d645a2f4d04510b330fdb43dd46cd059904c0a22e8f336e8778044bad5297cfc

General

Target
2026-07-18_21a725ab9c6cfdcba2b63da1f9f3c91a_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe
Size 9.8MB
Sample260718-nwwmasdw21
SHA256 d645a2f4d04510b330fdb43dd46cd059904c0a22e8f336e8778044bad5297cfc
MD5 21a725ab9c6cfdcba2b63da1f9f3c91a
SHA1 26e47828fa4b7d8403cf70131adf007644d98f25
SHA512 98377157f8fe45daa6948ff77e5729189f30bb85a38a9ad58ab6dc3ee18b7b549b01e56c2ad0568a3d2fbc7ca5e6f9b33dcbf2f6d248d38092b00355f63333da
SSDEEP 98304:QvuVDi1tFeE7y/NMZoC/I/EEvZqKG2BTLO4IqVxpHar5oZ/+/U2VBExZF8R05ZU:XV03+/aiC/SEGBBTLO4bVxpHw5IuEx8
TLSH
T18FA69D12AE542C8DC066D632D7508A190DF435D5879919DFC1CC2AEE0E2EEE7AB3C63D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024591-8.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	2026-07-18_21a725ab9c6cfdcba2b63da1f9f3c91a_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
4636	Fusion.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
5064	2026-07-18_21a725ab9c6cfdcba2b63da1f9f3c91a_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe
4636	Fusion.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3440	cmd.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{A7D85B10-9AA2-4F3B-866B-0799B5D2F6A8}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{5C906929-D04C-4F4A-B0F3-4D06C2B70E12}	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4636	Fusion.exe
4008	OpenWith.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 3440	5064	2026-07-18_21a725ab9c6cfdcba2b63da1f9f3c91a_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe	85
PID 3440 wrote to memory of 4636	3440	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-18_21a725ab9c6cfdcba2b63da1f9f3c91a_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_21a725ab9c6cfdcba2b63da1f9f3c91a_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\helper.bat" "
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Users\Admin\AppData\Local\fusion\Fusion.exe
    "C:\Users\Admin\AppData\Local\fusion\Fusion.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetWindowsHookEx
    PID:4636

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:1624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Fusion.lnk

Path C:\Users\Admin\AppData\Local\Temp\Fusion.lnk
Size 960B
SHA256 0b1c2a9bd23a1aabf9b8c4d0bbf46678606e17137c8d53dbbb9bec83336d6bbb
MD5 55b7db6d60a61546f1a606aaa59b329d
SHA1 b15c57248d2459693596ba9b7870a2cb9fe560a6
SHA512 67e6c7f1a9fd361e736fa9540e28e8fddd452e04958413a73024bb345312214c66fa006256f60702a0e6cb126fe8d5ab28360df5d112523590cdf8a2adf54fec
TLSH
T1271122158DA20231D7F6CF74C6DF6312C6B27CA7DF642E18408891587820A11BAF6F3B
MD5 SHA1 SHA512 TLSH

Submit Download

helper.bat

Path C:\Users\Admin\AppData\Local\Temp\helper.bat
Size 361B
SHA256 9e1274e3be49c5dabfbc6f5381c900def09acdf07bc09bff7369f446d436582b
MD5 6e78b446c273af41a3369daa999d1fc0
SHA1 432782d81a5f9bade5dcb7932d9ab5b227347d48
SHA512 d1aa3c780e8f42335144cac6576edafba66a74c8b3c126ec749bd7559a129effc166e4fbd9deea3d6eaf847a19c57f940fadeb0d4a7ee4a2de1d9fd7199705fa
TLSH
T156E0262746CF4A95480A940784D5290EC1BBF4CF9D883AD357318D2E3A8620B61F81A0
MD5 SHA1 SHA512 TLSH

Submit Download

Fusion.exe

Path C:\Users\Admin\AppData\Local\fusion\Fusion.exe
Size 9.8MB
SHA256 d645a2f4d04510b330fdb43dd46cd059904c0a22e8f336e8778044bad5297cfc
MD5 21a725ab9c6cfdcba2b63da1f9f3c91a
SHA1 26e47828fa4b7d8403cf70131adf007644d98f25
SHA512 98377157f8fe45daa6948ff77e5729189f30bb85a38a9ad58ab6dc3ee18b7b549b01e56c2ad0568a3d2fbc7ca5e6f9b33dcbf2f6d248d38092b00355f63333da
SSDEEP 98304:QvuVDi1tFeE7y/NMZoC/I/EEvZqKG2BTLO4IqVxpHar5oZ/+/U2VBExZF8R05ZU:XV03+/aiC/SEGBBTLO4bVxpHw5IuEx8
TLSH
T18FA69D12AE542C8DC066D632D7508A190DF435D5879919DFC1CC2AEE0E2EEE7AB3C63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads