d93426ee563c529c8215f4b265a9db242970df5a5ad52bae68847ddd4bce48a8

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 10:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_a5302c75780778503e7330097b230951_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Size 100.0MB
Sample260804-mfyw2stsgz
SHA256 d93426ee563c529c8215f4b265a9db242970df5a5ad52bae68847ddd4bce48a8
MD5 a5302c75780778503e7330097b230951
SHA1 25587472ff22f0b0d1283aa7a46d2f9bb7ddfac9
SHA512 0c5dfe91947866dea773cc5171c43ca54434109a47ea2d5b5543c7cf5d7673a574b1a46fcce4ae0957882310f1abe21e5e421f1b8ddd01e7c8a254de94a0f2b5
SSDEEP 196608:l+1G7bsk0EKkgmXqdQQ8aGkc47Ram7U0UB:l+1Obsk0EKkLXc8aGkc47Ram7A
TLSH
T159388C15E77800D8E4AAC1B9C7465157D7B1784A03B0ABDF1A90AEF62F27AE41F3B701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-08-03_a5302c75780778503e7330097b230951_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-08-03_a5302c75780778503e7330097b230951_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2128	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-08-03_a5302c75780778503e7330097b230951_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-08-03_a5302c75780778503e7330097b230951_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5128	2026-08-03_a5302c75780778503e7330097b230951_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
5128	2026-08-03_a5302c75780778503e7330097b230951_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5128 wrote to memory of 2708	5128	2026-08-03_a5302c75780778503e7330097b230951_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	89
PID 2708 wrote to memory of 2128	2708	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-03_a5302c75780778503e7330097b230951_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_a5302c75780778503e7330097b230951_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5128
- C:\Windows\System32\cmd.exe
  /c timeout /t 2 /nobreak >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-08-03_a5302c75780778503e7330097b230951_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads