Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
03/10/2026, 12:54
General
- Target 2026-10-02_4f2d74e1fbeb8ec12ff85164d1a29a4e_amadey_glassworm_hijackloader_icedid_luca-stealer_njrat_poet-rat_stealc_vidar.exe
- Size 15.3MB
- Sample261003-p5hbpsyfpg
- SHA256 314b83639aed202137331fc56d129562549924ab7df299e331013c0954ac9186
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects executables manipulated with Fody 1 IoCs
- Detects executables packed with ConfuserEx Mod 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_4f2d74e1fbeb8ec12ff85164d1a29a4e_amadey_glassworm_hijackloader_icedid_luca-stealer_njrat_poet-rat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_4f2d74e1fbeb8ec12ff85164d1a29a4e_amadey_glassworm_hijackloader_icedid_luca-stealer_njrat_poet-rat_stealc_vidar.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
interception.dll
memory/4828-13-0x0000025C70DA0000-0x0000025C70E98000-memory.dmp
memory/4828-14-0x00007FFAEBDE0000-0x00007FFAEC784000-memory.dmp
memory/4828-3-0x00007FFAEBDE0000-0x00007FFAEC784000-memory.dmp
memory/4828-4-0x00007FFAEBDE0000-0x00007FFAEC784000-memory.dmp
memory/4828-5-0x00007FFAEBDE0000-0x00007FFAEC784000-memory.dmp
memory/4828-6-0x00007FFAEBDE0000-0x00007FFAEC784000-memory.dmp
memory/4828-7-0x00007FFAEBDE0000-0x00007FFAEC784000-memory.dmp
memory/4828-8-0x00007FFAEBDE0000-0x00007FFAEC784000-memory.dmp
memory/4828-1-0x00007FFAEBDE0000-0x00007FFAEC784000-memory.dmp
memory/4828-16-0x00007FFAEBDE0000-0x00007FFAEC784000-memory.dmp
memory/4828-2-0x0000025C55780000-0x0000025C566C6000-memory.dmp
memory/4828-15-0x0000025C56BB0000-0x0000025C56BCA000-memory.dmp
memory/4828-0-0x00007FFAEBF6F000-0x00007FFAEBF70000-memory.dmp
memory/4828-17-0x00007FFAEBDE0000-0x00007FFAEC784000-memory.dmp
memory/4828-18-0x0000025C76FB0000-0x0000025C77062000-memory.dmp
memory/4828-19-0x00007FFAEBDE0000-0x00007FFAEC784000-memory.dmp
memory/4828-20-0x00007FFAEBDE0000-0x00007FFAEC784000-memory.dmp
memory/4828-21-0x00007FFAEBDE0000-0x00007FFAEC784000-memory.dmp
memory/4828-22-0x00007FFAEBDE0000-0x00007FFAEC784000-memory.dmp
memory/4828-23-0x00007FFAEBDE0000-0x00007FFAEC784000-memory.dmp
memory/4828-24-0x00007FFAEBDE0000-0x00007FFAEC784000-memory.dmp
memory/4828-25-0x00007FFAEBDE0000-0x00007FFAEC784000-memory.dmp