7bd402c10eb1f9173ffbb9a2ba87d290c2c
Malware Config
Signatures
- Detects executables referencing virtualization MAC addresses 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-03_d9825feaa15743a5d19291268526c8e4_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-03_d9825feaa15743a5d19291268526c8e4_glassworm_icedid.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5048-0-0x00007FFC7307F000-0x00007FFC73080000-memory.dmp
memory/5048-1-0x0000000000690000-0x00000000007CE000-memory.dmp
memory/5048-2-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/5048-3-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/5048-4-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/5048-5-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/5048-6-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/5048-7-0x0000000002FE0000-0x0000000002FE8000-memory.dmp
memory/5048-9-0x0000000003040000-0x000000000304E000-memory.dmp
memory/5048-8-0x0000000022B60000-0x0000000022B9E000-memory.dmp
memory/5048-10-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/5048-11-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/5048-12-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/5048-13-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/5048-14-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/5048-15-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp
memory/5048-16-0x00007FFC72EF0000-0x00007FFC73894000-memory.dmp