Overview

overview

10

Static

static

10

2026-09-16...id.exe

windows10-2004-x64

9

2026-09-16...id.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/09/2026, 19:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-16_88b86e022f3e5c88a950aacb8b6eb151_akira_glassworm_icedid.exe
  • Size 13.4MB
  • Sample260916-yby7ssdc39
  • SHA256 008579fa6bdf8d353dea421adc0d8a5b6753495eda39dea4d6325b7b6370982e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10

Malware Config

Signatures

  • Detects executables packed with VMProtect. 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_88b86e022f3e5c88a950aacb8b6eb151_akira_glassworm_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_88b86e022f3e5c88a950aacb8b6eb151_akira_glassworm_icedid.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2656
    • C:\Users\Admin\AppData\Local\Temp\dflove-update-LIybDx.exe
      "C:\Users\Admin\AppData\Local\Temp\dflove-update-LIybDx.exe" --apply-update C:\Users\Admin\AppData\Local\Temp\2026-09-16_88b86e022f3e5c88a950aacb8b6eb151_akira_glassworm_icedid.exe 2656
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:3616
      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_88b86e022f3e5c88a950aacb8b6eb151_akira_glassworm_icedid.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_88b86e022f3e5c88a950aacb8b6eb151_akira_glassworm_icedid.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:4768

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        launcher.log
        • Path C:\Users\Admin\AppData\Local\DFLove\logs\launcher.log
        • Size 268B
        • SHA256 07fc4a724d02efe7fe18b1067b37319bb891ddbf40699ffd6217961ebb498d9f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        launcher.log
        • Path C:\Users\Admin\AppData\Local\DFLove\logs\launcher.log
        • Size 621B
        • SHA256 0b8631fc72d56c689509ba072b997d4bf0d3f3dd4488c99c34e5bca86300ce42
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        2026-09-16_88b86e022f3e5c88a950aacb8b6eb151_akira_glassworm_icedid.log
        • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_88b86e022f3e5c88a950aacb8b6eb151_akira_glassworm_icedid.log
        • Size 423B
        • SHA256 0fc8db37447204f074d901f8abaf994894355afe563d14b3e70647d631ab1146
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dflove-update-LIybDx.exe
        • Path C:\Users\Admin\AppData\Local\Temp\dflove-update-LIybDx.exe
        • Size 13.6MB
        • SHA256 823142a510d70e2952424a6cb32d1b738c775c3b0ede737477319e5e9388841b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4768-30-0x0000000002060000-0x0000000002064000-memory.dmp
        Download