Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
23/05/2026, 00:00
General
- Target 2026-05-22_f089b61aabea687709e1128a6258a3da_glassworm_icedid_luca-stealer_njrat.exe
- Size 2.1MB
- Sample260523-aahxesbt2z
- SHA256 7c36e0b9268defbea30674a6f8590cb53b92699bafbe7d231fa374bf0b41c35b
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Detect binaries embedding considerable number of MFA browser extension IDs. 8 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 8 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 8 IoCs
- Detects command variations typically used by ransomware 8 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 8 IoCs
- Detects executables containing artifacts associated with disabling Widnows Defender 8 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 8 IoCs
- Detects executables referencing many Password Manager software clients. Observed in infostealers 8 IoCs
- Detects executables referencing many email and collaboration clients. Observed in information steale 8 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_f089b61aabea687709e1128a6258a3da_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_f089b61aabea687709e1128a6258a3da_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\output_yrxkcf5o.js"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" --headless powershell.exe -w H -NOp -noNI -Command "$x=[scriptblock]::Create($env:o4O3v6d4am);&$x"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -w H -NOp -noNI -Command $x=[scriptblock]::Create($env:o4O3v6d4am);&$x5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Badlisted process makes network request
- Registers new Windows logon scripts automatically executed at logon.
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
- Checks processor information in registry
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_am5n5zf3.aa0.ps1
output_yrxkcf5o.js
memory/1124-5-0x0000017237F50000-0x0000017237F72000-memory.dmp
memory/1124-12-0x0000017253A80000-0x0000017253ADE000-memory.dmp
memory/1124-13-0x0000017253AE0000-0x0000017253AF4000-memory.dmp
memory/5216-22-0x0000000140000000-0x000000014057E000-memory.dmp
memory/5216-21-0x0000000140000000-0x000000014057E000-memory.dmp
memory/5216-20-0x0000000140000000-0x000000014057E000-memory.dmp
memory/5216-19-0x0000000140000000-0x000000014057E000-memory.dmp
memory/5216-18-0x0000000140000000-0x000000014057E000-memory.dmp
memory/5216-23-0x0000000140000000-0x000000014057E000-memory.dmp
memory/5216-25-0x0000000140000000-0x000000014057E000-memory.dmp
memory/5216-27-0x0000000140000000-0x000000014057E000-memory.dmp