4cd602fdb60037ff631fcccd4a2cc5806cfdaf360eab0960e15f40f72bf8b7fd

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 00:24

Target
2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe
Size 1.7MB
Sample260723-ap6l2aed28
SHA256 4cd602fdb60037ff631fcccd4a2cc5806cfdaf360eab0960e15f40f72bf8b7fd
MD5 113423fbd3221a2d1e7e2f09b2634486
SHA1 bc604d0ed2db34cb8e128530e3e1157ea2c7a982
SHA512 6f0382bea06e85169acd545a4b3b4a2b0965d9b3f41888eae464637323cc4e3fdf97dc2f941d219c296ed149aa3646511d2efbd548141056a79f353f94721eca
SSDEEP 49152:xs4ioC7pzJdOiMqQuPi5lFH3VlKOqfL7dUFk:GLMqQbrFXVlKRlUF
TLSH
T1E885F15992A400F8D1B7D274CE56890BE772FC094BB0A64F33DD59960F736A09E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 5904	2440	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	89
PID 2440 wrote to memory of 5904	2440	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	89
PID 2440 wrote to memory of 1396	2440	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	90
PID 2440 wrote to memory of 1396	2440	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	90
PID 2440 wrote to memory of 3332	2440	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	91
PID 2440 wrote to memory of 3332	2440	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	91
PID 2440 wrote to memory of 2256	2440	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	92
PID 2440 wrote to memory of 2256	2440	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	92
PID 2440 wrote to memory of 2188	2440	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	93
PID 2440 wrote to memory of 2188	2440	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	93
PID 2440 wrote to memory of 1804	2440	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	94
PID 2440 wrote to memory of 1804	2440	2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_113423fbd3221a2d1e7e2f09b2634486_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:5904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2256
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:2188
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:1804