Analysis
- max time kernel
149s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 09:16
General
- Target 2026-09-24_599d20cc36c651afc39c32fea1c4f430_glassworm_hammertoss_icedid_njrat.exe
- Size 3.1MB
- Sample260925-k8xtcaxyg1
- SHA256 1d7b9bbb7d099c60f6a58880cc24bdcb8094dd89d3bdc90829fe28392bbf8b80
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_599d20cc36c651afc39c32fea1c4f430_glassworm_hammertoss_icedid_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_599d20cc36c651afc39c32fea1c4f430_glassworm_hammertoss_icedid_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\PJHLauncher\PJHLauncher.exe"C:\Users\Admin\AppData\Local\Programs\PJHLauncher\PJHLauncher.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
PJHLauncher.exe
settings.dat
settings.dat~RFe5943c6.TMP
memory/468-28-0x0000000003660000-0x00000000036B0000-memory.dmp
memory/468-45-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/468-54-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/468-53-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/468-52-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/468-48-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/468-46-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/468-42-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/468-25-0x0000000000AF0000-0x0000000000E04000-memory.dmp
memory/468-26-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/468-27-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/468-43-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/468-31-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/468-32-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/468-41-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/4896-3-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/4896-0-0x00007FFEAEE7F000-0x00007FFEAEE80000-memory.dmp
memory/4896-44-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/4896-2-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/4896-1-0x0000000000370000-0x0000000000694000-memory.dmp
memory/4896-4-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/4896-9-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/4896-47-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/4896-8-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/4896-7-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/4896-6-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp
memory/4896-5-0x00007FFEAECF0000-0x00007FFEAF694000-memory.dmp