Overview

overview

10

Static

static

10

2026-08-04...lc.exe

windows10-2004-x64

7

2026-08-04...lc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 22:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_e768b85bdc7403a683b98ed506416fad_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
  • Size 9.2MB
  • Sample260804-11xrdaeq7v
  • SHA256 d0b04b2d73292574409a54e576ff76a3c2194b1126bdbe9c8acd9825d978f2cd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_e768b85bdc7403a683b98ed506416fad_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_e768b85bdc7403a683b98ed506416fad_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
    1⤵
    • Creates a file in the Startup directory
    • Adds Run key to start application
    • Checks for any installed AV software in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3436
    • C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "MicrosoftEdgeUpdate_82ay" /tr "\"C:\Users\Admin\AppData\Local\Temp\2026-08-04_e768b85bdc7403a683b98ed506416fad_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe\"" /sc ONLOGON /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1556
    • C:\Program Files\7-Zip\7z.exe
      "C:\Program Files\7-Zip\7z.exe" a "-pOnline-fix.me" -mhe=on -t7z -mx9 "C:\Users\Admin\AppData\Local\Temp\vg__tmvdqyp8\Grand Theft Timeline.7z" "C:\Users\Admin\AppData\Local\Temp\vg__tmvdqyp8\organized\*"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1820
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_e768b85bdc7403a683b98ed506416fad_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_e768b85bdc7403a683b98ed506416fad_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
    1⤵
      PID:2072
    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_e768b85bdc7403a683b98ed506416fad_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-04_e768b85bdc7403a683b98ed506416fad_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
      1⤵
        PID:476

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            2
            T1547.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            2
            T1547.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Modify Registry

            1
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Browser Information Discovery

            1
            T1217

            Query Registry

            2
            T1012

            Software Discovery

            1
            T1518

            Security Software Discovery

            1
            T1518.001

            System Information Discovery

            1
            T1082

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Grand Theft Timeline.7z
            • Path C:\Users\Admin\AppData\Local\Temp\vg__tmvdqyp8\Grand Theft Timeline.7z
            • Size 1.8MB
            • SHA256 09b6bbb6e607e9702d60ae1e10281e71e9a326033bfe0cb78453cca0bdeb38b8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            History.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__tmvdqyp8\organized\Browser\Edge\History.txt
            • Size 66B
            • SHA256 982bc4c33531c8dc768a76be5913cb723f5641b0432febd4339d6f1ad88f0ac6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Bookmarks.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__tmvdqyp8\organized\Browser\Firefox\Bookmarks.txt
            • Size 367B
            • SHA256 4dc748ca7535f1c6a8cc1414733d9459457b3d2080a3a5e96386570af9a0647d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            history.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__tmvdqyp8\organized\Credentials\Edge\history.txt
            • Size 70B
            • SHA256 b7f309d4b10a925559913cb035068575c2486f7ef1a4cf16068820a10573a380
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Desktop.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__tmvdqyp8\organized\Directories\Desktop.txt
            • Size 1KB
            • SHA256 138e975f12aa51646b0e35d31cb85cb3976e8ea6daead7ee99da303e1927a97e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Documents.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__tmvdqyp8\organized\Directories\Documents.txt
            • Size 940B
            • SHA256 90d206215d658c623116610653e103278e0bd47dad73a8a64308d656ade989e4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Downloads.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__tmvdqyp8\organized\Directories\Downloads.txt
            • Size 1KB
            • SHA256 5304c398cdc8de37c9c02884721c4cff5111ef495cba6395ea13507f7de4ea46
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Music.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__tmvdqyp8\organized\Directories\Music.txt
            • Size 813B
            • SHA256 02c85cb20cfc532eacdbc59939f969cc3ce1ce57ea80050eeaae56373d46e1ed
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Pictures.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__tmvdqyp8\organized\Directories\Pictures.txt
            • Size 1KB
            • SHA256 5b1fc45627bcfbeedd9c5cd3dbe4690e9dd1c50866aff9d36b431528302ee553
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Videos.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__tmvdqyp8\organized\Directories\Videos.txt
            • Size 64B
            • SHA256 0168720facabf636d9307e93790f3326f5e32601d23b172a41e4436d8f0072ae
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Antivirus.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__tmvdqyp8\organized\System\Antivirus.txt
            • Size 31B
            • SHA256 7b56726c474b8da981e067e36bcd5fbd9efcec4cadc69d2a1c416b9832eede97
            • MD5 SHA1 SHA512
            Submit Download

            MAC Addresses.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__tmvdqyp8\organized\System\MAC Addresses.txt
            • Size 34B
            • SHA256 e557989930cf0eac5a9174229877e11517c80fb0420050d1dbc6835c5b53c0a3
            • MD5 SHA1 SHA512
            Submit Download

            System Info.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__tmvdqyp8\organized\System\System Info.txt
            • Size 724B
            • SHA256 e2f045bafd4df71fa3065b5d034aa9640ee9e752f652c075f0fe45305958123c
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Task List.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__tmvdqyp8\organized\System\Task List.txt
            • Size 2KB
            • SHA256 706e784a5200a3bada46386b797508a3c1b6df8431ffb6dfb2b54648eaf9dbeb
            • MD5 SHA1 SHA512 TLSH
            Submit Download