Overview

overview

8

Static

static

1

2026-05-19...at.exe

windows10-2004-x64

1

2026-05-19...at.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    19/05/2026, 23:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-19_b4b107e8908bf3195c09eea40316d713_glassworm_icedid_luca-stealer_njrat.exe
  • Size 17.1MB
  • Sample260519-3apdesdw21
  • SHA256 13094fa63e8ec29f00a1e289b9402b1e4a37767ee7b9e0ef293fd37b06d59de9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceprivilege_escalationspywaretrojan

Malware Config

Signatures

  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Drops file in System32 directory 17 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Embeds OpenSSL 2 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 42 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 50 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-19_b4b107e8908bf3195c09eea40316d713_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-19_b4b107e8908bf3195c09eea40316d713_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Manipulates Digital Signatures
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:4376
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:612
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{18787328-4f68-024d-ab67-1a7f83a64b21}\LynxWDM.Inf" "9" "4cb92634b" "0000000000000148" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files\Lynx Studio Technology\V2 Driver"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3344
  • C:\Program Files\Lynx Studio Technology\LynxTrayVolume.exe
    "C:\Program Files\Lynx Studio Technology\LynxTrayVolume.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:4788
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D8
    1⤵
      PID:4880

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          HiloRemote.exe
          • Path C:\Program Files\Lynx Studio Technology\V2 Driver\HiloRemote.exe
          • Size 7.7MB
          • SHA256 254da5fdea5efae1023230310e6ab71e97e894f4356fccf29779ef72138b3345
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LKBH32.Dll
          • Path C:\Program Files\Lynx Studio Technology\V2 Driver\LKBH32.Dll
          • Size 83KB
          • SHA256 807df15abe7c4a68273267b79b5775a6cdfee70189112e298def5b193651580c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LMixerOptions.exe
          • Path C:\Program Files\Lynx Studio Technology\V2 Driver\LMixerOptions.exe
          • Size 150KB
          • SHA256 737c9e48e62caded2704ae58e9edec667e60f12af6efae4f02be5eb3390bc0a8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LynxDemo.exe
          • Path C:\Program Files\Lynx Studio Technology\V2 Driver\LynxDemo.exe
          • Size 494KB
          • SHA256 4e934b04c2a944649a36573858defa26586473eb952e0b5303f9af26902646d8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LynxMixer.exe
          • Path C:\Program Files\Lynx Studio Technology\V2 Driver\LynxMixer.exe
          • Size 4.1MB
          • SHA256 21ddb7e3b61bdc865581b68d1cdfa72ca63a1010725153915af41cd2cb88dc34
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LynxTrayVolume.exe
          • Path C:\Program Files\Lynx Studio Technology\V2 Driver\LynxTrayVolume.exe
          • Size 392KB
          • SHA256 e452a76cb1b24cb35b9fceea1cfc9356fee434c5cf87e8ddd0058df479b1c694
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LynxV264.dll
          • Path C:\Program Files\Lynx Studio Technology\V2 Driver\LynxV264.dll
          • Size 199KB
          • SHA256 2dc4c7335dd020b4454880fc585ded84567976469e93e69513155a23339b37a6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LynxV264.sys
          • Path C:\Program Files\Lynx Studio Technology\V2 Driver\LynxV264.sys
          • Size 749KB
          • SHA256 54cc57a34aed3d47eb72c6c87cdef9d6ef848d4056ce3814320eea2f1c29e417
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LynxWDM.cat
          • Path C:\Program Files\Lynx Studio Technology\V2 Driver\LynxWDM.cat
          • Size 12KB
          • SHA256 31e7a11723a26198d05c0a67859a9cf574de2f837d89204518c93a2567d6bc4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LynxWDM.dll
          • Path C:\Program Files\Lynx Studio Technology\V2 Driver\LynxWDM.dll
          • Size 167KB
          • SHA256 c5d02c95172826ea492d3fecbd8b73aee6b4ff69c6df4c42008ab9f224d97762
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          LynxWDM.inf
          • Path C:\Program Files\Lynx Studio Technology\V2 Driver\LynxWDM.inf
          • Size 84KB
          • SHA256 cd6896f269eaa7c38099afa7083bb2152393692bc1d9608cccadf4513a20e289
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MesaRemote.exe
          • Path C:\Program Files\Lynx Studio Technology\V2 Driver\MesaRemote.exe
          • Size 4.5MB
          • SHA256 24c3511a973064d85bd0f9f4b841863d3311b0488e333c0c541a72309ac6a6b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NControl.exe
          • Path C:\Program Files\Lynx Studio Technology\V2 Driver\NControl.exe
          • Size 10.3MB
          • SHA256 876b22917833f892d0f88d70f0c375bf92e36bd9d651ae88382588f1e536bdc8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Register.exe
          • Path C:\Program Files\Lynx Studio Technology\V2 Driver\Register.exe
          • Size 50KB
          • SHA256 f1fbab655beef5c3fa0050e15591aa8d4cd35abe5350815221026cff7a321846
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          V2DriverReleaseNotes.html
          • Path C:\Program Files\Lynx Studio Technology\V2 Driver\V2DriverReleaseNotes.html
          • Size 101KB
          • SHA256 7cf99aea327a8063d8f737c38043f7911a508ad7acd93ddd31b5b8e12e762ec0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          V2Uninstall.exe
          • Path C:\Program Files\Lynx Studio Technology\V2 Driver\V2Uninstall.exe
          • Size 453KB
          • SHA256 406043c8e10572a245e758df4301ef98c79ecb5c00c53b4e48f3f7fd15ac6441
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          HILOREMOTE.EX$
          • Path C:\Users\Admin\AppData\Local\Temp\HILOREMOTE.EX$
          • Size 4.3MB
          • SHA256 cad63af3bb4fd530c764942e0edcc852271178cf24f59252fd0b96230591b46e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dberr.txt
          • Path C:\Windows\System32\CatRoot2\dberr.txt
          • Size 107KB
          • SHA256 7ee5e963a94117df0980aedb8357070c6d1532a9c786bf58f9013a495518ca9b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download