Analysis
- max time kernel
150s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 22:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
- Size 59.7MB
- Sample260707-2rjc3ags4k
- SHA256 d634f2acf17298fdccb21468296f6a9905756270ca8458085515c95aad1548f5
- MD5 b095716f4830d285031a3d34ec48199f
- SHA1 76d778ea87c2752416473cedf5f66f4dfbee58f3
- SHA512 b951325a01d25929625b105461983a88b4276d8765addea3f787dd2261788cab56807e792ec67ad52646818654b86567fe007657c46b54472d62b0c5f132b47f
- SSDEEP 786432:AaW1JhQlR7TtKeagPV1pmjyktYF9hnPBKq9BopQa2UoEFtr1k:AaywR7hKG+tWZJ9013k
- TLSH T186D7CF0773E501A5E177D1388AAB9203EBB3B8161734D7DB32AC03652F67AE05E7A750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 1888 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe - Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1888 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe 1888 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe 1888 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe 1888 2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_b095716f4830d285031a3d34ec48199f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1888
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\.cache\pkg\cd9fb878c2e73711e37cf82e60526509a3df361148396dcb3a95b053b582880c\koffi\build\koffi\win32_x64\koffi.node
- Size 1.5MB
- SHA256 cd9fb878c2e73711e37cf82e60526509a3df361148396dcb3a95b053b582880c
- MD5 9b19c3d4529fd231ac217c86192beafb
- SHA1 d258c7ec9cbe51648f9eb2ca5d4e20fcb92c6120
- SHA512 a747595abd8647e41474f36c564b51ec1d3a7eb2afa9844c4b26992e2a5d365fdc37ee827944ebc029b5ea88649eb62b3ead7cf9342b192db655b7e60cdcdd64
- SSDEEP 12288:nzlZYkFrYoBU7A4WONVMhFaBpfmrytFNXrfKh4ICXoEuBN2vo2Jb0afMhpCcSBU3:z7NONVSFsOOt3rKi7oEur2JTk4ytjt7
- TLSH T1AD752715F75981E9C0AED2344F72C716B964E811437E698BD29DFEEC2E025BD903A2F0
- MD5 SHA1 SHA512 SSDEEP TLSH