c5225fa993439065c273882d370d6d79ebe4999ee0eaf29476f8e9f8ffede04a

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_26eee6d3656bad36bcef3c1e86a7a210_glassworm_icedid_njrat_vidar_zxxz.exe
Size 32.8MB
Sample260924-pedktstbld
SHA256 c5225fa993439065c273882d370d6d79ebe4999ee0eaf29476f8e9f8ffede04a
MD5 26eee6d3656bad36bcef3c1e86a7a210
SHA1 b7c3ce98a648d65f5fdcfa541a03379f8d406ccb
SHA512 8357178924b999278bd26d7660cbc22ca378fcac912f480402c168609bd7526bf010380afac59fb84c3445c93ff9ac9c5496d312cb0f0786080924a083f780d9
SSDEEP 393216:4WGB6oiHUVA4O4H1V7Y8339+jgFTI71YP0Bo7yQjGJqc/zce07VDcOZh+FmesX3G:4tCY76mesMpAIJ
TLSH
T16F778B5772B90185E5B7E13889AB4203D773B8668730CBCF215D02592F77AE29E7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2680	cmd.exe
4060	cmd.exe
3904	cmd.exe
4908	cmd.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1820	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2612	2026-09-23_26eee6d3656bad36bcef3c1e86a7a210_glassworm_icedid_njrat_vidar_zxxz.exe
2612	2026-09-23_26eee6d3656bad36bcef3c1e86a7a210_glassworm_icedid_njrat_vidar_zxxz.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 2680	2612	2026-09-23_26eee6d3656bad36bcef3c1e86a7a210_glassworm_icedid_njrat_vidar_zxxz.exe	89
PID 2612 wrote to memory of 4060	2612	2026-09-23_26eee6d3656bad36bcef3c1e86a7a210_glassworm_icedid_njrat_vidar_zxxz.exe	90
PID 2612 wrote to memory of 3904	2612	2026-09-23_26eee6d3656bad36bcef3c1e86a7a210_glassworm_icedid_njrat_vidar_zxxz.exe	91
PID 3904 wrote to memory of 1820	3904	cmd.exe	92
PID 2612 wrote to memory of 4908	2612	2026-09-23_26eee6d3656bad36bcef3c1e86a7a210_glassworm_icedid_njrat_vidar_zxxz.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-09-23_26eee6d3656bad36bcef3c1e86a7a210_glassworm_icedid_njrat_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_26eee6d3656bad36bcef3c1e86a7a210_glassworm_icedid_njrat_vidar_zxxz.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ipfs swarm addrs --timeout=60s"
  2⤵
  - Executes a command shell one-liner
  PID:2680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ipfs init --timeout=30s"
  2⤵
  - Executes a command shell one-liner
  PID:4060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "systeminfo"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:1820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "check_vtx.exe"
  2⤵
  - Executes a command shell one-liner
  PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads