ded9ecd93c67469de59f322afcc31eede9f82c7f99a146c70da9b8035e2ea786

Analysis

max time kernel
150s
max time network
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_37edb801a28b70652e63f778982f9e95_glassworm_icedid_mespinoza_njrat_ryuk.exe
Size 71.6MB
Sample260714-negrtabv2n
SHA256 ded9ecd93c67469de59f322afcc31eede9f82c7f99a146c70da9b8035e2ea786
MD5 37edb801a28b70652e63f778982f9e95
SHA1 6bd69d652d75910030bcb254107d94651046a6a3
SHA512 23e521d889c1fe54a6df697aac26a3a5908b99e3378eeace55c5de998ada970f5a68c71bfd3b312aacfbcf5be685e1b8b7bd42aace32c0d5537ab2a2074459a1
SSDEEP 196608:ActgISALtjfxK2FeRiJ2id8pDIr5PkpiT7udfhJsB2DGdYrT6:QALtTgIdHr5udZ28Bf6
TLSH
T159F70233A3B514E4D676D13885A79607EFB1B84707309ADF619857922F33AF06E7A320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2388	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5760	2026-07-14_37edb801a28b70652e63f778982f9e95_glassworm_icedid_mespinoza_njrat_ryuk.exe
5760	2026-07-14_37edb801a28b70652e63f778982f9e95_glassworm_icedid_mespinoza_njrat_ryuk.exe
5688	2026-07-14_37edb801a28b70652e63f778982f9e95_glassworm_icedid_mespinoza_njrat_ryuk.exe
5688	2026-07-14_37edb801a28b70652e63f778982f9e95_glassworm_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5760 wrote to memory of 1168	5760	2026-07-14_37edb801a28b70652e63f778982f9e95_glassworm_icedid_mespinoza_njrat_ryuk.exe	88
PID 5760 wrote to memory of 2388	5760	2026-07-14_37edb801a28b70652e63f778982f9e95_glassworm_icedid_mespinoza_njrat_ryuk.exe	89
PID 1168 wrote to memory of 5688	1168	wscript.exe	90
PID 5688 wrote to memory of 1088	5688	2026-07-14_37edb801a28b70652e63f778982f9e95_glassworm_icedid_mespinoza_njrat_ryuk.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-14_37edb801a28b70652e63f778982f9e95_glassworm_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_37edb801a28b70652e63f778982f9e95_glassworm_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5760
- C:\Windows\system32\wscript.exe
  wscript.exe C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_37edb801a28b70652e63f778982f9e95_glassworm_icedid_mespinoza_njrat_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_37edb801a28b70652e63f778982f9e95_glassworm_icedid_mespinoza_njrat_ryuk.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /s /c "rd /s /q "C:\Users\Admin\AppData\Local\Exastealer""
      4⤵
      PID:1088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Exastealer\jre.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Exastealer' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EXASTE~1.JAR

Path C:\Users\Admin\AppData\Local\Exastealer\EXASTE~1.JAR
Size 10.0MB
SHA256 4d2b1a8aa3fca01cc83341c1143169bfbf48dd3cb541f9bad55a3af5cb0ff303
MD5 c5ed741d94a06c2675e5de46a158e621
SHA1 08002f31561af26e82ac2a728ce90c4e8c4449f1
SHA512 d28df30b6788773da954fde3896255b8f0747e5267eddc34f46caae1af9834d6f55131382c0e7329707a1761aaaae52b5878ed5f13b7cb363a8e0c401bab87e0
SSDEEP 196608:9iFh3foA18v+c08JOSFwvtmzq7mSXwAm11vn/QKpRzE6w9jfFDF:IFhPt1UaSWtxmSZs1A2RDw9j9p
TLSH
T1C6B60237E4D9C826D93792B291C25673E43F52DDE40B206FA5F40E83A9F358A93127E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jre.zip

Path C:\Users\Admin\AppData\Local\Exastealer\jre.zip
Size 30.1MB
SHA256 b0805476e9931a90dd9b902a2400da2f1c84e9e839054a3894f8dea10b544270
MD5 6e394b689462a5a2d4dbd3f6c16c75af
SHA1 66d43cfd56294f5a949bf41f981641e98bddc679
SHA512 31b4131d2fe38f5356222077a40e379141bc39443900d5289d0cce9a62d4ea5664a1f3dfe7a2457ed1d30c45c6d779fbd6fd603b2ce49634053b059694702456
SSDEEP 786432:0y7+qDFpJim/2Qj18dQk3GcBhAQiJ6R/xGjmvQlqgpLTQgD:0ieQjCdQCGcBCaR/xjv239
TLSH
T17267335CC92ED9CAB223F13890A6D3C800C55CBB97D14E38FB2191D91F9E1CD65A6D8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launch_hidden.vbs

Path C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs
Size 290B
SHA256 718867d37998f0310ccc29545e672168f10b789c721149075fd4311c02d58e1c
MD5 ed20278d1112af4dd719c39ae81a44ec
SHA1 4bf4ecc569b439194034c6ff23a9b3c31682ed8e
SHA512 522997518f2d83ecbaf721b1a93c68856e2a96c172c60765af96290ff2576c21ef728880b2aa5450231b1906feb00e863e2a9ab8253e5f344b8cd774cf26b423
TLSH
T136D02B41DC6ECB94148DE0E2C7F13A08C7F6D50B1537AD315B20C8952B558225AF2333
MD5 SHA1 SHA512 TLSH

Submit Download