Analysis
- max time kernel
149s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
03/10/2026, 12:54
General
- Target 2026-10-02_4f2d74e1fbeb8ec12ff85164d1a29a4e_amadey_glassworm_hijackloader_icedid_luca-stealer_njrat_poet-rat_stealc_vidar.exe
- Size 15.3MB
- Sample261003-p5hbpsyfpg
- SHA256 314b83639aed202137331fc56d129562549924ab7df299e331013c0954ac9186
Score
9/10
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects executables manipulated with Fody 1 IoCs
- Detects executables packed with ConfuserEx Mod 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_4f2d74e1fbeb8ec12ff85164d1a29a4e_amadey_glassworm_hijackloader_icedid_luca-stealer_njrat_poet-rat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_4f2d74e1fbeb8ec12ff85164d1a29a4e_amadey_glassworm_hijackloader_icedid_luca-stealer_njrat_poet-rat_stealc_vidar.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
interception.dll
memory/4276-0-0x000001C4B2EB0000-0x000001C4B3DF6000-memory.dmp
memory/4276-6-0x000001C4CE2B0000-0x000001C4CE3A8000-memory.dmp
memory/4276-5-0x000001C4CE420000-0x000001C4CE430000-memory.dmp
memory/4276-7-0x000001C4B5A60000-0x000001C4B5A7A000-memory.dmp
memory/4276-8-0x000001C4CE420000-0x000001C4CE430000-memory.dmp
memory/4276-9-0x000001C4D2270000-0x000001C4D2322000-memory.dmp
memory/4276-10-0x000001C4CE420000-0x000001C4CE430000-memory.dmp
memory/4276-11-0x000001C4CE420000-0x000001C4CE430000-memory.dmp
memory/4276-12-0x000001C4CE420000-0x000001C4CE430000-memory.dmp
memory/4276-13-0x000001C4CE420000-0x000001C4CE430000-memory.dmp