Analysis
- max time kernel
150s - max time network
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
19/09/2026, 11:03
General
- Target 2026-09-19_9e23edd2962440df19e1dd4ea3fbc893_glassworm_icedid_megazord_njrat_ryuk_stealc.exe
- Size 84.9MB
- Sample260919-m5rt2asy2p
- SHA256 7ceff658daad0d039692235d761a4aa5b636d12a0c11a8466fac2f1365838deb
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-19_9e23edd2962440df19e1dd4ea3fbc893_glassworm_icedid_megazord_njrat_ryuk_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-19_9e23edd2962440df19e1dd4ea3fbc893_glassworm_icedid_megazord_njrat_ryuk_stealc.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "chcp 65001"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2256-18-0x000001DEE5610000-0x000001DEE5634000-memory.dmp
memory/2256-16-0x000001DEE5090000-0x000001DEE509A000-memory.dmp
memory/2256-17-0x000001DEE5610000-0x000001DEE563A000-memory.dmp
memory/2256-11-0x000001DEE5050000-0x000001DEE5072000-memory.dmp
memory/2256-14-0x000001DEE50A0000-0x000001DEE50BE000-memory.dmp
memory/2256-15-0x000001DEE5300000-0x000001DEE53B2000-memory.dmp
memory/3040-1-0x000002D57A002000-0x000002D57A003000-memory.dmp
memory/3040-5-0x000002D57A003000-0x000002D57A004000-memory.dmp
memory/3040-6-0x000002D57A004000-0x000002D57A005000-memory.dmp
memory/3040-7-0x000002D57A006000-0x000002D57A007000-memory.dmp
memory/3040-4-0x000002D57A005000-0x000002D57A006000-memory.dmp
memory/3040-3-0x000002D5B9FFF000-0x000002D5BA000000-memory.dmp
memory/3040-2-0x000002D57A001000-0x000002D57A002000-memory.dmp
memory/3040-20-0x000002D57A002000-0x000002D57A003000-memory.dmp
memory/3040-21-0x000002D5B9FFF000-0x000002D5BA000000-memory.dmp
memory/3040-22-0x000002D57A006000-0x000002D57A007000-memory.dmp