98176afc2ecde78e445591b38f33d5d6d44f98f32b011d5e0ef662f19a50b336

General

Target
2026-07-28_273e4391f4454d3cac44644c177a1c0d_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_vidar.exe
Size 69.3MB
Sample260728-qctppsxzev
SHA256 98176afc2ecde78e445591b38f33d5d6d44f98f32b011d5e0ef662f19a50b336
MD5 273e4391f4454d3cac44644c177a1c0d
SHA1 2ef1b907e80e310896597eea7d35325055c7478e
SHA512 775b8b61af75fbf8f8315834bcb2a7658b22511920878744bac78cbd73cfa956186020a0adeec67729ca6548e9f5509e8e233933973c3cea5ac4f4884a6734e1
SSDEEP 786432:muMLI+H38OA83yg1Yg1WV5OtsFktaPxW+:m5j38VqHFWqA7
TLSH
T1A0F7BE15B3D80A16E63FC27CC2638102E7F1B4935352D7CF4598EA992F63BC19A37266
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4900	2026-07-28_273e4391f4454d3cac44644c177a1c0d_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-28_273e4391f4454d3cac44644c177a1c0d_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-28_273e4391f4454d3cac44644c177a1c0d_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4900	2026-07-28_273e4391f4454d3cac44644c177a1c0d_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_vidar.exe
4900	2026-07-28_273e4391f4454d3cac44644c177a1c0d_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_vidar.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4900	2026-07-28_273e4391f4454d3cac44644c177a1c0d_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_vidar.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 2924	4900	2026-07-28_273e4391f4454d3cac44644c177a1c0d_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_vidar.exe	91
PID 4900 wrote to memory of 2924	4900	2026-07-28_273e4391f4454d3cac44644c177a1c0d_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_vidar.exe	91
PID 4900 wrote to memory of 1548	4900	2026-07-28_273e4391f4454d3cac44644c177a1c0d_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_vidar.exe	90
PID 4900 wrote to memory of 1548	4900	2026-07-28_273e4391f4454d3cac44644c177a1c0d_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-28_273e4391f4454d3cac44644c177a1c0d_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_273e4391f4454d3cac44644c177a1c0d_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_vidar.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2924

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e_sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\2026-07-28_273e4391f4454d3cac44644c177a1c0d_glassworm_icedid_krakenkeylogger_luca-stealer_megazord_njrat_vidar\PRqOIfFLhYwa\e_sqlite3.dll
Size 1.7MB
SHA256 39923cfdad272169c217406a60214ffe9bd6c1b3bd396a3eff94b781bd8d3376
MD5 796c0d4607433e747075a0a675a23bdf
SHA1 426841da35a580d9b280d2fd9eaf546859da9cf7
SHA512 fc75873361c7c162166c9e6527246a8da59ecc4b6e83642bdd3a00c4f4a0289d4da025c8a5d38af8be1c2e8c9d8d5efd2f1d1f2e7c6e355932d80a739d8dfa31
SSDEEP 24576:4OduSG8dN8tpBWQCCA5hF2pQwtqjnU43qCtWuj60dshJEZwLB8vOCmFZ3J:4OpG8dN8BCTcpQiOUn0WCshTLyo
TLSH
T187856D4BA2B900ACD86782B8C917570BE7F1B4052764ABDB1590C6652F23FF61F7A334
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fingerprint.json

Path C:\Users\Admin\AppData\Local\Temp\8EDM3RLEjRYpGVJhQUi2PXxs\Browsers\Chrome\fingerprint.json
Size 868B
SHA256 abec94c6f0007ef65cfeca8ea1acb32bbf4314a46a7a5bb5bdd4e747d5d66172
MD5 8de558e79289d8289980838aa5cd12e9
SHA1 3e524c241f6f9b551cee179ade51284719999c76
SHA512 3594bcca85052ef6ab7eb4c0d3e02c424f27a957b25dafc6a13321c8a57d9e26d553ed1fc23684b6f3b400ddbd4aa9661dad47af34075b1be8f31ef41315d29f
TLSH
T11211C952AA45D0BF2A31F148D270A85736A18F2E22B50C1737F7A4181846B3E315AFA1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2572-2-0x0000022964360000-0x00000229645A1000-memory.dmp

Download

memory/3356-1-0x000001DCD5930000-0x000001DCD5B71000-memory.dmp