Analysis
- max time kernel
148s - max time network
144s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 14:01
General
- Target 2026-05-03_bb7a198585d3f568a10e6434076faaec_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 18.4MB
- Sample260503-rbvfaabs2s
- SHA256 0e681d6eb14584269213ca92c086df7add3168aa834dc8b7544295b208aa04ad
Malware Config
Extracted
-
xbinder
-
4SsPfvmwFd2f8Rddb
-
primary_drop_directory
%Temp%
-
primary_execute
true
-
primary_hidden_file
false
-
primary_resource_name
Cheat.exe
-
secondary_drop_directory
%Temp%
-
secondary_execute
true
-
secondary_hidden_file
false
-
secondary_resource_name
Beta.exe
Signatures
- Family: XBinder
XBinder is a crypter and loader delivering a wide variety of malware, written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Executes dropped EXE 10 IoCs
- Loads dropped DLL 14 IoCs
- Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_bb7a198585d3f568a10e6434076faaec_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_bb7a198585d3f568a10e6434076faaec_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_bb7a198585d3f568a10e6434076faaec_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_bb7a198585d3f568a10e6434076faaec_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp_75981.exeC:\Users\Admin\AppData\Local\Temp\tmp_75981.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Cheat.exe"C:\Users\Admin\AppData\Local\Temp\Cheat.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Cheat.exe"C:\Users\Admin\AppData\Local\Temp\Cheat.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c mode con: cols=80 lines=256⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con: cols=80 lines=257⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Beta.exe"C:\Users\Admin\AppData\Local\Temp\Beta.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="NBE#fl4dfE*Cfi" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\nvvsvc.exe" enable=yes & exit5⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Users\Admin\AppData\Roaming\nvvsvc.exe" /RL HIGHEST & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Users\Admin\AppData\Roaming\nvvsvc.exe" /RL HIGHEST6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Users\Admin\AppData\Local\WinBioSvc.exe" /RL HIGHEST & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Users\Admin\AppData\Local\WinBioSvc.exe" /RL HIGHEST6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\nvvsvc.exe"C:\Users\Admin\AppData\Roaming\nvvsvc.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\nvvsvc.exeC:\Users\Admin\AppData\Roaming\nvvsvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\WinBioSvc.exeC:\Users\Admin\AppData\Local\WinBioSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\nvvsvc.exeC:\Users\Admin\AppData\Roaming\nvvsvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\nvvsvc.exeC:\Users\Admin\AppData\Roaming\nvvsvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\nvvsvc.exeC:\Users\Admin\AppData\Roaming\nvvsvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
nvvsvc.exe.log
Beta.exe
Cheat.exe
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python314.dll
select.pyd
unicodedata.pyd
base_library.zip
tmp_75981.exe
memory/984-205-0x00000213DBFB0000-0x00000213DC01F000-memory.dmp
memory/2840-204-0x00000144A7060000-0x00000144A7072000-memory.dmp
memory/2840-203-0x00000144A6E10000-0x00000144A6E7F000-memory.dmp
memory/2840-202-0x00000144A6DD0000-0x00000144A6DDC000-memory.dmp
memory/2904-197-0x0000029C98690000-0x0000029C986A2000-memory.dmp
memory/2904-195-0x0000029C98630000-0x0000029C9863C000-memory.dmp
memory/2904-196-0x0000029C99E80000-0x0000029C99EEF000-memory.dmp
memory/3208-193-0x0000013C82F10000-0x0000013C82F22000-memory.dmp
memory/3208-191-0x0000013C82ED0000-0x0000013C82EDC000-memory.dmp
memory/3208-192-0x0000013C9D030000-0x0000013C9D09F000-memory.dmp
memory/3208-65-0x0000013C82A10000-0x0000013C82A6C000-memory.dmp
memory/3992-241-0x000001FC398C0000-0x000001FC3992F000-memory.dmp
memory/3992-242-0x000001FC39960000-0x000001FC39972000-memory.dmp
memory/3992-240-0x000001FC398B0000-0x000001FC398BC000-memory.dmp
memory/4676-276-0x000001ACA3340000-0x000001ACA3352000-memory.dmp
memory/4676-274-0x000001ACA1A00000-0x000001ACA1A0C000-memory.dmp
memory/4676-275-0x000001ACBBB90000-0x000001ACBBBFF000-memory.dmp
memory/5080-44-0x0000022456E30000-0x0000022456E9F000-memory.dmp
memory/5172-45-0x0000000000900000-0x000000000112A000-memory.dmp
memory/5172-46-0x0000000003200000-0x0000000003210000-memory.dmp
memory/5172-67-0x00000000031F0000-0x00000000031FC000-memory.dmp
memory/5212-208-0x000001C8B0F30000-0x000001C8B0F9F000-memory.dmp
memory/5212-209-0x000001C8B1010000-0x000001C8B1022000-memory.dmp
memory/5212-207-0x000001C896FC0000-0x000001C896FCC000-memory.dmp
memory/5980-213-0x00000273BBCF0000-0x00000273BBEA3000-memory.dmp
memory/5980-238-0x00000273BBCF0000-0x00000273BBEA3000-memory.dmp
memory/5980-233-0x00000273BBCF0000-0x00000273BBEA3000-memory.dmp
memory/5980-231-0x00000273A2BE0000-0x00000273A2C4F000-memory.dmp
memory/5980-247-0x00000273BBCF0000-0x00000273BBEA3000-memory.dmp
memory/5980-252-0x00000273BBCF0000-0x00000273BBEA3000-memory.dmp
memory/5980-257-0x00000273BBCF0000-0x00000273BBEA3000-memory.dmp
memory/5980-262-0x00000273BBCF0000-0x00000273BBEA3000-memory.dmp
memory/5980-265-0x00000273A2BE0000-0x00000273A2C4F000-memory.dmp
memory/5980-267-0x00000273BBCF0000-0x00000273BBEA3000-memory.dmp
memory/5980-272-0x00000273BBCF0000-0x00000273BBEA3000-memory.dmp
memory/5980-212-0x00000273A2C70000-0x00000273A2C82000-memory.dmp
memory/5980-211-0x00000273A2BE0000-0x00000273A2C4F000-memory.dmp
memory/5980-210-0x00000273A12F0000-0x00000273A12FC000-memory.dmp
memory/5980-281-0x00000273BBCF0000-0x00000273BBEA3000-memory.dmp