e34e190755eb8af5caa462cf9a193f62ed878e0a17cc4bee962a764c27294433

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 16:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_8b03f5df52e6520b818681e69d84f3ec_glassworm_icedid_mespinoza_njrat_ryuk.exe
Size 65.2MB
Sample260714-t8dvxabw2s
SHA256 e34e190755eb8af5caa462cf9a193f62ed878e0a17cc4bee962a764c27294433
MD5 8b03f5df52e6520b818681e69d84f3ec
SHA1 bdd7cffe5800efcdf34e120ca944458a0b2a1a4c
SHA512 93d1621aed200864afc455091d25647ac0621a4b91255932a8a4c41c578dae01de4dcce2368fb546814c1c5485a3b9d7f8316e966fe0a071c53097df44642846
SSDEEP 196608:ActgISALtjfxK2FeRiJ2id8pDIr5PkpiT7udfhJsB2DGdYrT:QALtTgIdHr5udZ28Bf
TLSH
T1C3E70223A3B510E8D6B6D13885A79607DFB1B84707309ADF619857562F33BF06E7A320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
700	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4184	2026-07-14_8b03f5df52e6520b818681e69d84f3ec_glassworm_icedid_mespinoza_njrat_ryuk.exe
4184	2026-07-14_8b03f5df52e6520b818681e69d84f3ec_glassworm_icedid_mespinoza_njrat_ryuk.exe
3748	2026-07-14_8b03f5df52e6520b818681e69d84f3ec_glassworm_icedid_mespinoza_njrat_ryuk.exe
3748	2026-07-14_8b03f5df52e6520b818681e69d84f3ec_glassworm_icedid_mespinoza_njrat_ryuk.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4716	4184	2026-07-14_8b03f5df52e6520b818681e69d84f3ec_glassworm_icedid_mespinoza_njrat_ryuk.exe	88
PID 4184 wrote to memory of 700	4184	2026-07-14_8b03f5df52e6520b818681e69d84f3ec_glassworm_icedid_mespinoza_njrat_ryuk.exe	89
PID 4716 wrote to memory of 3748	4716	wscript.exe	90
PID 3748 wrote to memory of 4164	3748	2026-07-14_8b03f5df52e6520b818681e69d84f3ec_glassworm_icedid_mespinoza_njrat_ryuk.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-14_8b03f5df52e6520b818681e69d84f3ec_glassworm_icedid_mespinoza_njrat_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_8b03f5df52e6520b818681e69d84f3ec_glassworm_icedid_mespinoza_njrat_ryuk.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\system32\wscript.exe
  wscript.exe C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Users\Admin\AppData\Local\Temp\2026-07-14_8b03f5df52e6520b818681e69d84f3ec_glassworm_icedid_mespinoza_njrat_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_8b03f5df52e6520b818681e69d84f3ec_glassworm_icedid_mespinoza_njrat_ryuk.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /s /c "rd /s /q "C:\Users\Admin\AppData\Local\Exastealer""
      4⤵
      PID:4164
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Exastealer\jre.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Exastealer' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EXASTE~1.JAR

Path C:\Users\Admin\AppData\Local\Exastealer\EXASTE~1.JAR
Size 5.2MB
SHA256 e720ad3cd9cb5236eeac396f369d89f95f0aa7d87a1e7404b04a55c7998023da
MD5 1d57813c2c3835e6db1add48c710231c
SHA1 b4d37cbe7192b0bdef6da27e55316ddd90b2c438
SHA512 fe70559d3dc148c9b13641779b8141352152f5faf605f9a2befc02efba7640a3a4e472f6663529180815f3d82e13ee75932f3d2ff3709066ff5a3e7ba24cde41
SSDEEP 98304:Aq3idHVn33wq5w0iXA18v+/E7NiB8i+BNOJhaJFPExl8i3tmGqq9EclPsSM5j:xiFh3foA18v+c08JOSFwvtmzq7mSq
TLSH
T154460233D5DEC829EE7745F391C25683A43F55ADAC0B607F12E05D828AB294B43A1BF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jre.zip

Path C:\Users\Admin\AppData\Local\Exastealer\jre.zip
Size 30.1MB
SHA256 b0805476e9931a90dd9b902a2400da2f1c84e9e839054a3894f8dea10b544270
MD5 6e394b689462a5a2d4dbd3f6c16c75af
SHA1 66d43cfd56294f5a949bf41f981641e98bddc679
SHA512 31b4131d2fe38f5356222077a40e379141bc39443900d5289d0cce9a62d4ea5664a1f3dfe7a2457ed1d30c45c6d779fbd6fd603b2ce49634053b059694702456
SSDEEP 786432:0y7+qDFpJim/2Qj18dQk3GcBhAQiJ6R/xGjmvQlqgpLTQgD:0ieQjCdQCGcBCaR/xjv239
TLSH
T17267335CC92ED9CAB223F13890A6D3C800C55CBB97D14E38FB2191D91F9E1CD65A6D8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launch_hidden.vbs

Path C:\Users\Admin\AppData\Local\Temp\launch_hidden.vbs
Size 290B
SHA256 3acf3e4806ab30a3295ab591e30e757dae35eee1f7d377b17ec4269c2fb4e724
MD5 fca01411160de1ab66dbe7eb04dc1a36
SHA1 9a073620db67af91014755e38dd4cdb59e23814f
SHA512 4b795e8a5f1893033e5c6053465b4b1295a56b94844968139ab7665378b998878df20f0c6e8568caf3e56466c59f7f97e1f6ca10c8464ead58a9bf6ca4310986
TLSH
T1F2D02B51DC7EC9D404DEE0B287F11918CBD6D10B0577E8344730C4952B5683652F2233
MD5 SHA1 SHA512 TLSH

Submit Download