f6ba97bdea91db767622a98c96fd3432f1ca0fefae132312f4f8c7095408623a

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Size 9.5MB
Sample260809-ch6dsssse1
SHA256 f6ba97bdea91db767622a98c96fd3432f1ca0fefae132312f4f8c7095408623a
MD5 97518d632963ea7cc4ea67337b0e688b
SHA1 208ca5b4d9a2cf43f9e71614d92a86821c99bcfb
SHA512 ed0d13b90880c70aa399d0da02a78c6640f690a32771fc8e9bf1ae884076e515759ef07633ac33c43fc870e40dc47764864762afbec5e026c979bb2bbf89a759
SSDEEP 98304:2kJJPu6KZ6o1sw5H4BftoasojQcx91XyO6Yujw+B8z:2kJRc6isw5H4BftoasojQcx91XH6b0z
TLSH
T18EA68C56E37800E8D4AAC2B8C7465157D771744A03B0ABDF1A90AEA12F37AE51F3F712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurity__vqjgsz.lnk	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
1164	runtime_service.exe
4440	runtime_service.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdate__1qobh8rh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\BoundRuntime\\runtime_service.exe"	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1620	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
1620	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3316	7z.exe
Token: 35	3316	7z.exe
Token: SeSecurityPrivilege	3316	7z.exe
Token: SeSecurityPrivilege	3316	7z.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2436	1620	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	85
PID 1620 wrote to memory of 3316	1620	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	87
PID 1620 wrote to memory of 1164	1620	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	102

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "MicrosoftEdgeUpdate_m4wi" /tr "\"C:\Users\Admin\AppData\Local\Temp\2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe\"" /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2436
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" a "-pVoidGX123" -mhe=on -t7z -mx9 "C:\Users\Admin\AppData\Local\Temp\vg__13ufmel\Logs.7z" "C:\Users\Admin\AppData\Local\Temp\vg__13ufmel\organized\*"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3316
- C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe"
  2⤵
  - Executes dropped EXE
  PID:1164

C:\Users\Admin\AppData\Local\Temp\2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
1⤵
PID:1768

C:\Users\Admin\AppData\Local\Temp\2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
1⤵
PID:2376

C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe
C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe
1⤵
- Executes dropped EXE
PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Logs.7z

Path C:\Users\Admin\AppData\Local\Temp\vg__13ufmel\Logs.7z
Size 3KB
SHA256 336411d5fd557aabdc0f7af827ea3c1bc5f7f3f3e3707b6869ac5e8d0d69f254
MD5 fd002d887deef7aa2f04020be5a49f24
SHA1 552ee49feffb27bcffbc407c95c552901225e569
SHA512 9263638f95a20d66eb85ff86ae9b0c7b707e864b80a4efbe84cd916ee4cee06327cba4662bb8e0d2f50aff6568db9232bb89ab4da75b837bee342b0923eed2aa
TLSH
T1D151399D70DEC4ADBA7A9F315235CB57BE08A39E6B434CBE7C8D1C428323DD09A42905
MD5 SHA1 SHA512 TLSH

Submit Download

Desktop.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__13ufmel\organized\Directories\Desktop.txt
Size 961B
SHA256 8a092029093251ba23b83e17687b65abb0ffd807687b769774bf3c1f0bacf054
MD5 2ee6c404957ee5e2b36536b30f56e09c
SHA1 5d9d092d339767994a4a7e0c9f265eb50e90f30a
SHA512 9566fcdc25b7010ffa200753c50a12edf533e2df352e4167e0a0d3c0938eb7372a9d89e7adc60ffc0bbb8eaf2d37bb0f917b04685c23fa0dcd9ea015a72a5c9b
TLSH
T1EE11BA9D9975ED0F2DEAFAB21340B10711CA1CC0FE42E1A37B8DDC96764B92A4464C23
MD5 SHA1 SHA512 TLSH

Submit Download

Documents.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__13ufmel\organized\Directories\Documents.txt
Size 637B
SHA256 673a990c800162634bd9e414e48db7dd07f7853ec79b7a199f00b409da2b8125
MD5 d46eede5acfb3f45314715a2c75e3952
SHA1 ad28e1fe67b466348ed0acc8fecfb013e44ce618
SHA512 c4eda7683239b0408f70b46916269f48f159ff8fd73686a409406c4d25b14db49fe843959f17dff7a59f60d081c95280751c694a7292beab36d90adc00b3313b
TLSH
T10BF026C8147DEC9E095BDEE607D0759706C15ACBADB5F47E3B8ECD000281A2160CCC03
MD5 SHA1 SHA512 TLSH

Submit Download

Downloads.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__13ufmel\organized\Directories\Downloads.txt
Size 1KB
SHA256 e1d16b6afaaf1d84da6f136d3587385a8e635fad0fc7544afddee52d00b1b3fe
MD5 a3434517b58be358830a93014ba52785
SHA1 f5ed88a46063566a592a50dc263609807f1263aa
SHA512 667fe3641a6384321a17c692a3a1b6ec0105a17cc0a2b01e52d966d614ea0bca04ada9786e86ef2c0882864facb1bae43b9097ddf60186cd6c5e9e209467b00b
TLSH
T1B82112C96A35DD1E3E452EA41B3076474AC645CE1D6DF5B23BDFDDB0461AF1980A0806
MD5 SHA1 SHA512 TLSH

Submit Download

Music.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__13ufmel\organized\Directories\Music.txt
Size 1KB
SHA256 886e572cc09c1bdab9ed6e45b2fde29d3ab1f7e5b79c839f1af30d6ec003076c
MD5 f9348f444d5cf3f644fd0a91035547df
SHA1 94b16188aa3c9323a39d45a99b110a81b413fe2c
SHA512 1dd493390a55069c8161600ddf79d5759452df09bd510f7a9cc288429981accab0662886177468061cd7aeb858cfa490058b7b13f2ea2ec141aed6470fdb962b
TLSH
T1F62120AF9E34FD5E3A19BB741B40F98341C2F9C42E85F07A3BCECC20420176685B6816
MD5 SHA1 SHA512 TLSH

Submit Download

Pictures.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__13ufmel\organized\Directories\Pictures.txt
Size 1KB
SHA256 89f1bc6cfd217fc083e5a3639fd97e63f5d249f0d14d2be168506091d263d2f7
MD5 08fc66686e7d4d04af4b37c23c5d7b69
SHA1 b54c4ce3802b03621cc47ab56bad82d984868167
SHA512 c4da8c357dfe466e40e4610cbde199f668c9a635cd53c58d6f92b1db0c79ececfb0379d61aa8e5f45ef770265f76776df59fcc92899a617be8a03c766e761048
TLSH
T1E9219E4B7A79EC315A861ABD17543A831AD0E9CE4E06F57373CCECA5DB167490862C83
MD5 SHA1 SHA512 TLSH

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__13ufmel\organized\Directories\Videos.txt
Size 64B
SHA256 0168720facabf636d9307e93790f3326f5e32601d23b172a41e4436d8f0072ae
MD5 8100dc3aba0a9885142dcf57555aeb26
SHA1 dad54e7648029a2821f0ccbe29d6c19565eb859e
SHA512 391c3ace74e6c4c56dc7f1fda276f5bea8dd5572db784528156f3c3c4f9771600bd0b9f59f01b85462acc4d14292aad646422588d0bfed8396cfaa6a8bf54595
TLSH
T174A0220A38AF0E2B000C20E20238E00CC38F0C823F802A0833838280C8030200AB00A2
MD5 SHA1 SHA512 TLSH

Submit Download

System Info.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__13ufmel\organized\System\System Info.txt
Size 65B
SHA256 b975f5f4c8442c5c8862124525ddb2eb739d44d11356f82caa67857877d6b61f
MD5 cb91436f426e9a88f5497691a1b8c5db
SHA1 5c7753589fc975191fe01fe6c4e2837703bc0481
SHA512 4c281ed136fba3cb18658cdfadd6024db683cc7d412dbdc9b8d420ab5f5e0e92adf7dbac83f5257a3598f3f2607e70085ec0059d343e3de2b7b40d2e4d00a9bc
TLSH
T1FCA022F230C332CCA2EF0000200200CA0030AE8AF08BF208203C00C20E3C0CCC3CC08B
MD5 SHA1 SHA512 TLSH

Submit Download

Task List.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__13ufmel\organized\System\Task List.txt
Size 2KB
SHA256 3534bd37a266ccbd30861ffdf55987318a7fb2ec7cd38b2e7dc54115a5c476be
MD5 98b3141754a8cbf6b835f5ddc79bf133
SHA1 e3dc473ba1916254fe634e22d20b5780cf542c11
SHA512 a4cbdf1e3be52a99ee919a038047e98472b6f6dff99c2da3db4041a797ea98baa8d873eab7fde366250bf8f4bbbb8c67806d0c608d0bc69dc7b76ecb2986298d
TLSH
T1F141940B909FA6CCE2D512EF3E60225F1BAB194C018F9CD971521AEC28B0C1DDA4B72C
MD5 SHA1 SHA512 TLSH

Submit Download

results.json

Path C:\Users\Admin\AppData\Local\Temp\vg__13ufmel\results.json
Size 361B
SHA256 372b325b7a57c6c2442aeade21a3356c090266121165b049c81ccf41b5570fe4
MD5 69568069d730abdd3b4e60b553fe2191
SHA1 aa0f12ffef5e1bd51d3ca532e6ed6cc5d341e128
SHA512 05c97eaa2dd6e73d171b765220dc13b2c3d14a804e58ee2047745b97a8f5dbf7d0b596e48d419419db6b8dfca3bb1dcf8a748571c58586088aac254a0e6fcadd
TLSH
T115E08622E6610E5334DAE86594A71742B3F0564B4E153D0AFB85DD1C0F0E07F35B756D
MD5 SHA1 SHA512 TLSH

Submit Download

runtime_service.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe
Size 29KB
SHA256 927004a7ed771954853acfd331baf0a2d74c84037d4adff5a4a65fb1b287e586
MD5 dbd2194b7a5b38636edf7112ebc6fe91
SHA1 6fea8daee367fbdee5a299a214c0419ef04ea7bb
SHA512 238cf410957b64bc0f8997fb3669b6f362e6b170c942fecca43ddc72a73ebffe75d829f0bade82cc712ca6786d6083921df9648d8c7a19ddc1e0de55cc526d42
SSDEEP 384:rHrg8dKZcKMUK+ftkHia5hPAiGfWjf4qHWv6wzbkROjDAZBoVYUb+harH+AtN7hO:rHrJdW1g4N6IgO8oVFChcWqfvB+A5+z
TLSH
T1FFD2290173EC863BE6FA8BB555B151220BB3B99B1572FBCE5D94508E0CB3B409311B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1164-30-0x000001F112F70000-0x000001F112F7E000-memory.dmp

Download