cdc5700482fa438b1006264025369794d723b10ce3a54cb081dceddf7d647fd4

General

Target
2026-07-02_29c993f1e6681d9a2053e9cccf333635_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe
Size 9.8MB
Sample260702-fm5vlsby5x
SHA256 cdc5700482fa438b1006264025369794d723b10ce3a54cb081dceddf7d647fd4
MD5 29c993f1e6681d9a2053e9cccf333635
SHA1 6a738f58545f8f04c2889bbeab0842935bd54730
SHA512 805db8f0f877e75739f4533dcbc5fc096ad4a333c65b1cc07d32f7aa5c446cf6c9ab957d1b0035117494cd7de9660875ec79b79c5e3f75405d6d1714e6c96534
SSDEEP 196608:mwUdojmhCVnrkpDUk1cSSnkC4cQYWOS7BHqwDIh:mIahMrkpbSnkC4cQYWOS7BnI
TLSH
T141A69D12AE642C9DC122D632E7518A090DF43595879559DFC1C82BEF0E2EED3AB3C63D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4f4-10.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Executes dropped EXE 1 IoCs

pid	Process
5640	Fusion.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
6084	2026-07-02_29c993f1e6681d9a2053e9cccf333635_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe
5640	Fusion.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{1E480A20-34F9-4446-AFC2-E51ED8000828}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{C74F009B-CE60-49AE-8486-DC3839B02E65}	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2588	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6084 wrote to memory of 6108	6084	2026-07-02_29c993f1e6681d9a2053e9cccf333635_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe	88
PID 6108 wrote to memory of 5640	6108	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-02_29c993f1e6681d9a2053e9cccf333635_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_29c993f1e6681d9a2053e9cccf333635_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\helper.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6108
- - C:\Users\Admin\AppData\Local\fusion\Fusion.exe
    "C:\Users\Admin\AppData\Local\fusion\Fusion.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:5640

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:1772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:6116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fusion.lnk

Path C:\Users\Admin\AppData\Local\Temp\Fusion.lnk
Size 960B
SHA256 52c94e4a467fdd5d0dece3c9aa6e1a3c95ad39480ef53d266947ba33c2ae7c43
MD5 958e56658515b1bad7b5a62f4850e9f2
SHA1 5e027abe58e276a38095b7bd99aca5bdaf6825c1
SHA512 dc1b9d98ffce30ae0f5b9f2abef90b17a7aedb2d94e9d4ad628152144db412ec30540f75f45559e1730b921a1dfae8bd7ebda541fed42bb6ab2620ffcebdbb9e
TLSH
T10111FF058CA60220D7F6CB74C2DE6315C6B27CE7DF542E19008891487821A11B9F6F3F
MD5 SHA1 SHA512 TLSH

Submit Download

helper.bat

Path C:\Users\Admin\AppData\Local\Temp\helper.bat
Size 361B
SHA256 62bac7f67db78ce13fdd076cf61cdea64fc505309dc01f84e41623e1f068a7ee
MD5 da30456ef273e9831eb8b99bde39acf8
SHA1 4137a085215b12cc023f5de82aa4723e1fa4bb5c
SHA512 3bf4a4320170e46b175639fdbe61c130bd2e85357c219d91d11b6328517a6083eba2bc477f3be271d059dd39cd6140fa252cbd669a03841f1b8580cf770de276
TLSH
T1CFE0206E07874789591AA855406D380ED067F0F65A80355753314D2E31A700AE4FA391
MD5 SHA1 SHA512 TLSH

Submit Download

Fusion.exe

Path C:\Users\Admin\AppData\Local\fusion\Fusion.exe
Size 9.8MB
SHA256 cdc5700482fa438b1006264025369794d723b10ce3a54cb081dceddf7d647fd4
MD5 29c993f1e6681d9a2053e9cccf333635
SHA1 6a738f58545f8f04c2889bbeab0842935bd54730
SHA512 805db8f0f877e75739f4533dcbc5fc096ad4a333c65b1cc07d32f7aa5c446cf6c9ab957d1b0035117494cd7de9660875ec79b79c5e3f75405d6d1714e6c96534
SSDEEP 196608:mwUdojmhCVnrkpDUk1cSSnkC4cQYWOS7BHqwDIh:mIahMrkpbSnkC4cQYWOS7BnI
TLSH
T141A69D12AE642C9DC122D632E7518A090DF43595879559DFC1C82BEF0E2EED3AB3C63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2588-25-0x00000144CA700000-0x00000144CA95F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads