Analysis
- max time kernel
151s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/09/2026, 15:41
General
- Target 2026-09-08_76fbe9c167a64a7677f155774773e07a_glassworm_icedid_njrat_vidar.exe
- Size 55.1MB
- Sample260908-s41y7stdjh
- SHA256 00ba179eb6364c34df1834ea067dd7eb653be2d2b93c99026f15ba86cf38b077
Malware Config
Signatures
- Detects executables packed with VMProtect. 11 IoCs
- Deletes itself 1 IoCs
- VMProtect packed file 7 IoCs
Detects executables packed with VMProtect commercial packer.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_76fbe9c167a64a7677f155774773e07a_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_76fbe9c167a64a7677f155774773e07a_glassworm_icedid_njrat_vidar.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Deletes itself
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
DPINST1.lic
memory/4764-14-0x00007FFD3BF60000-0x00007FFD3BF62000-memory.dmp
memory/4764-16-0x00007FFD3A810000-0x00007FFD3A812000-memory.dmp
memory/4764-4-0x0000000140000000-0x0000000142D75000-memory.dmp
memory/4764-6-0x0000000140000000-0x0000000142D75000-memory.dmp
memory/4764-7-0x0000000140000000-0x0000000142D75000-memory.dmp
memory/4764-9-0x0000000140000000-0x0000000142D75000-memory.dmp
memory/4764-11-0x00007FFD3D2C0000-0x00007FFD3D2C2000-memory.dmp
memory/4764-12-0x00007FFD3D2D0000-0x00007FFD3D2D2000-memory.dmp
memory/4764-10-0x00007FFD3D2B0000-0x00007FFD3D2B2000-memory.dmp
memory/4764-43-0x0000000140000000-0x0000000142D75000-memory.dmp
memory/4764-39-0x000001C900CD0000-0x000001C900D69000-memory.dmp
memory/4764-15-0x00007FFD3A800000-0x00007FFD3A802000-memory.dmp
memory/4764-13-0x00007FFD3BF50000-0x00007FFD3BF52000-memory.dmp
memory/4764-19-0x0000000180000000-0x0000000180504000-memory.dmp
memory/4764-17-0x0000000140000000-0x0000000142D75000-memory.dmp
memory/4764-28-0x0000000180000000-0x0000000180504000-memory.dmp
memory/4764-5-0x000001C97D330000-0x000001C97D331000-memory.dmp
memory/4764-38-0x0000000180000000-0x0000000180504000-memory.dmp
memory/4764-40-0x0000000180000000-0x0000000180504000-memory.dmp
memory/6112-1-0x00007FF72B7E0000-0x00007FF72EF04000-memory.dmp
memory/6112-0-0x00007FFD3D2B0000-0x00007FFD3D2B2000-memory.dmp