Overview

overview

10

Static

static

10

2026-07-29...lc.exe

windows10-2004-x64

7

2026-07-29...lc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/07/2026, 02:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-29_78980b6cc337dff86c852432ffb1b148_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
  • Size 9.2MB
  • Sample260729-c63mtasgkd
  • SHA256 394383ead225c23853593804e9a21f250336b3883b2928755518574f9920b3f2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-29_78980b6cc337dff86c852432ffb1b148_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-29_78980b6cc337dff86c852432ffb1b148_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
    1⤵
    • Checks for any installed AV software in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4848
    • C:\Program Files\7-Zip\7z.exe
      "C:\Program Files\7-Zip\7z.exe" a "-p93051ec395301864" -mhe=on -t7z -mx9 "C:\Users\Admin\AppData\Local\Temp\vg__9qmh64s1\4462dc-Admin.7z" "C:\Users\Admin\AppData\Local\Temp\vg__9qmh64s1\organized\*"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4876

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        4462dc-Admin.7z
        • Path C:\Users\Admin\AppData\Local\Temp\vg__9qmh64s1\4462dc-Admin.7z
        • Size 4.8MB
        • SHA256 e413b18918e0b29bac40881c9a54db475078e8d56ecc915e0a288d367fa7ed69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        History.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__9qmh64s1\organized\Browser\Edge\History.txt
        • Size 66B
        • SHA256 982bc4c33531c8dc768a76be5913cb723f5641b0432febd4339d6f1ad88f0ac6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Bookmarks.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__9qmh64s1\organized\Browser\Firefox\Bookmarks.txt
        • Size 367B
        • SHA256 4dc748ca7535f1c6a8cc1414733d9459457b3d2080a3a5e96386570af9a0647d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        history.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__9qmh64s1\organized\Credentials\Edge\history.txt
        • Size 70B
        • SHA256 b7f309d4b10a925559913cb035068575c2486f7ef1a4cf16068820a10573a380
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Desktop.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__9qmh64s1\organized\Directories\Desktop.txt
        • Size 1KB
        • SHA256 b7043616b4bdb6806ea733ec925cf305e0dd8a2372fff70c9cce16595a101e39
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Documents.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__9qmh64s1\organized\Directories\Documents.txt
        • Size 1KB
        • SHA256 0e2a890fefc33602cc4a5b395d0b95d6a4cc366cb125cd85f26ab84bc5da92d2
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Downloads.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__9qmh64s1\organized\Directories\Downloads.txt
        • Size 1KB
        • SHA256 3bba4a5e91d3d720fb8cbd2e506a0e8e80d4130247865a395c57a9b5c4ca5c55
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Music.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__9qmh64s1\organized\Directories\Music.txt
        • Size 871B
        • SHA256 fb143bff871819d259064599ef6f4354c1f5bc91868db8561ee1d86847214d31
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Pictures.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__9qmh64s1\organized\Directories\Pictures.txt
        • Size 965B
        • SHA256 95bcaf92e747967b9193b24ef39b4870460d06e91024185170d6af7e1fbf8369
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Videos.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__9qmh64s1\organized\Directories\Videos.txt
        • Size 64B
        • SHA256 0168720facabf636d9307e93790f3326f5e32601d23b172a41e4436d8f0072ae
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Antivirus.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__9qmh64s1\organized\System\Antivirus.txt
        • Size 31B
        • SHA256 7b56726c474b8da981e067e36bcd5fbd9efcec4cadc69d2a1c416b9832eede97
        • MD5 SHA1 SHA512
        Submit Download

        MAC Addresses.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__9qmh64s1\organized\System\MAC Addresses.txt
        • Size 34B
        • SHA256 ce3112d92be2f3d7f1382b34b6bdd05f46f28f9bdc2d69e3714b60db5c37fb0e
        • MD5 SHA1 SHA512
        Submit Download

        System Info.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__9qmh64s1\organized\System\System Info.txt
        • Size 724B
        • SHA256 58128d3a6ff2ad5e916b1ced6081109d2b1e4989d3117103d3061c1972ca4b6e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Task List.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__9qmh64s1\organized\System\Task List.txt
        • Size 2KB
        • SHA256 9d0f5b2701777fa2a976f713ff99bd30d497a738db38c79e07c35737a291be7e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/4848-32-0x0000016060540000-0x00000160607DE000-memory.dmp
        Download