Overview

overview

4

Static

static

1

2026-10-26...ar.exe

windows10-2004-x64

4

2026-10-26...ar.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 03:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-26_e880db2c92abd4aaca4ec64b2381cb79_glassworm_icedid_njrat_poet-rat_remcos_vidar.exe
  • Size 6.2MB
  • Sample261027-ecc66sas9s
  • SHA256 0a0125149e96347fb495431c5d8492204a51181ad654bf7890a702b5bd97c902
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies registry class 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_e880db2c92abd4aaca4ec64b2381cb79_glassworm_icedid_njrat_poet-rat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-26_e880db2c92abd4aaca4ec64b2381cb79_glassworm_icedid_njrat_poet-rat_remcos_vidar.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\ProgramData\Jagex\launcher\rs2client.exe
      C:\ProgramData\Jagex\launcher\rs2client.exe "35" "http://world16a.runescape.com/k=5" "36" "http://services.runescape.com/m=gamelogspecs/k=5/clientstats?data=" "37" "content.runescape.com" "31" "16785" "32" "" "33" "" "38" "1200" "39" "false" "58" "https://account.jagex.com/" "59" "https://auth.runescape.com/" "8" "false" "56" "https://social.auth.jagex.com/" "7" "0" "57" "6589" "6" "0" "54" "https://payments.jagex.com/" "5" "0" "55" "196515767263-1oo20deqm6edn7ujlihl6rpadk9drhva.apps.googleusercontent.com" "4" "0" "52" "0" "3" "lobby20.runescape.com" "53" "https://auth.jagex.com/" "2" "1119" "50" "0" "1" "0" "51" "0" "18" "-2083230396" "19" "" "60" "0" "13" "false" "10" "wwGlrZHF5gKN6D3mDdihco3oPeYN2KFybL9hUUFqOvk" "11" "77" "16" ".runescape.com" "17" "false" "14" "false" "15" "" "27" "16" "26" "false" "25" "0" "24" "true" "23" "false" "22" "" "21" "halign=true|valign=true|image=rs_logo.gif,0,-43|rotatingimage=rs3_loading_spinner.gif,0,47,9.6|progress=true,Verdana,13,0xFFFFFF,0,51" "20" "false" "41" "43594" "40" "http://world16a.runescape.com/k=5" "43" "43594" "29" "xCNoVntm1yaqH4R3iLOCpW7zq7MV-ei6" "42" "443" "28" "1439379131" "45" "43594" "44" "443" "47" "43594" "46" "443" "49" "content.runescape.com" "48" "443" "34" "1789536144" launcher B94
      2⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      PID:2556

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        rs2client.exe
        • Path C:\ProgramData\Jagex\launcher\rs2client.exe
        • Size 24.4MB
        • SHA256 f01543b9f7af2a8f4f978abdb2587864ecedb039ab8c406759249be1883d957a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2556-11-0x000001CD48BB0000-0x000001CD48D56000-memory.dmp
        Download

        memory/2964-10-0x000001E248550000-0x000001E2486F6000-memory.dmp
        Download