Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/05/2026, 03:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-23_ca131cab6047b6d2284aee20d7000710_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-23_ca131cab6047b6d2284aee20d7000710_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win11-20260513-en
3 signatures
150 seconds
General
- Target 2026-05-23_ca131cab6047b6d2284aee20d7000710_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
- Size 1.2MB
- Sample260523-ebf7faey9t
- SHA256 257dc3dd66624de5cd88d3ad8c77abf3ef504c428df071baf8ceff4130dec3e0
- MD5 ca131cab6047b6d2284aee20d7000710
- SHA1 96457461496eef9b4a840d175b3f69f862f6a2e3
- SHA512 c5f0b9624f7db805da2565bc663c332db425f0211d59c62551256ec4f146eab2ae0795d8eaab2b027bac6ce65737bb4075de6d2409da8a2346488963d0e466b2
- SSDEEP 24576:yGtlq+BKr3zC9S3L1/f9VYY0rR7n6BZiA:yGtlq+BDG/fn8r5n6BZt
- TLSH T104457C45A3B501E8E5B79538CEA24616EBB27C151730DBDF23A0564F1F73AD0AE3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-05-23_ca131cab6047b6d2284aee20d7000710_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeBackupPrivilege 3468 2026-05-23_ca131cab6047b6d2284aee20d7000710_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe Token: SeRestorePrivilege 3468 2026-05-23_ca131cab6047b6d2284aee20d7000710_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe Token: SeManageVolumePrivilege 3468 2026-05-23_ca131cab6047b6d2284aee20d7000710_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe Token: SeSecurityPrivilege 3468 2026-05-23_ca131cab6047b6d2284aee20d7000710_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe Token: 35 3468 2026-05-23_ca131cab6047b6d2284aee20d7000710_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3468 2026-05-23_ca131cab6047b6d2284aee20d7000710_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe 3468 2026-05-23_ca131cab6047b6d2284aee20d7000710_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_ca131cab6047b6d2284aee20d7000710_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_ca131cab6047b6d2284aee20d7000710_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3468