c5aa67c0bfa2980e2a3754e5a51394248e9ead4adb56b3303cfb5b906df055b5

General

Target
2026-07-28_8febe9ee71692179953f178e83f9c8e6_glassworm_icedid_luca-stealer_njrat.exe
Size 1.7MB
Sample260729-a41dkadn2x
SHA256 c5aa67c0bfa2980e2a3754e5a51394248e9ead4adb56b3303cfb5b906df055b5
MD5 8febe9ee71692179953f178e83f9c8e6
SHA1 8b03d9acc8943f28dfa5a2edd788b73baed94f14
SHA512 098a3ca79604a0b4eac2e66a5b71e82c44d980478f81ebc62dc25a906c3333df4cddf43e4e7aed4ad421d6739f12f0ddf33c66d4f3fe2ebee61bc466c6b970a9
SSDEEP 49152:xTyCXwCyP1yxhx1oogFsIBU2NdL4glRPG:NyCXDnxhzDgFU2Dh
TLSH
T1D485F169A7A400F8D1F7D275CD424807EB72B84A4771A99F33ED45960F336A09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
12	discord.com
13	discord.com

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 2340	4772	2026-07-28_8febe9ee71692179953f178e83f9c8e6_glassworm_icedid_luca-stealer_njrat.exe	86
PID 4772 wrote to memory of 2340	4772	2026-07-28_8febe9ee71692179953f178e83f9c8e6_glassworm_icedid_luca-stealer_njrat.exe	86
PID 4772 wrote to memory of 2096	4772	2026-07-28_8febe9ee71692179953f178e83f9c8e6_glassworm_icedid_luca-stealer_njrat.exe	89
PID 4772 wrote to memory of 2096	4772	2026-07-28_8febe9ee71692179953f178e83f9c8e6_glassworm_icedid_luca-stealer_njrat.exe	89
PID 4772 wrote to memory of 2548	4772	2026-07-28_8febe9ee71692179953f178e83f9c8e6_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4772 wrote to memory of 2548	4772	2026-07-28_8febe9ee71692179953f178e83f9c8e6_glassworm_icedid_luca-stealer_njrat.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-28_8febe9ee71692179953f178e83f9c8e6_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_8febe9ee71692179953f178e83f9c8e6_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2096
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:2548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1976

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qwe900.log

Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
Size 1KB
SHA256 ba9ee622ed9c493cbac1a95a8ab583e49e06980f2fc1c6451a5402bd703bfcc0
MD5 6d4c2a377c40257d55efc4932be96429
SHA1 7ed295b88a7db48b8be94a49a23b06d16e288c74
SHA512 c1acd18adf45c90217b1b3115c5ea3a7f7837f218e399984cdf371c1cfdde57b76f19a807424642d2cba95afbf657c527999e6c6ac255d31ebc520e6e78815f7
TLSH
T1EC21731B82F6746706458250F7406DD8EFD8743ADD914C511B07810CEBF88879F7E751
MD5 SHA1 SHA512 TLSH

Submit Download

qwe900.log

Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
Size 1KB
SHA256 1deaa337df3890ff27171656078df94372cb2c1bada4072e3799123731301e6a
MD5 5bf1770bf07884f16bd58f8914a78f0a
SHA1 9bcfff6364785b9c7ed27e50cca227cd6bccb18d
SHA512 f8245afcc7872fecb8171b50d147b1dc02f98df0132ebf7df057e5bbc18ead5d273c2e2ca51995fe204c10c8f1229ebf58ce021205035b8df2499942e76291a0
TLSH
T1C3215C1B82FA746706858250F7406DD8EFD8743AD9924D921F07810CEBF88879FBEB61
MD5 SHA1 SHA512 TLSH

Submit Download

qwe900.log

Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
Size 1KB
SHA256 afda406473944d03e2e49ea8a490767c6f5b8ebc27da35f36e52cce86b2c45a5
MD5 691a49a1ab4185c709d3a9fd0be3de53
SHA1 7966d9ce696384d67c1fcee71afe369b10cdd153
SHA512 1cdd6ebbf0a22e23707906a9f83e611351856585a9052d99054992b4c8d90373362c7b591520f2549f1cd81f2641c749cc22a2ea3266079381dffd2013f3b1f7
TLSH
T1CA316E1B82FA746706868250F7406DD8EFE8753AED914D511B07810CEBF88879FBEB61
MD5 SHA1 SHA512 TLSH

Submit Download

qwe900.log

Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
Size 1KB
SHA256 851cca90ac8dca6b2c3825119d59633805bef39611e4991b9a70d7d6290a4419
MD5 ed6779aa1d2df8145de27253728ab0d0
SHA1 f9116835d893b080764ebd7b9b75945c1362768d
SHA512 c409bc10f0260fd87d5eb893ce1825d2027136aadeed15c8b67d59019c7a4befcea1ca41cffd69ccfc740900159b570c17b9544d2b5ae9819d9184453243dc2a
TLSH
T18631391B82FA746706868250F6406DD8EFE8753ADD914D511B06810CEBF88879FBEB61
MD5 SHA1 SHA512 TLSH

Submit Download

qwe900.log

Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
Size 671B
SHA256 9f4ca4ba7a8c7c1815a0542676a5e8e4909b0f78e70813b83a2d688696b9c976
MD5 9ded750a0f36698fe714d999fd6c10f7
SHA1 2909d1a2054560bb194310212c607b53e2105a93
SHA512 7d48f721490e540876b56a7701ec98a75da9fab200eebfd1399e007b085fa0aa3e1022a4a0b78fcb87571d38f41624c861ee2c3458e2815002beb2d1ea094910
TLSH
T1AB017B1B82F674670785C250F7406EE8EED8743AE8964C561B0B810CDBF88D79F79BA0
MD5 SHA1 SHA512 TLSH

Submit Download

qwe900.log

Path C:\Users\Admin\AppData\Local\Temp\qwe900.log
Size 745B
SHA256 4673513966c02d9dcfe81047cac237718ad5e9cdbf816ce5273ca52510ef206d
MD5 364e2430bc10a852c53dd8044158ef7b
SHA1 42801e53d2d7a5d562580bced16523a1f5a87c93
SHA512 c9806ea1ef07e15bb0e34e3864bf031893e0209ade3bd27f55e1235a846bcf649a52c0aba0d40dde82d87994fa142e19c6280380c8869a0a80020c7d1f7df2c5
TLSH
T14901491B82F6646706858250F7406DE8EED8743AD9924C521F07810CEBF88C79FB9B61
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads