28cae9aee7f2f64e246a2da19a183f5ed11017726e4068ba5e63af0944f26fba

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 00:35

Target
2026-06-04_3a568e20d9f71e39287dbf57a539ae9e_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 6.7MB
Sample260604-axqwjsf17x
SHA256 28cae9aee7f2f64e246a2da19a183f5ed11017726e4068ba5e63af0944f26fba
MD5 3a568e20d9f71e39287dbf57a539ae9e
SHA1 d751ebdaff12dc0e503c367fa29acccc974acce3
SHA512 ea54b16f976b9f0ccc79ad4820284f4bb76698c1e0a2da44f5d460f14f509480fd6397fd20ba72911de37a93228b14e6222ae6ecb4023207d12554007e0a9a7f
SSDEEP 98304:JpPTUxZHHBdaA2wa3mXY6AzKZNKu5i61UOVZr6f7j+PI6tDyB:JpbUxZHHjaAC3mXY6AzKZNR8j8I6tM
TLSH
T176669EA9A6BC00D6D4ABC1B9C2865227DB72745517B057CF5AA08AF61F23FE01F7B700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 3248	4444	2026-06-04_3a568e20d9f71e39287dbf57a539ae9e_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	81
PID 3248 wrote to memory of 5048	3248	cmd.exe	83
PID 4444 wrote to memory of 3692	4444	2026-06-04_3a568e20d9f71e39287dbf57a539ae9e_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	84
PID 3692 wrote to memory of 2752	3692	cmd.exe	86
PID 4444 wrote to memory of 2508	4444	2026-06-04_3a568e20d9f71e39287dbf57a539ae9e_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	87
PID 2508 wrote to memory of 3496	2508	cmd.exe	89
PID 4444 wrote to memory of 928	4444	2026-06-04_3a568e20d9f71e39287dbf57a539ae9e_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	90
PID 928 wrote to memory of 3756	928	cmd.exe	92
PID 4444 wrote to memory of 4804	4444	2026-06-04_3a568e20d9f71e39287dbf57a539ae9e_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	93
PID 4804 wrote to memory of 904	4804	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-06-04_3a568e20d9f71e39287dbf57a539ae9e_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_3a568e20d9f71e39287dbf57a539ae9e_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "curl -s https://ipinfo.io/json"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\system32\curl.exe
    curl -s https://ipinfo.io/json
    3⤵
    PID:5048
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "curl -s https://ipinfo.io/json"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\system32\curl.exe
    curl -s https://ipinfo.io/json
    3⤵
    PID:2752
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "curl -s https://ipinfo.io/json"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\system32\curl.exe
    curl -s https://ipinfo.io/json
    3⤵
    PID:3496
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "curl -s https://ipinfo.io/json"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\system32\curl.exe
    curl -s https://ipinfo.io/json
    3⤵
    PID:3756
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C "curl -s https://ipinfo.io/json"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\system32\curl.exe
    curl -s https://ipinfo.io/json
    3⤵
    PID:904