Analysis
- max time kernel
149s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 11:56
General
- Target 2026-07-31_4f1989beaaa912f695b79ee2873c1dea_glassworm_icedid_luca-stealer_njrat_stealc.exe
- Size 12.8MB
- Sample260731-n4bbbsaa43
- SHA256 cdc84ada6dd59ae1fb733b7ba1f604e422d4b6483720330bb54504fbb676ea0c
Malware Config
Signatures
- Detects executables packed with Themida 2 IoCs
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 1 IoCs
- Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Kills process with taskkill 1 IoCs
- Runs ping.exe 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_4f1989beaaa912f695b79ee2873c1dea_glassworm_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_4f1989beaaa912f695b79ee2873c1dea_glassworm_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /C Get-Service -Name WpnUserService* | Restart-Service -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\laddon.exe"C:\laddon.exe" 56162⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -OutputFormat Text -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAAkAGMAcAB1ACAAPQAgAEcAZQB0AC0AVwBtAGkATwBiAGoAZQBjAHQAIABXAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzAG8AcgAgAHwAIABTAGUAbABlAGMAdAAgAC0ARgBpAHIAcwB0ACAAMQAgAC0ARQB4AHAAYQBuAGQAIABNAGEAbgB1AGYAYQBjAHQAdQByAGUAcgAKACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAYwBwAHUAIAAtAGwAaQBrAGUAIAAnACoASQBuAHQAZQBsACoAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBJAG4AdABlAGwAIgAKACAAIAAgACAAIAAgACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIATwB0AGgAZQByACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAIAAgACAAIAA=3⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C ping 127.0.0.1 -n 2 > nul & taskkill /F /PID 1336 > nul 2>&1 & ping 127.0.0.1 -n 2 > nul & del /F /Q "C:\laddon.exe" > nul 2>&1 & exit3⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 24⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Windows\system32\taskkill.exetaskkill /F /PID 13364⤵
- Kills process with taskkill
-
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 24⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
chairfbi_addon_to_sdk
chairfbi_addon_to_sdk
chairfbi_sdk_to_addon
StartupProfileData-NonInteractive
laddon.exe
memory/1336-244-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-463-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-577-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-573-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-563-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-553-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-544-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-536-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-532-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-517-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-514-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-497-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-259-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-35-0x00000191C04A0000-0x00000191C04A1000-memory.dmp
memory/1336-39-0x00007FF6447A0000-0x00007FF6452A5000-memory.dmp
memory/1336-37-0x00007FF6447A0000-0x00007FF6452A5000-memory.dmp
memory/1336-34-0x00000191C0450000-0x00000191C0451000-memory.dmp
memory/1336-40-0x00007FF6447A0000-0x00007FF6452A5000-memory.dmp
memory/1336-41-0x00007FF6447A0000-0x00007FF6452A5000-memory.dmp
memory/1336-36-0x00007FF6447A0000-0x00007FF6452A5000-memory.dmp
memory/1336-58-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-493-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-490-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-32-0x00007FF6447A0000-0x00007FF6452A5000-memory.dmp
memory/1336-85-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-94-0x00000191C0500000-0x00000191C0501000-memory.dmp
memory/1336-104-0x00000191C0600000-0x00000191C0601000-memory.dmp
memory/1336-108-0x00000191C0610000-0x00000191C0611000-memory.dmp
memory/1336-118-0x00000191C0640000-0x00000191C0641000-memory.dmp
memory/1336-31-0x00007FF6447A0000-0x00007FF6452A5000-memory.dmp
memory/1336-153-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-161-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-165-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-175-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-179-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-182-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-185-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-189-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-239-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-30-0x00007FF6447A0000-0x00007FF6452A5000-memory.dmp
memory/1336-482-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-263-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-495-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-269-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-280-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-296-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-315-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-326-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-344-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-349-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-354-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-369-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-383-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-384-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-388-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-398-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-407-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-422-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-437-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-443-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-459-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-258-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-473-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/1336-475-0x00000191C0440000-0x00000191C0441000-memory.dmp
memory/5616-23-0x0000000140000000-0x0000000140CD2000-memory.dmp
memory/5616-0-0x0000000140000000-0x0000000140CD2000-memory.dmp
memory/5852-3-0x00007FF8998AF000-0x00007FF8998B0000-memory.dmp
memory/5852-16-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp
memory/5852-15-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp
memory/5852-14-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp
memory/5852-13-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp
memory/5852-11-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp
memory/5852-12-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp
memory/5852-8-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp
memory/5852-9-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp
memory/5852-10-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp
memory/5852-7-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp
memory/5852-6-0x0000020C253A0000-0x0000020C253C2000-memory.dmp
memory/5852-17-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp
memory/5852-19-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp
memory/5852-20-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp
memory/5852-18-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp
memory/5852-22-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp