Overview

overview

7

Static

static

3

2026-11-07...id.exe

windows10-2004-x64

7

2026-11-07...id.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    17s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/11/2026, 17:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-07_05fc0e83c1af077b541b177c66d0e982_glassworm_icedid.exe
  • Size 13.4MB
  • Sample261107-vw8eesfd86
  • SHA256 d66b04e1fddc06ca90e8f4117d07b04f28a9845c49ca133dae03ba83df47347c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistence

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-07_05fc0e83c1af077b541b177c66d0e982_glassworm_icedid.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-07_05fc0e83c1af077b541b177c66d0e982_glassworm_icedid.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of WriteProcessMemory
    PID:6040
    • C:\Users\Admin\Downloads\inst-dotnet-10.0.0-X64-WindowsDesktop.exe
      "C:\Users\Admin\Downloads\inst-dotnet-10.0.0-X64-WindowsDesktop.exe" /norestart /passive /showrmui
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4272
      • C:\Windows\TEMP\{6164BFEC-9C5B-4CC8-BBA8-304A22F45E13}\.ba\wixstdba.exe
        "C:\Windows\TEMP\{6164BFEC-9C5B-4CC8-BBA8-304A22F45E13}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{917C86B2-1416-482A-8127-AB607CB49952} {3A2D4221-1417-4DA6-AD5B-3AF0D5E50B57}
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:3236
      • C:\Windows\TEMP\{6164BFEC-9C5B-4CC8-BBA8-304A22F45E13}\.be\windowsdesktop-runtime-10.0.14-win-x64.exe
        "C:\Windows\TEMP\{6164BFEC-9C5B-4CC8-BBA8-304A22F45E13}\.be\windowsdesktop-runtime-10.0.14-win-x64.exe" -q -burn.elevated BurnPipe.{B4CBA9D7-C57A-479C-A61E-A7DFCF0DDC1B} {D273E74B-52BD-42D8-8C3E-DF482A3EFE59} 4272
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:3280
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4640
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 4A79E2839A39A31950A9BC77AE17341B
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:4192
  • C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe
    "C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:6008
    • C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe
      "C:\ProgramData\Package Cache\{29A18B06-B190-4463-9FFC-BC0D70D80B7C}\windowsdesktop-runtime-10.0.14-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107172151.log" /passive /norestart /showrmui
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1048
      • C:\Windows\TEMP\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\wixstdba.exe
        "C:\Windows\TEMP\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{24E36BBF-178E-4592-B6B4-77F74211CF35} {535F75B0-BC23-46D5-BA30-636698187968}
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        PID:4164
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:2920

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          DotNetRuntime
          • Path C:\ProgramData\Package Cache\.unverified\DotNetRuntime
          • Size 28.1MB
          • SHA256 36c8067684aeb83228b44ecb3d4c103379017ca87e3e007e51105a91e404d97a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107172151.log
          • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107172151.log
          • Size 23KB
          • SHA256 d2d6487383797ff7dbcdd894a6581fd802c414809b7d18575cdec156815776ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107172151_000_DotNetHost.log
          • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.14_(x64)_20261107172151_000_DotNetHost.log
          • Size 2KB
          • SHA256 dffcbeb68960890a4e5abbd69e93d59d3fadd3803c5ca7f4b5e4b26b6b19724a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          DotNetHost
          • Path C:\Users\Admin\AppData\Local\Temp\{6164BFEC-9C5B-4CC8-BBA8-304A22F45E13}\DotNetHost
          • Size 848KB
          • SHA256 abf9056691ac5c463120c59943bcc7b3ff8cc45e9430f5260d6383108f0f2839
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DotNetHostFxr
          • Path C:\Users\Admin\AppData\Local\Temp\{6164BFEC-9C5B-4CC8-BBA8-304A22F45E13}\DotNetHostFxr
          • Size 920KB
          • SHA256 b26eb4b947543ee2becaf5f71d8736f5bbdcb340eb1259856bdaf64bc11c7782
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsDesktopRuntime
          • Path C:\Users\Admin\AppData\Local\Temp\{6164BFEC-9C5B-4CC8-BBA8-304A22F45E13}\WindowsDesktopRuntime
          • Size 28.7MB
          • SHA256 cd1659987ad005184e83139f89fd0f073005916311f3426ae2152e0fc942a2c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSIBCFD.tmp
          • Path C:\Windows\Installer\MSIBCFD.tmp
          • Size 411KB
          • SHA256 ac54078e0387d2a8ddcdbee3967da6ea6ec6508172505aca3d27a75fa43ce34f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BootstrapperApplicationData.xml
          • Path C:\Windows\TEMP\{6164BFEC-9C5B-4CC8-BBA8-304A22F45E13}\.ba\BootstrapperApplicationData.xml
          • Size 9KB
          • SHA256 2994ce2de1b0a3527527b3e0e914d389fd9f4d9dbc1e22f30b1f385c8565e525
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DotNetLogo_256x.png
          • Path C:\Windows\TEMP\{6164BFEC-9C5B-4CC8-BBA8-304A22F45E13}\.ba\DotNetLogo_256x.png
          • Size 2KB
          • SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          dotnet.ico
          • Path C:\Windows\TEMP\{6164BFEC-9C5B-4CC8-BBA8-304A22F45E13}\.ba\dotnet.ico
          • Size 44KB
          • SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\TEMP\{6164BFEC-9C5B-4CC8-BBA8-304A22F45E13}\.ba\thm.wxl
          • Size 7KB
          • SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.xml
          • Path C:\Windows\TEMP\{6164BFEC-9C5B-4CC8-BBA8-304A22F45E13}\.ba\thm.xml
          • Size 11KB
          • SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\1028\thm.wxl
          • Size 7KB
          • SHA256 43e1e134d0591532323dfcd138ac8f5e99096cb6cb0213a486bbb3ecc5c47aad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\1029\thm.wxl
          • Size 7KB
          • SHA256 2f174b5eed2a84e43396f3cae2e6521c9247bb0deccb16e7f9b461233c363534
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\1031\thm.wxl
          • Size 7KB
          • SHA256 2589887424dd4b0b27d36f7aa36d07fb6fa8d1c4dbe50059248a24823c742f92
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\1036\thm.wxl
          • Size 8KB
          • SHA256 ecdd5f7b7ed65bef8e3eec00537da44939b8e8f8f604e9b39329b45ec210efde
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\1040\thm.wxl
          • Size 7KB
          • SHA256 c536f3f85936f6b38782df30a7bf88c7e7e66fa1e3257b20b75f9a4f0112b184
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\1041\thm.wxl
          • Size 8KB
          • SHA256 000e1508d9bacb7156951988ba1d6dc36165facd2163352a93b9a66e8c642089
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\1042\thm.wxl
          • Size 7KB
          • SHA256 09c51c910f7142ab7f73db8e826f3daff1525eea765d03bcd934cba53bc689d3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\1045\thm.wxl
          • Size 7KB
          • SHA256 209911674536ad5976dad21ae1e96a9fdfa61270120a94bbe0e8ae32a67239a2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\1046\thm.wxl
          • Size 7KB
          • SHA256 7b095c32d1fbdd924d710d18d51a88a710bc152c8b30c6051524583bfabe38c0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\1049\thm.wxl
          • Size 9KB
          • SHA256 3c911848f83d269fa2cd64bbfd7b5e88eb3a621bdd42c564c69100a8e8a40494
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\1055\thm.wxl
          • Size 7KB
          • SHA256 56d76adc63b71879e3291f0f306e54081e9e80f463fcb41dc6896ecd2298deae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\2052\thm.wxl
          • Size 7KB
          • SHA256 340154c87016bd6af740e6a91ea86d722817f6dc2bc675c33133901443658179
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          thm.wxl
          • Path C:\Windows\Temp\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\3082\thm.wxl
          • Size 7KB
          • SHA256 2416f9a3daa6767f418c5ab94edb8a83dc9326fcaf13de1186e61b5248349edc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          BootstrapperExtensionData.xml
          • Path C:\Windows\Temp\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\BootstrapperExtensionData.xml
          • Size 276B
          • SHA256 258fac237622533e7f9ec3f95bcec8abcc31ae87e2017e5717af0841c61e9df4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          license.rtf
          • Path C:\Windows\Temp\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\license.rtf
          • Size 215B
          • SHA256 75cf03762aea3f3ef6ae0dc0290c4426052549a0b4335bcc3ba9ca30391e0751
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          logo.png
          • Path C:\Windows\Temp\{53093A03-3A4F-4372-9E1A-302AB9BDBF8A}\.ba\logo.png
          • Size 852B
          • SHA256 cd2e8ed1fbb308d9d166f49794d323a9b22efba1033cdf906d1f4b030319e01b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          wixstdba.exe
          • Path C:\Windows\Temp\{6164BFEC-9C5B-4CC8-BBA8-304A22F45E13}\.ba\wixstdba.exe
          • Size 431KB
          • SHA256 e9aad13949cd910523bf9547fc5c23bd2c26595e024809a9f8fa866c8d8e555b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          windowsdesktop-runtime-10.0.14-win-x64.exe
          • Path C:\Windows\Temp\{6164BFEC-9C5B-4CC8-BBA8-304A22F45E13}\.be\windowsdesktop-runtime-10.0.14-win-x64.exe
          • Size 968KB
          • SHA256 4234cb04b518dd990fd7053a16584dc37400465686ec0ef288d410e3ba304f17
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1048-146-0x00000000000B0000-0x0000000000176000-memory.dmp
          Download