d645a2f4d04510b330fdb43dd46cd059904c0a22e8f336e8778044bad5297cfc

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_21a725ab9c6cfdcba2b63da1f9f3c91a_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe
Size 9.8MB
Sample260718-nwwmasdw21
SHA256 d645a2f4d04510b330fdb43dd46cd059904c0a22e8f336e8778044bad5297cfc
MD5 21a725ab9c6cfdcba2b63da1f9f3c91a
SHA1 26e47828fa4b7d8403cf70131adf007644d98f25
SHA512 98377157f8fe45daa6948ff77e5729189f30bb85a38a9ad58ab6dc3ee18b7b549b01e56c2ad0568a3d2fbc7ca5e6f9b33dcbf2f6d248d38092b00355f63333da
SSDEEP 98304:QvuVDi1tFeE7y/NMZoC/I/EEvZqKG2BTLO4IqVxpHar5oZ/+/U2VBExZF8R05ZU:XV03+/aiC/SEGBBTLO4bVxpHw5IuEx8
TLSH
T18FA69D12AE542C8DC066D632D7508A190DF435D5879919DFC1CC2AEE0E2EEE7AB3C63D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c479-10.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Executes dropped EXE 2 IoCs

pid	Process
2304	Fusion.exe
1808	Fusion.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4236	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
5048	2026-07-18_21a725ab9c6cfdcba2b63da1f9f3c91a_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe
2304	Fusion.exe
2304	Fusion.exe
1808	Fusion.exe
1808	Fusion.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5312	cmd.exe
5780	cmd.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
4760	timeout.exe
1896	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{51D35EF3-EB28-40C3-81FC-2EA957FD858B}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{491B1E29-BC6A-4FC2-853B-206A468A1B52}	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4236	tasklist.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2900	OpenWith.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 5312	5048	2026-07-18_21a725ab9c6cfdcba2b63da1f9f3c91a_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe	89
PID 5312 wrote to memory of 2304	5312	cmd.exe	91
PID 2304 wrote to memory of 5780	2304	Fusion.exe	95
PID 5780 wrote to memory of 5508	5780	cmd.exe	99
PID 5780 wrote to memory of 4236	5780	cmd.exe	102
PID 5780 wrote to memory of 4380	5780	cmd.exe	103
PID 5780 wrote to memory of 1896	5780	cmd.exe	105
PID 5780 wrote to memory of 1808	5780	cmd.exe	106
PID 5780 wrote to memory of 4760	5780	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-18_21a725ab9c6cfdcba2b63da1f9f3c91a_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_21a725ab9c6cfdcba2b63da1f9f3c91a_blankgrabber_glassworm_icedid_mespinoza_njrat_ryuk_stealc.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\helper.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5312
- - C:\Users\Admin\AppData\Local\fusion\Fusion.exe
    "C:\Users\Admin\AppData\Local\fusion\Fusion.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\fusion\updater.bat" "
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5780
    - - C:\Windows\system32\mode.com
        
        mode con: cols=38 lines=18
        5⤵
        
        PID:5508
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /FI "PID eq 2304"
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4236
    - - C:\Windows\system32\find.exe
        
        find "2304"
        5⤵
        
        PID:4380
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 2 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:1896
    - - C:\Users\Admin\AppData\Local\fusion\Fusion.exe
        
        "Fusion.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1808
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 2 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:4760

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:5084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 314B
SHA256 8f7e3bf512ad71b46e560695a2c7858dd149fd5bdce5d4862a23ef003a1f7d2f
MD5 d05225d1e7652ab27dff7c68d973e55e
SHA1 1c4879c2f950958903b2394641f2c60cd259360d
SHA512 4585931b5396a9a7a64d3d8442e0254f3d90f830c786839d3614e851b2ecddf9bfdf66100b0b988731585bd71e13fdacb5f648f862a42e07eff64ea9579bf900
TLSH
T1B4E0E705274D84D7F63B44792FE1487A7413018D04E5AB8D7E0843D3CC4153F9817101
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 977B
SHA256 174b2235c374a96abceb093fc82f94ee79e7040bf72b03e30d434e87c25050d8
MD5 1053c417ef017cf87b077f9550f55495
SHA1 f9111be0f39d79d5941aba56b73519d270e834fd
SHA512 e519835076eb46656df169597a6e52c27328cccb38eab6dff900b601b95fb06783b49b8098c443825ab0a37e7d89addceab0b88e416aa6cad81fc117fe0d56a7
TLSH
T12E1121C70EE4A19199F38661CBFCD1357CB530C52CEA70D61C928892289675D7B1503F
MD5 SHA1 SHA512 TLSH

Submit Download

18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
Size 488B
SHA256 fb7b2359ae3161168ccc48eb661c43ab03b396808744538d8b4ec78106cdcafb
MD5 e1ce9d328d1acb336a48be4dd43d6add
SHA1 f5a9faf41e076809873fdcc127dbb7d0d6c3932a
SHA512 dbef5d6999ef0a626fac6dd472a1a02dd2154eaeb45f42b6490ff349121e5cf01954b02a02e648b39c5bda63a76c9a9d43a6c4755cc654955bde4ef69b5c77e7
TLSH
T109F05C2C1BBC407EE47ACA799FD9A2936D16E123380455BD0BD20B8DA602F406C51439
MD5 SHA1 SHA512 TLSH

Submit Download

D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
Size 488B
SHA256 d83f6ed724c1f1c88555f9cacad60b83396a1ebec6343a860ee08b0ae500f295
MD5 bed2f4244ffcf673896b03fc4dbca318
SHA1 c615ce776bf906e21d0086b7368f01894b345f3e
SHA512 813df0b04896cc4b3a6bdd50e9340da50965ec9924894ed14ca3e61c9f30a8e6bbe12b96c9558f3115290c7873089bb2316e669d90c880e8e69119626884a958
TLSH
T12CF0236416E1403DF335173409F253D9EB0D721A3000E89829E2120FFE03B404E2143C
MD5 SHA1 SHA512 TLSH

Submit Download

Fusion.lnk

Path C:\Users\Admin\AppData\Local\Temp\Fusion.lnk
Size 960B
SHA256 9bfbe8f855d7367a6f5b4452544cb51aa752663374c5ad255b23d11c915f3e7d
MD5 ec49538bb18feaaad36ce789fb9c24db
SHA1 ed7a3a910d723ec248258253e113794223886d98
SHA512 0a773c6b976de7b9e4d34e31268986debb27c0f6aa47c6b5efa41ca457cd52efe5d971bb29d2ecdafb21eabe090b94cce6a15cc95eb38a5fec9bf2fc8d44302c
TLSH
T1881128018CA11221D7F1CF74C2DE7316D7727CA7EF542E14004990083821611B9F6F3B
MD5 SHA1 SHA512 TLSH

Submit Download

helper.bat

Path C:\Users\Admin\AppData\Local\Temp\helper.bat
Size 361B
SHA256 9e1274e3be49c5dabfbc6f5381c900def09acdf07bc09bff7369f446d436582b
MD5 6e78b446c273af41a3369daa999d1fc0
SHA1 432782d81a5f9bade5dcb7932d9ab5b227347d48
SHA512 d1aa3c780e8f42335144cac6576edafba66a74c8b3c126ec749bd7559a129effc166e4fbd9deea3d6eaf847a19c57f940fadeb0d4a7ee4a2de1d9fd7199705fa
TLSH
T156E0262746CF4A95480A940784D5290EC1BBF4CF9D883AD357318D2E3A8620B61F81A0
MD5 SHA1 SHA512 TLSH

Submit Download

Fusion.exe

Path C:\Users\Admin\AppData\Local\fusion\Fusion.exe
Size 9.8MB
SHA256 d645a2f4d04510b330fdb43dd46cd059904c0a22e8f336e8778044bad5297cfc
MD5 21a725ab9c6cfdcba2b63da1f9f3c91a
SHA1 26e47828fa4b7d8403cf70131adf007644d98f25
SHA512 98377157f8fe45daa6948ff77e5729189f30bb85a38a9ad58ab6dc3ee18b7b549b01e56c2ad0568a3d2fbc7ca5e6f9b33dcbf2f6d248d38092b00355f63333da
SSDEEP 98304:QvuVDi1tFeE7y/NMZoC/I/EEvZqKG2BTLO4IqVxpHar5oZ/+/U2VBExZF8R05ZU:XV03+/aiC/SEGBBTLO4bVxpHw5IuEx8
TLSH
T18FA69D12AE542C8DC066D632D7508A190DF435D5879919DFC1CC2AEE0E2EEE7AB3C63D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updater.bat

Path C:\Users\Admin\AppData\Local\fusion\updater.bat
Size 1KB
SHA256 4c808942802bdf434279238cfc18fb99c1969c7fc2bdb6d60ccea0b1a91e3286
MD5 b8c46c579a9192c2afb87a42c5d38c7c
SHA1 0dda5bc9445a4c51d2f5fa0d928487adc9a3ae44
SHA512 299070787e3087147815ce41bd55abc668e09520afeb847ac29e1e0832d8ad78556f5c701caf07ddc4adc874dee9a3c4251bb9a747aa53b39b1977e6b89ae805
TLSH
T16531F05A7022A5A481FC4CA41EB52422F5A654DF8A262DACB06FC0354F253C63FFE0ED
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads