5a0d32971e73510a4d31416103f48a8e85c53c21e3324c19dcf86210a539c6ff

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 20:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_54b037b6760df6899f8f652e2c1ef9b5_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 1.2MB
Sample260730-y9lpcswhmf
SHA256 5a0d32971e73510a4d31416103f48a8e85c53c21e3324c19dcf86210a539c6ff
MD5 54b037b6760df6899f8f652e2c1ef9b5
SHA1 3ecd19231a98ddf8d356dfd0e3794702b2eec755
SHA512 17b35532e7fd3f7dd32d4acf053cbed4da888cfa9c8174ec578c025cd10f36e12be5caa290a0157404ad874d701c6ac4c6a6b9b0bda29a076f5e055b69e3b961
SSDEEP 24576:+GtlqMhc4IBa2QGK59KXnb2+MyDqnkqKEg7/ZeU:+GtlqMhc4IkKXn6+1+LlgbZN
TLSH
T1E3457D4567A541ECD0BBC538CEA24663FBB1781A0730CBDF1290965A1F73AE49F39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-30_54b037b6760df6899f8f652e2c1ef9b5_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeBackupPrivilege	4312	2026-07-30_54b037b6760df6899f8f652e2c1ef9b5_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeRestorePrivilege	4312	2026-07-30_54b037b6760df6899f8f652e2c1ef9b5_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeManageVolumePrivilege	4312	2026-07-30_54b037b6760df6899f8f652e2c1ef9b5_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeSecurityPrivilege	4312	2026-07-30_54b037b6760df6899f8f652e2c1ef9b5_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: 35	4312	2026-07-30_54b037b6760df6899f8f652e2c1ef9b5_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4312	2026-07-30_54b037b6760df6899f8f652e2c1ef9b5_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
4312	2026-07-30_54b037b6760df6899f8f652e2c1ef9b5_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_54b037b6760df6899f8f652e2c1ef9b5_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_54b037b6760df6899f8f652e2c1ef9b5_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads