Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
29/06/2026, 16:18
General
- Target 2026-06-26_4af2e09ef3fd48085a474227a05dc265_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 10.5MB
- Sample260629-tr2weahw4x
- SHA256 3d7dc783279e586e90b5a9580f9858e85646e83aa412fc5b2d88e7cf248e6daa
Score
10/10
Malware Config
Extracted
Family
-
xworm
Version
-
XWorm V5.6
C2
-
143.14.44.171:54320
Attributes
-
install_file
USB.exe
-
localhost
127.0.0.1
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 12 IoCs
- Detects Pyinstaller 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_4af2e09ef3fd48085a474227a05dc265_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_4af2e09ef3fd48085a474227a05dc265_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_4af2e09ef3fd48085a474227a05dc265_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_4af2e09ef3fd48085a474227a05dc265_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e911_run_1782749905.exeC:\Users\Admin\AppData\Local\Temp\e911_run_1782749905.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e911_run_1782749905.exeC:\Users\Admin\AppData\Local\Temp\e911_run_1782749905.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e911_run_1782749908.exeC:\Users\Admin\AppData\Local\Temp\e911_run_1782749908.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
base_library.zip
VCRUNTIME140.dll
_bz2.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
base_library.zip
libcrypto-1_1.dll
python310.dll
select.pyd
unicodedata.pyd
e911_run_1782749905.exe
e911_run_1782749908.exe
memory/2892-67-0x00007FFFED74F000-0x00007FFFED750000-memory.dmp
memory/2892-68-0x0000000000D80000-0x0000000000D94000-memory.dmp
memory/2892-69-0x00007FFFED5C0000-0x00007FFFEDF64000-memory.dmp
memory/2892-70-0x00007FFFED5C0000-0x00007FFFEDF64000-memory.dmp
memory/2892-71-0x00007FFFED5C0000-0x00007FFFEDF64000-memory.dmp
memory/2892-72-0x00007FFFED5C0000-0x00007FFFEDF64000-memory.dmp
memory/2892-73-0x00007FFFED5C0000-0x00007FFFEDF64000-memory.dmp