b8856163e814a1e4d4dc21627fb5ec3ffb5793eb145187990e07d81b4a8d9439

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_bf45bc2359dd6882a70f394f8470ea71_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 59.6MB
Sample260808-dafc3sgl5y
SHA256 b8856163e814a1e4d4dc21627fb5ec3ffb5793eb145187990e07d81b4a8d9439
MD5 bf45bc2359dd6882a70f394f8470ea71
SHA1 3efbcc9bde058271983a3954a70ceee12247ac83
SHA512 21aee2a34bb32a584eeb4c34c0432b731d8f56ec13addd2782978136c43de6e33c10353364c606b9d087843fbf5efbd85c79b987e7df955587b50277b8636cae
SSDEEP 786432:r90NQhC0n2CcwLFMPl+0XFa5UJM6AIOyBgDHn:BNhvnIiM9HFaq+6AIO6gDHn
TLSH
T176D78E5410FAB59E78F47128AEEEADE5171BF0C1D0ED7B424828F9226C12C35F339A65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4316	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 4316	3820	2026-08-08_bf45bc2359dd6882a70f394f8470ea71_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf45bc2359dd6882a70f394f8470ea71_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_bf45bc2359dd6882a70f394f8470ea71_cryptbot_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" start.vbs
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

package.json

Path C:\Users\Admin\AppData\Local\Temp\tqx_checker\node_modules\brace-expansion\dist\commonjs\package.json
Size 25B
SHA256 8005a3491db7d92f36ac66369861589f9c47123d3a7c71e643fc2c06168cd45a
MD5 df9ffc6aa3f78a5491736d441c4258a8
SHA1 9d0d83ae5d399d96b36d228e614a575fc209d488
SHA512 6c58939da58f9b716293a8328f7a3649b6e242bf235fae00055a0cc79fb2788e4a99dfaa422e0cfadbe84e0d5e33b836f68627e6a409654877edc443b94d04c4
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Temp\tqx_checker\node_modules\brace-expansion\dist\esm\package.json
Size 23B
SHA256 3ca9d4afd21425087cf31893b8f9f63c81b0b8408db5e343ca76e5f8aa26ab9a
MD5 d0707362e90f00edd12435e9d3b9d71c
SHA1 50faeb965b15dfc6854cb1235b06dbb5e79148d2
SHA512 9d323420cc63c6bee79dcc5db5f0f18f6b8e073daaf8ffa5459e11f2de59a9f5e8c178d77fa92afc9ddd352623dec362c62fff859c71a2fab93f1e2172c4987f
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\tqx_checker\node_modules\es-errors\LICENSE
Size 1KB
SHA256 5e325595b4ea8cfec3802f545b1def5d7b73e4a5b8e9ba63e32a320f67732292
MD5 8fe23ea421aaf9f9d687709f6a6a09b7
SHA1 a47868ab90b532df82abe3e4f507bcb2ea441364
SHA512 8acd3b84f3afa8c6ff9c1a58ab774ea33aec7701c022ba8f4d36218a8d1c03e80ef2ee1d692dbd43dbf5883153137c5e000f113b98da23d870dfab6f71b78afa
TLSH
T11111751EB25107B228AB13605578ACD5F23BB25F7A9F2A84246DF345633A06CC5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

.nycrc

Path C:\Users\Admin\AppData\Local\Temp\tqx_checker\node_modules\es-set-tostringtag\.nycrc
Size 139B
SHA256 997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a
MD5 d0104f79f0b4f03bbcd3b287fa04cf8c
SHA1 54f9d7adf8943cb07f821435bb269eb4ba40ccc2
SHA512 daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6
TLSH
T170C09B65E43F596B255D119CBD4CD5C7155415E1C1CD8F097D156661C31DB64004F541
MD5 SHA1 SHA512 TLSH

Submit Download

.eslintrc

Path C:\Users\Admin\AppData\Local\Temp\tqx_checker\node_modules\has-tostringtag\.eslintrc
Size 43B
SHA256 0694050195fc694c5846b0a2a66b437ac775da988f0a779c55fb892597f7f641
MD5 c28b0fe9be6e306cc2ad30fe00e3db10
SHA1 af79c81bd61c9a937fca18425dd84cdf8317c8b9
SHA512 e3eca17804522ffa4f41e836e76e397a310a20e8261a38115b67e8b644444153039d04198fb470f45be2997d2c7a72b15bd4771a02c741b3cbc072ea6ef432e9
MD5 SHA1 SHA512

Submit Download

.nycrc

Path C:\Users\Admin\AppData\Local\Temp\tqx_checker\node_modules\has-tostringtag\.nycrc
Size 216B
SHA256 948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a
MD5 c2ab942102236f987048d0d84d73d960
SHA1 95462172699187ac02eaec6074024b26e6d71cff
SHA512 e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479
TLSH
T12ED0A710F03A051561DD629C7D4DB057051404A2818A8625AC712260CB78A10104B941
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\tqx_checker\node_modules\https-proxy-agent\LICENSE
Size 1KB
SHA256 8d8c55319c7729d57be811c747452636688d54f19701ee0752b6b15ad3771d9a
MD5 e0788eaca177f42808ee36bc32bb522f
SHA1 06000e5076e6e4b51294a87d836817a74c8af65c
SHA512 dc037410a930a54ee25a8fdaaa9bcd3c310b9abd81ffd2dc8a75205da44dbe7a1ad1d058d85271e73b7ec5ccf07ccd7109fc6ebbbfc2e2499695515f34392dea
TLSH
T13311661E725443721856137015796CC5B25AB19FBE9B2A84646DF244233745CA4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\tqx_checker\node_modules\ini\LICENSE
Size 765B
SHA256 4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b
MD5 82703a69f6d7411dde679954c2fd9dca
SHA1 bb408e929caeb1731945b2ba54bc337edb87cc66
SHA512 3fa748e59fb3af0c5293530844faa9606d9271836489d2c8013417779d10cc180187f5e670477f9ec77d341e0ef64eab7dcfb876c6390f027bc6f869a12d0f46
TLSH
T1E401FD9FB2E26BD458D09B603DA16DC962CAB03B7803AA152468E298DB7740FA47A400
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\Temp\tqx_checker\node_modules\minipass\LICENSE.md
Size 1KB
SHA256 8a1af140fdfbf5afd3df27f7e662f989c5b963a300020dfafce42033cae9e004
MD5 95e9f67f2840df3a3a09a77ef3aea34b
SHA1 04b424df89f0c4840f5f64286a19afd84bee2466
SHA512 b1e087ec6f6e4a139b043c99b203d75ac1ad10c23148df1417b191dc382649d076c05d0eaf640f667b9c8b1ebe0d0f185e03f0d9f3d6d67d58776ec28e90f0c4
TLSH
T16131EF2F7259276352E14219AF4370BFF50A493D976A17F6349A901433F6A2602FB8F8
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\Temp\tqx_checker\node_modules\p-map\license
Size 1KB
SHA256 5c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3
MD5 d5f2a6dd0192dcc7c833e50bb9017337
SHA1 80674912e3033be358331910ba27d5812369c2fc
SHA512 d1f336ff272bc6b96dc9a04a7d0ef8f02936dd594f514060340478ee575fe01d55fc7a174df5814a4faf72c8462b012998eca7bb898e3f9a3e87205fb9135af2
TLSH
T18221931E7254136318BA13A0696A6CC4B32BB11F7DAF6B8418ADF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\tqx_checker\node_modules\tar-fs\LICENSE
Size 1KB
SHA256 3fe8d55a98dbf260eace67c00cf9bc53edb46234e840098a0b93df3096b97fb6
MD5 9befe7026bf915886cd566a98117c80e
SHA1 a95ab3a4b0e4bd978897f09b3b430a449da20a08
SHA512 b52ba143042812d6dd1031a12946afddb6e8f8ebbc7169c59c138d16aafc5e261aae92fe6b1ea94a3d80e39d2415c4b219710ef46939a2df135db24a0cf712fb
TLSH
T14E11B91E735507761CAA13605579ACD9F12BB25F7A6F1A44146DF340133A06CD1FB840
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\Temp\tqx_checker\node_modules\yallist\LICENSE.md
Size 1KB
SHA256 a49c9ba464796f65b59fca3f1e6ca40912df1e859f575383223f7ec6c5baae09
MD5 add98d83942d5809bc719262ae40f4ce
SHA1 17dc270ca93a72a075b821095ddcc4b910ca7554
SHA512 49ceb8da2d4faf9d7c8267271504fd7cb8015f2a3bce085033593ea095af61665322a10d5ee44851d24f29f1f61a0b8e538fb46d692bc5ae173ab3e26fcfc7e0
TLSH
T1C231211F7348676353D1421A6F4360AFF60A497C675A02F2345A901833F2A2602FF8F8
MD5 SHA1 SHA512 TLSH

Submit Download

start.vbs

Path C:\Users\Admin\AppData\Local\Temp\tqx_checker\start.vbs
Size 369B
SHA256 d27d91ed57e74c6987805cc2547781f6f948c5ec351d95a9da2606db9a7eb28d
MD5 5877c540b5512dee5f099a55ffad6c2f
SHA1 1f7957abf1e75c635ce15335c3e37d28d1d58396
SHA512 582596dff579102b8fe775d6b214cdecdf1abcfe09a50a24b528ecdfa4b802ee15391c2c04d6c94b21b2441e464f13be6ae365b19cf9ee9b86d997a5ef357880
TLSH
T162E02019A815933E1DAE41A197E54416ABAAE1510139E4060FF9858557473FD133609B
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads