805b9a1b47d39be1303035c6052330d18e6ff311cba6d986917722d40f489eee

General

Target
2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Size 57.4MB
Sample260723-py4lcscp9v
SHA256 805b9a1b47d39be1303035c6052330d18e6ff311cba6d986917722d40f489eee
MD5 cc3ae793a891be8dd8defed199446600
SHA1 bdba0f606d2adaa66a0de7a3635eafb3091104ff
SHA512 ae8b553461ce5aae4c767660831b2e7b7d5be651c72203eb5a9f2278bd1ca700185b9e7d2bbff2bf0715c454cb3918752949b687be837195680a1812dbab7e83
SSDEEP 393216:d2PB+xzPvG3TnPgUKD2OVwWOHectHHWLJoTG4Q42WA26Xz6hg1V24kfpslIDomYx:4PpvHWa6F/i2zSfgpe1k4mPddGVUOmp
TLSH
T188D7AD1663A111AAD577D178CBAB6203EB72B40713308BDB329C43652F63BE45E7BB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Updater.exe	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io
10	ipinfo.io

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3212	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5820 wrote to memory of 3212	5820	2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe	90
PID 3212 wrote to memory of 3348	3212	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_cc3ae793a891be8dd8defed199446600_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe"
1⤵
- Drops startup file
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:5820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
    3⤵
    PID:3348