19644b9701d654a8e8b43c39532cbed7185b3c7aa7f274a8a10da7fae502c177

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 22:45

Target
2026-10-22_bb63af9b4d806098551fe6692c6fd2bf_glassworm_icedid.exe
Size 2.8MB
Sample261023-2prlnavy8p
SHA256 19644b9701d654a8e8b43c39532cbed7185b3c7aa7f274a8a10da7fae502c177
MD5 bb63af9b4d806098551fe6692c6fd2bf
SHA1 10089d6b7c4f69cd338d6c4c8259c748620d2f71
SHA512 85561a2995bdc203eb364f5b0855ce88892892dcfc957b6a32ecd4cbfa73c6b98c86b38175963deb6e0b1f4d6a68696250e7e448e6f311df6696b3e57a05d027
SSDEEP 49152:iUNxvC6FGYJf6yjNQpNONZnTX5PlGPgq4EIxc7N/XxgWk3CTQQjxKWjFUsTWDcND:iULC6FPYpNONhVPlEgq41c71K3exKWSq
TLSH
T171D59D063FD9C0E9DFA791F2C6299622D37274150738D7CB25E0AA1DDFA3A905B3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
3408	AutoHotkey.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3408	AutoHotkey.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3408	AutoHotkey.exe
3408	AutoHotkey.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3408	AutoHotkey.exe
3408	AutoHotkey.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3408	AutoHotkey.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5644 wrote to memory of 3408	5644	2026-10-22_bb63af9b4d806098551fe6692c6fd2bf_glassworm_icedid.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-10-22_bb63af9b4d806098551fe6692c6fd2bf_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_bb63af9b4d806098551fe6692c6fd2bf_glassworm_icedid.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5644
- C:\Users\Admin\AppData\Local\Temp\AutoHotkey.exe
  "C:\Users\Admin\AppData\Local\Temp\AutoHotkey.exe" /force "\\.\pipe\AHKHHHHAJJJ"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3408

AutoHotkey.exe

Path C:\Users\Admin\AppData\Local\Temp\AutoHotkey.exe
Size 1.3MB
SHA256 effdea83c6b7a1dc2ce9e9d40e91dfd59bed9fcbd580903423648b7ca97d9696
MD5 2d0600fe2b1b3bdc45d833ca32a37fdb
SHA1 e9a7411bfef54050de3b485833556f84cabd6e41
SHA512 9891cd6d2140c3a5c20d5c2d6600f3655df437b99b09ae0f9daf1983190dc73385cc87f02508997bb696ac921eee43fccdf1dc210cc602938807bdb062ce1703
SSDEEP 24576:a3CTQQje6KWjFUsTNEDcN20pah5nQsrivkdhWeWr2O8hYzlj1TNp4j7YoqK:a3CTQQjxKWjFUsTWDcN20k5nQsrivkdq
TLSH
T196559D0633E6C0E8DEB391F6C5299623D772781407389BDB25E0592DDFA3AE05B3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5644-3-0x00000000058B0000-0x0000000005CB0000-memory.dmp

Download