4cd602fdb60037ff631fcccd4a2cc5806cfdaf360eab0960e15f40f72bf8b7fd

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 00:24

Target
2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe
Size 1.7MB
Sample260723-ap6l2aed28
SHA256 4cd602fdb60037ff631fcccd4a2cc5806cfdaf360eab0960e15f40f72bf8b7fd
MD5 113423fbd3221a2d1e7e2f09b2634486
SHA1 bc604d0ed2db34cb8e128530e3e1157ea2c7a982
SHA512 6f0382bea06e85169acd545a4b3b4a2b0965d9b3f41888eae464637323cc4e3fdf97dc2f941d219c296ed149aa3646511d2efbd548141056a79f353f94721eca
SSDEEP 49152:xs4ioC7pzJdOiMqQuPi5lFH3VlKOqfL7dUFk:GLMqQbrFXVlKRlUF
TLSH
T1E885F15992A400F8D1B7D274CE56890BE772FC094BB0A64F33DD59960F736A09E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	api.ipify.org

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 4880	1672	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	86
PID 1672 wrote to memory of 4880	1672	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	86
PID 1672 wrote to memory of 3568	1672	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	89
PID 1672 wrote to memory of 3568	1672	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	89
PID 1672 wrote to memory of 3984	1672	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	90
PID 1672 wrote to memory of 3984	1672	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	90
PID 1672 wrote to memory of 4036	1672	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	91
PID 1672 wrote to memory of 4036	1672	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	91
PID 1672 wrote to memory of 772	1672	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	92
PID 1672 wrote to memory of 772	1672	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3984
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:4036
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:772

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3760

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3944