Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 15:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-10_6aef6190c26a1a3dba61479e3d129222_glassworm_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-10_6aef6190c26a1a3dba61479e3d129222_glassworm_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-09-10_6aef6190c26a1a3dba61479e3d129222_glassworm_icedid_njrat_vidar.exe
- Size 2.4MB
- Sample260910-s7xe7atzby
- SHA256 bfe566e999fe40fd42a6a5e8577c76e05931e52304504aaf15411535806bea5c
- MD5 6aef6190c26a1a3dba61479e3d129222
- SHA1 ce462ef3337583f716dd3b9bf174801930804dfd
- SHA512 316fdcbccf82fe388b17dbd9d999aaa5537cbbc261fc2287eac3f3fa2d6fe9ee4ce132dd28634044b43e2f065cece14c151add226af2e385dc32c7704db9047e
- SSDEEP 49152:TZ/1OLUjPHM4TUtLFFuBjyMC5MSyCTrAGLVufq81ID:TKkeHoO9
- TLSH T181B5BE1F2A9702B8D2B6993AC653590ED321BDF103D2998F116DF39B1F33B825EE5214
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1856 2026-09-10_6aef6190c26a1a3dba61479e3d129222_glassworm_icedid_njrat_vidar.exe 1856 2026-09-10_6aef6190c26a1a3dba61479e3d129222_glassworm_icedid_njrat_vidar.exe 1856 2026-09-10_6aef6190c26a1a3dba61479e3d129222_glassworm_icedid_njrat_vidar.exe 1856 2026-09-10_6aef6190c26a1a3dba61479e3d129222_glassworm_icedid_njrat_vidar.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1856 2026-09-10_6aef6190c26a1a3dba61479e3d129222_glassworm_icedid_njrat_vidar.exe Token: SeDebugPrivilege 1856 2026-09-10_6aef6190c26a1a3dba61479e3d129222_glassworm_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_6aef6190c26a1a3dba61479e3d129222_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_6aef6190c26a1a3dba61479e3d129222_glassworm_icedid_njrat_vidar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1856