308a521f2cdf8330c44aa2c115efd995ba51943cbc70f904204cd8e9255cb1ae

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/05/2026, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-25_99afb3aedf268b87c8770f25edff8745_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 1.7MB
Sample260525-mncnsagy6y
SHA256 308a521f2cdf8330c44aa2c115efd995ba51943cbc70f904204cd8e9255cb1ae
MD5 99afb3aedf268b87c8770f25edff8745
SHA1 fdd7313ee863def7174e49bbc2d7cd075d70d4a1
SHA512 405b090ccfa761b9521ee195d31bd7592597a13a25fd06ba9cf2895f7426f84ceceb01efb69a4e6ec0c59bd244cf31a4f2ae90a29003a2ab15f919dc5930fbda
SSDEEP 24576:2vunPSlR7ig08WRUZLKMRbEw9mZZx/V6u2OyhjAFKoSg5KzG:sMPSlR7j08DL1wZZx7UjUvX
TLSH
T1E4857D57A2F901F5E177C07DC5535A56FAB2B81903609BDB03E0AAB61F237E06A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence

Malware Config

Signatures

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BTG\Parameters\ServiceDll = "C:\\Windows\\wpcipz.inf"	2026-05-25_99afb3aedf268b87c8770f25edff8745_glassworm_icedid_luca-stealer_njrat_stealc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\wpcipz.inf	2026-05-25_99afb3aedf268b87c8770f25edff8745_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2848	2660	2026-05-25_99afb3aedf268b87c8770f25edff8745_glassworm_icedid_luca-stealer_njrat_stealc.exe	82
PID 2848 wrote to memory of 1152	2848	cmd.exe	83
PID 2660 wrote to memory of 1400	2660	2026-05-25_99afb3aedf268b87c8770f25edff8745_glassworm_icedid_luca-stealer_njrat_stealc.exe	84
PID 1400 wrote to memory of 3480	1400	cmd.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-25_99afb3aedf268b87c8770f25edff8745_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-25_99afb3aedf268b87c8770f25edff8745_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Server Software Component: Terminal Services DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -addstore ROOT .\cer3DCF.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\system32\certutil.exe
    certutil -addstore ROOT .\cer3DCF.tmp
    3⤵
    PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -addstore CA .\cer3DD0.tmp
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\system32\certutil.exe
    certutil -addstore CA .\cer3DD0.tmp
    3⤵
    PID:3480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k EventOperations
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cer3DCF.tmp

Path C:\Users\Admin\AppData\Local\Temp\cer3DCF.tmp
Size 1001B
SHA256 42436beabdfb215ea25ba26435c06d0e1a0a7e1bf711d578f2dc2d58069e6580
MD5 58a13f721fa2d3e482de9e7619921df0
SHA1 300cc94e8d3f5a184c448fcd9e320833d56cc652
SHA512 2fa857779b9045bc6c1ae0af48b78f2ef3a65035c96cfd575ee233c80da3ce57a43ec0207b3ae7070f592362a4cb10f6f092177491d3708d10c6905dbfdb805f
TLSH
T1651102ADCE599D0C6C97F6C1D5FAF75748141092A9163C7F244E3022D621B2341EE0DA
MD5 SHA1 SHA512 TLSH

Submit Download

cer3DD0.tmp

Path C:\Users\Admin\AppData\Local\Temp\cer3DD0.tmp
Size 998B
SHA256 ad107a75c9eb06d0d0fad1ea871f3883fbc41cf4764c45abecbec5f54caeaf3c
MD5 9dac29e2c0b6edc0b043e02f1843103c
SHA1 e660468ab6a009ba142b268c0d9dec824b7112e5
SHA512 d60a069273695f7187fbb0e4553960c43ddf22dbc997dc8769bf433b5a0e08592298dd2da5c09dc0825bde413b5329fa50ef8ee414493a24fcc75131c8e41bb0
TLSH
T16E1132FACF261C1C689AFBC2C1A8F65699384843A4C22CAF3C0F31719D047226DB84D5
MD5 SHA1 SHA512 TLSH