48d886c5244802e11c3423f1a8b8cf551a558bf742a69142f9b295e68bfdfa5a

General

Target
2026-07-18_23deadacc3cf9a4b06ff7763c4331eda_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe
Size 9.8MB
Sample260718-nv1jvsdv8s
SHA256 48d886c5244802e11c3423f1a8b8cf551a558bf742a69142f9b295e68bfdfa5a
MD5 23deadacc3cf9a4b06ff7763c4331eda
SHA1 157d71cd29e1eab4eb14022e32b01f384b24cb33
SHA512 bab3d5f42d11e77ed8b296aa4a3d8b59d610348b2046a4f5e63a24080cd1a3d1940ec8096618c594ffc3a1618bcfb0bd1fa0df558358753f35026370b1d809a8
SSDEEP 196608:X0998gQIuFPo1LNUYD0EzsEaZXrQyPTNG:X+PSPo1+YD0EzsEaZXrQyR
TLSH
T165A69D12AE542C8CC122D632D7518A190DF435D587A919DF81C82BEF0E2EED7AB3C63D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c535-10.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Executes dropped EXE 2 IoCs

pid	Process
2908	Fusion.exe
1076	Fusion.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2664	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2848	2026-07-18_23deadacc3cf9a4b06ff7763c4331eda_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe
2908	Fusion.exe
2908	Fusion.exe
1076	Fusion.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2836	cmd.exe
2056	cmd.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
1900	timeout.exe
4832	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{4A8FC40A-5797-480F-8C20-3C70858F715F}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{68BFB32F-EAC9-4137-9E9C-77128B2C90C7}	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	tasklist.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3012	OpenWith.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2836	2848	2026-07-18_23deadacc3cf9a4b06ff7763c4331eda_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe	89
PID 2836 wrote to memory of 2908	2836	cmd.exe	91
PID 2908 wrote to memory of 2056	2908	Fusion.exe	95
PID 2056 wrote to memory of 5236	2056	cmd.exe	99
PID 2056 wrote to memory of 2664	2056	cmd.exe	102
PID 2056 wrote to memory of 4936	2056	cmd.exe	103
PID 2056 wrote to memory of 1900	2056	cmd.exe	105
PID 2056 wrote to memory of 1076	2056	cmd.exe	106
PID 2056 wrote to memory of 4832	2056	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-18_23deadacc3cf9a4b06ff7763c4331eda_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_23deadacc3cf9a4b06ff7763c4331eda_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\helper.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Users\Admin\AppData\Local\fusion\Fusion.exe
    "C:\Users\Admin\AppData\Local\fusion\Fusion.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\fusion\updater.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2056
    - - C:\Windows\system32\mode.com
        
        mode con: cols=38 lines=18
        5⤵
        
        PID:5236
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "PID eq 2908"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2664
    - - C:\Windows\system32\find.exe
        
        find "2908"
        5⤵
        
        PID:4936
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 2 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1900
    - - C:\Users\Admin\AppData\Local\fusion\Fusion.exe
        
        "Fusion.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1076
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 2 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4832

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:1700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fusion.lnk

Path C:\Users\Admin\AppData\Local\Temp\Fusion.lnk
Size 956B
SHA256 9f391e05523839a28a6b2695787e9ccada1a925e18f6b364b5cf4da3d0577b2d
MD5 0a7f41d853de8fd7d0dc0a1fbee5f3c9
SHA1 eaf7f62c3d5aaf088783751d83d4415aa48aa8b2
SHA512 4f2142f7f493fe17b338695703e355740743dbfa66f6b37141f75613d0673f989a19ee4e4c4b9c19bdd756630193247dd2f1b1f656996185ca3effda8e48cf71
TLSH
T1F51122118DA21220D7F5CBB1C2DF6316C7B67CA7DF642E18400890483821611A9FAF3B
MD5 SHA1 SHA512 TLSH

Submit Download

helper.bat

Path C:\Users\Admin\AppData\Local\Temp\helper.bat
Size 361B
SHA256 06fef6b3b2a109367b06f29addaf4424c3f7543356fdc51be8f081dfbeca1e3a
MD5 50639b6f9af0fb9b652ed8e871527a1c
SHA1 97e554c7d0c5f723a0d816f749cd6dbf93852fcc
SHA512 1b8ac134d33fe925502feded971dcb86fddd46953de55c26dd4ddb9c8c9745e36f147d11082feff5cb643b06764ee7537629d613cdd6ffb54756ba95318f43fd
TLSH
T1D9E02031078F45475C06941544552A59C1BBF0DB7F4075D36334489E3A96C3E76F5A90
MD5 SHA1 SHA512 TLSH

Submit Download

Fusion.exe

Path C:\Users\Admin\AppData\Local\fusion\Fusion.exe
Size 9.8MB
SHA256 48d886c5244802e11c3423f1a8b8cf551a558bf742a69142f9b295e68bfdfa5a
MD5 23deadacc3cf9a4b06ff7763c4331eda
SHA1 157d71cd29e1eab4eb14022e32b01f384b24cb33
SHA512 bab3d5f42d11e77ed8b296aa4a3d8b59d610348b2046a4f5e63a24080cd1a3d1940ec8096618c594ffc3a1618bcfb0bd1fa0df558358753f35026370b1d809a8
SSDEEP 196608:X0998gQIuFPo1LNUYD0EzsEaZXrQyPTNG:X+PSPo1+YD0EzsEaZXrQyR
TLSH
T165A69D12AE542C8CC122D632D7518A190DF435D587A919DF81C82BEF0E2EED7AB3C63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.bat

Path C:\Users\Admin\AppData\Local\fusion\updater.bat
Size 1KB
SHA256 1897d520c3464e544b24a03fe2af0d6768a033f2b34d88b58b343aa24b848d78
MD5 59ab611e60925d3307dbffdf1febd128
SHA1 8b679fec9c6b823d9b24470eff94a3c2fa7e6746
SHA512 93632fbd397f0ce2c302d6168b2a273d070f448a1845f8373fd5820e4225408a248b519b883875e9e4e5227624d4152ee3b235c14ddf3d5a7bd4868a2f4cf33e
TLSH
T14F31F05A7026A5A481FC4CA41EB52422F5A654DF8A262DACB06FC0354F253C63FFE0DD
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1700-26-0x0000017AD1BE0000-0x0000017AD2260000-memory.dmp

Download

memory/1960-35-0x0000022306410000-0x0000022306A90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads