Overview

overview

4

Static

static

1

2026-10-26...ar.exe

windows10-2004-x64

4

2026-10-26...ar.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/10/2026, 03:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-26_e880db2c92abd4aaca4ec64b2381cb79_glassworm_icedid_njrat_poet-rat_remcos_vidar.exe
  • Size 6.2MB
  • Sample261027-ecc66sas9s
  • SHA256 0a0125149e96347fb495431c5d8492204a51181ad654bf7890a702b5bd97c902
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies registry class 18 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_e880db2c92abd4aaca4ec64b2381cb79_glassworm_icedid_njrat_poet-rat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-26_e880db2c92abd4aaca4ec64b2381cb79_glassworm_icedid_njrat_poet-rat_remcos_vidar.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\ProgramData\Jagex\launcher\rs2client.exe
      C:\ProgramData\Jagex\launcher\rs2client.exe "35" "http://world24a.runescape.com/k=5" "36" "http://services.runescape.com/m=gamelogspecs/k=5/clientstats?data=" "37" "content.runescape.com" "31" "8897" "32" "" "33" "" "38" "1200" "39" "false" "58" "https://account.jagex.com/" "8" "false" "59" "https://auth.runescape.com/" "56" "https://social.auth.jagex.com/" "7" "0" "57" "6589" "6" "0" "54" "https://payments.jagex.com/" "5" "0" "4" "0" "55" "196515767263-1oo20deqm6edn7ujlihl6rpadk9drhva.apps.googleusercontent.com" "52" "0" "3" "lobby19a.runescape.com" "2" "1118" "53" "https://auth.jagex.com/" "50" "0" "1" "0" "51" "0" "18" "913343173" "19" "" "60" "0" "13" "false" "10" "wwGlrZHF5gKN6D3mDdihco3oPeYN2KFybL9hUUFqOvk" "11" "77" "16" ".runescape.com" "17" "false" "14" "false" "15" "" "27" "24" "26" "false" "25" "0" "24" "true" "23" "false" "22" "" "21" "halign=true|valign=true|image=rs_logo.gif,0,-43|rotatingimage=rs3_loading_spinner.gif,0,47,9.6|progress=true,Verdana,13,0xFFFFFF,0,51" "20" "false" "41" "43594" "40" "http://world24a.runescape.com/k=5" "43" "43594" "29" "*qFpnElrFu9fnJ*zkOYxuL9kLXcZiGZa" "42" "443" "28" "1439378945" "45" "43594" "44" "443" "47" "43594" "46" "443" "49" "content.runescape.com" "48" "443" "34" "172549335" launcher 64C
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of SetWindowsHookEx
      PID:3964

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        preferences.cfg
        • Path C:\ProgramData\Jagex\launcher\preferences.cfg
        • Size 129B
        • SHA256 0266a84ab491a6e37890d66d96d420fe9ab2387188586fe91b6c045c1527e0b0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        rs2client.exe
        • Path C:\ProgramData\Jagex\launcher\rs2client.exe
        • Size 24.4MB
        • SHA256 f01543b9f7af2a8f4f978abdb2587864ecedb039ab8c406759249be1883d957a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download