fe3518e01aa4fb0b5c05c6e7ea53e2e6b59caf3aea388458cdb29a5c8401a910

General

Target
2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat.exe
Size 2.7MB
Sample260727-eefp3svxet
SHA256 fe3518e01aa4fb0b5c05c6e7ea53e2e6b59caf3aea388458cdb29a5c8401a910
MD5 09dd1ff525fb8d23b7b99169b29a773b
SHA1 98ff9f7c96d23dd42d5173c23cdc2e8a9fb5c088
SHA512 b429072e57399693b8d20e4a7d0fb8122f83c7e2c29ed53326de8b185e9dbc6020b6364b574490a55400c7879e106efff6e7f7e80055fd74df06c7cc96c80e46
SSDEEP 49152:5IhqK0byTx/H8xjigE12dF8YPJ2q5FkWGcaUeI+xdWUxkT72mgv:vby9/chigj/1ZeZHW+pv
TLSH
T17BD5E00FA76801F9D0A7C2B5CF465A07D7B2B8464270A79F13E5CAD61F276614E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
58	api.ipify.org

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 4900	2072	2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat.exe	86
PID 2072 wrote to memory of 4900	2072	2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat.exe	86
PID 2072 wrote to memory of 3232	2072	2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat.exe	89
PID 2072 wrote to memory of 3232	2072	2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat.exe	89
PID 2072 wrote to memory of 632	2072	2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat.exe	93
PID 2072 wrote to memory of 632	2072	2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat.exe	93
PID 2072 wrote to memory of 2880	2072	2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat.exe	105
PID 2072 wrote to memory of 2880	2072	2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat.exe	105
PID 2072 wrote to memory of 3220	2072	2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat.exe	106
PID 2072 wrote to memory of 3220	2072	2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat.exe	106
PID 2072 wrote to memory of 3104	2072	2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat.exe	107
PID 2072 wrote to memory of 3104	2072	2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_09dd1ff525fb8d23b7b99169b29a773b_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2880
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:3220
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:3104

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3876

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1976

veh_log.txt

Path C:\Users\Public\veh_log.txt
Size 458B
SHA256 9693f7b349650b9e139b5f771780f717f562daff6e4542d28064e4e2648a7cc0
MD5 aa8cb4e68d263f36cab95c804d19a63d
SHA1 9d287c9bdd68be8b32d15c360c5b75095d0baca5
SHA512 7d93d0eecf089db55d7ef1f2f4c16180d1d185b6572e7160a2660032987c825307b6742463b14c19c06d116b481abac2101d4367303ddb89c725b56129dd89a2
TLSH
T1A4F02894FC7ADD2ADB964A706C21B91F02A8FCC142D694330FC75AAD8416FF3C934489
MD5 SHA1 SHA512 TLSH

Submit Download

veh_log.txt

Path C:\Users\Public\veh_log.txt
Size 574B
SHA256 e42c1821f242de2788192da873f405988d26499a1ca15dd0fb2d649fa3268f58
MD5 538c039ba0b0a4adaa08f1363e5edf2d
SHA1 545f71d74c0f2bda7867d1200fc930fc43f2e22f
SHA512 0599c7d81f949d0690ab5dc1c36e1a9d4613c9abb5a7929d216283b0eac8a9caf82494d18b7ddb8fc4109b4a16cd0a18a6ccad828176abbb52801f72442c6244
TLSH
T1F4F0D694EC7AD92ADB565A706C21B91F03A8FCC152D654230F865AAE8416BF38938489
MD5 SHA1 SHA512 TLSH

Submit Download

veh_log.txt

Path C:\Users\Public\veh_log.txt
Size 174B
SHA256 1c5c53bde79b90bd15950d255fc89557b9a70ad5659c4199897b9aff4793f25a
MD5 428c935726e643b902840ca11075821b
SHA1 dbf6348e390d9f25270b94a08769d14f3af26ecf
SHA512 01a032bee8f04feda0bbcf5815c6d9273f9d70c92ea3cd45ca7703a01524b85ca2f7aad187befdeaa3c086464ae1841605941775dec143879777e2fcf2eef100
TLSH
T1B4C01290AC7A9929CB5655746C21B91F0298FC8001D254330F825AAD8416BF3D930449
MD5 SHA1 SHA512 TLSH

Submit Download

veh_log.txt

Path C:\Users\Public\veh_log.txt
Size 232B
SHA256 df85602e09959646d8c2504228e5393e5ddaeb96a7441b6ff8e2d238661fa04d
MD5 9318d7b38ce26ad7776bdfba9d8939c5
SHA1 0afbb48f27a3803882bc6ca620a9b8f2dd8b452a
SHA512 8abbb0be6b7f8c891b1809cfb3fb9fe2fb25945342ab24a4744938ac2c25cbf438df46b03978b734a4bc8ea259bae6f5a493251946c88c36b3f5bebb80bf1eda
TLSH
T103D05E90BC7A992ADB5646706C21B91F02A8FCC002D254330F825AAD8416BF3C930489
MD5 SHA1 SHA512 TLSH

Submit Download

veh_log.txt

Path C:\Users\Public\veh_log.txt
Size 345B
SHA256 fbed2fefebce59a72ac243b76f0dac63c9f13bc628997082428ec6d7601cdf40
MD5 efd4b60c3f0e801c224e6b09eed05f93
SHA1 7690cb46d105a2e6f238558928ce26bdeca8de32
SHA512 ce0dc2f3f6c8fda803730ccb2cd1c8f0ba9d6985fee883bb1f5a84d156c81ef22b3af0834e6d4e14ee64aae1a969b768cddb0537e22d67b3deb661a510776fd3
TLSH
T1BFE09A94FC7ADD2ADB5646706C21B91F02A8FCC142D694330F865AAD8416FF3C934489
MD5 SHA1 SHA512 TLSH

Submit Download