f0ffe8baf4cfebc7106552bd505b2ef38467d0b7741d410b7ed764b5566e9c57

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_242be4108c35dacce225d2e7eb2d164d_glassworm_icedid_luca-stealer_vidar.exe
Size 10.6MB
Sample260907-hc3nlsfc48
SHA256 f0ffe8baf4cfebc7106552bd505b2ef38467d0b7741d410b7ed764b5566e9c57
MD5 242be4108c35dacce225d2e7eb2d164d
SHA1 4e7aac155f8e44a0b2a64405488b3f2d42aa9f3d
SHA512 7214fbd347b9afa71cc1e00afa1c4e485eee36a0bce0e239e14e93623a64a58cab4ca6a69f41e06624153be5cb1db4558274be4473f694dc2cd3341685801e98
SSDEEP 98304:WkN0meeKX4t5aWscEY2VXjhme3kvGLcwmDSW4HQThB5:WQRKotsWsJYkThB3MGLcTEH
TLSH
T1A6B69C0AA3E50165E877D678CA268733CAB9BC525734C18F0158F6DA1F33AA14B7F325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
828	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com
11	raw.githubusercontent.com
12	raw.githubusercontent.com
13	raw.githubusercontent.com
4	raw.githubusercontent.com
5	raw.githubusercontent.com
6	raw.githubusercontent.com

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
828	powershell.exe
828	powershell.exe
2808	powershell.exe
2808	powershell.exe
4704	powershell.exe
4704	powershell.exe
4432	powershell.exe
4432	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	828	powershell.exe
Token: SeIncreaseQuotaPrivilege	828	powershell.exe
Token: SeSecurityPrivilege	828	powershell.exe
Token: SeTakeOwnershipPrivilege	828	powershell.exe
Token: SeLoadDriverPrivilege	828	powershell.exe
Token: SeSystemProfilePrivilege	828	powershell.exe
Token: SeSystemtimePrivilege	828	powershell.exe
Token: SeProfSingleProcessPrivilege	828	powershell.exe
Token: SeIncBasePriorityPrivilege	828	powershell.exe
Token: SeCreatePagefilePrivilege	828	powershell.exe
Token: SeBackupPrivilege	828	powershell.exe
Token: SeRestorePrivilege	828	powershell.exe
Token: SeShutdownPrivilege	828	powershell.exe
Token: SeDebugPrivilege	828	powershell.exe
Token: SeSystemEnvironmentPrivilege	828	powershell.exe
Token: SeRemoteShutdownPrivilege	828	powershell.exe
Token: SeUndockPrivilege	828	powershell.exe
Token: SeManageVolumePrivilege	828	powershell.exe
Token: 33	828	powershell.exe
Token: 34	828	powershell.exe
Token: 35	828	powershell.exe
Token: 36	828	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeIncreaseQuotaPrivilege	2808	powershell.exe
Token: SeSecurityPrivilege	2808	powershell.exe
Token: SeTakeOwnershipPrivilege	2808	powershell.exe
Token: SeLoadDriverPrivilege	2808	powershell.exe
Token: SeSystemProfilePrivilege	2808	powershell.exe
Token: SeSystemtimePrivilege	2808	powershell.exe
Token: SeProfSingleProcessPrivilege	2808	powershell.exe
Token: SeIncBasePriorityPrivilege	2808	powershell.exe
Token: SeCreatePagefilePrivilege	2808	powershell.exe
Token: SeBackupPrivilege	2808	powershell.exe
Token: SeRestorePrivilege	2808	powershell.exe
Token: SeShutdownPrivilege	2808	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeSystemEnvironmentPrivilege	2808	powershell.exe
Token: SeRemoteShutdownPrivilege	2808	powershell.exe
Token: SeUndockPrivilege	2808	powershell.exe
Token: SeManageVolumePrivilege	2808	powershell.exe
Token: 33	2808	powershell.exe
Token: 34	2808	powershell.exe
Token: 35	2808	powershell.exe
Token: 36	2808	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeIncreaseQuotaPrivilege	4704	powershell.exe
Token: SeSecurityPrivilege	4704	powershell.exe
Token: SeTakeOwnershipPrivilege	4704	powershell.exe
Token: SeLoadDriverPrivilege	4704	powershell.exe
Token: SeSystemProfilePrivilege	4704	powershell.exe
Token: SeSystemtimePrivilege	4704	powershell.exe
Token: SeProfSingleProcessPrivilege	4704	powershell.exe
Token: SeIncBasePriorityPrivilege	4704	powershell.exe
Token: SeCreatePagefilePrivilege	4704	powershell.exe
Token: SeBackupPrivilege	4704	powershell.exe
Token: SeRestorePrivilege	4704	powershell.exe
Token: SeShutdownPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeSystemEnvironmentPrivilege	4704	powershell.exe
Token: SeRemoteShutdownPrivilege	4704	powershell.exe
Token: SeUndockPrivilege	4704	powershell.exe
Token: SeManageVolumePrivilege	4704	powershell.exe
Token: 33	4704	powershell.exe
Token: 34	4704	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 828	536	2026-09-06_242be4108c35dacce225d2e7eb2d164d_glassworm_icedid_luca-stealer_vidar.exe	96
PID 536 wrote to memory of 2808	536	2026-09-06_242be4108c35dacce225d2e7eb2d164d_glassworm_icedid_luca-stealer_vidar.exe	100
PID 536 wrote to memory of 4704	536	2026-09-06_242be4108c35dacce225d2e7eb2d164d_glassworm_icedid_luca-stealer_vidar.exe	102
PID 536 wrote to memory of 4432	536	2026-09-06_242be4108c35dacce225d2e7eb2d164d_glassworm_icedid_luca-stealer_vidar.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-09-06_242be4108c35dacce225d2e7eb2d164d_glassworm_icedid_luca-stealer_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_242be4108c35dacce225d2e7eb2d164d_glassworm_icedid_luca-stealer_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" ((Get-NetAdapter -Physical | Where-Object Status -eq 'Up').MacAddress).Replace('-', ':').ToLower()
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" (Get-CimInstance Win32_ComputerSystemProduct).UUID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" (Get-CimInstance Win32_BIOS).SerialNumber
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" (Get-CimInstance Win32_BaseBoard).SerialNumber
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
TLSH
T1DC51FE323375F0D4C8567F07293819D463BF4386EA94AF58B258621ED93641B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 46599a80b0a9a7e522f3d86d79ab9c6a6ce6f0fef263439dbfef1f63e8c656c3
MD5 ca97aaac3b0b4d54955539487f93816f
SHA1 dade0004f226d1e456a0d58e93ca5e4c86a313c1
SHA512 76790dbc2fdc849df160615207c40589f22430ccd6600472ff81b0cb4a39eed992dd8b1dd25621f999aebcd54e996e0e4a98196e6e55e837497209a2a2b6ab86
TLSH
T149217823B39D8821CCD5153A108D9C5072A682C781DFCF9F2EC0C21191BFAC8CB21194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 900a9a624aec11ad3135d11115657b312ce79a009a92366ea62429de7b7114dd
MD5 fd0be6de81c6d2be5e155c7f1dfacafe
SHA1 558364f27408dedc78dec440e4976ba3c34b599b
SHA512 7781cd109df759d5e1f563c77af02e6fb2029df06f85d79a7d5a127bee4bc62ff51aeba01c8b8f05cc28dd5fa2b8d39df163c98a4afa8166ab6d2dea9f633094
TLSH
T1D9216527B39DD8A2CC89253A209CAC1172B783C7409ECF8F6AC0C224A57FA94CB61150
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 34c6696dc87d3f2bd1ff41b7048017c2f2662bbe651f51b18825419fa679dd9b
MD5 8ff2c89bd4c9885c5b0301ccda34a049
SHA1 48ccac1723f1ce63c297e428761408c3de6be2c8
SHA512 e747ca0d0a61bad06b444184d67052f4bb64c88348ce6abf9ce7e1b7c15ed3c160c51463e6f3013c9e4048b4ac98d2e57b455d5e2e0ca344229dad6f7e5a5bdc
TLSH
T170216527B39CC921DC99153A209CAC1172B683CB809ECF8F6EC0D224A17FA84CB61590
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ka4m4cep.kiz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ka4m4cep.kiz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/828-0-0x000002E99ACE0000-0x000002E99ACF0000-memory.dmp

Download

memory/828-2-0x000002E9B40C0000-0x000002E9B40E2000-memory.dmp

Download

memory/828-10-0x000002E99ACE0000-0x000002E99ACF0000-memory.dmp

Download

memory/828-1-0x000002E99ACE0000-0x000002E99ACF0000-memory.dmp

Download

memory/2808-15-0x000001EB72CF0000-0x000001EB72D00000-memory.dmp

Download

memory/2808-25-0x000001EB74630000-0x000001EB74654000-memory.dmp

Download

memory/2808-24-0x000001EB74630000-0x000001EB7465A000-memory.dmp

Download

memory/2808-14-0x000001EB72CF0000-0x000001EB72D00000-memory.dmp

Download