f6ba97bdea91db767622a98c96fd3432f1ca0fefae132312f4f8c7095408623a

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Size 9.5MB
Sample260809-ch6dsssse1
SHA256 f6ba97bdea91db767622a98c96fd3432f1ca0fefae132312f4f8c7095408623a
MD5 97518d632963ea7cc4ea67337b0e688b
SHA1 208ca5b4d9a2cf43f9e71614d92a86821c99bcfb
SHA512 ed0d13b90880c70aa399d0da02a78c6640f690a32771fc8e9bf1ae884076e515759ef07633ac33c43fc870e40dc47764864762afbec5e026c979bb2bbf89a759
SSDEEP 98304:2kJJPu6KZ6o1sw5H4BftoasojQcx91XyO6Yujw+B8z:2kJRc6isw5H4BftoasojQcx91XH6b0z
TLSH
T18EA68C56E37800E8D4AAC2B8C7465157D771744A03B0ABDF1A90AEA12F37AE51F3F712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurity__v6m0c9.lnk	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Executes dropped EXE 2 IoCs

pid	Process
1352	runtime_service.exe
1976	runtime_service.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate__vm72k7 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\BoundRuntime\\runtime_service.exe"	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2456	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4372	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
4372	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4104	7z.exe
Token: 35	4104	7z.exe
Token: SeSecurityPrivilege	4104	7z.exe
Token: SeSecurityPrivilege	4104	7z.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 2456	4372	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	88
PID 4372 wrote to memory of 4104	4372	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	91
PID 4372 wrote to memory of 1352	4372	2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /tn "MicrosoftEdgeUpdate_lpn" /tr "\"C:\Users\Admin\AppData\Local\Temp\2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe\"" /sc ONLOGON /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2456
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" a "-pVoidGX123" -mhe=on -t7z -mx9 "C:\Users\Admin\AppData\Local\Temp\vg__8s55g\Logs.7z" "C:\Users\Admin\AppData\Local\Temp\vg__8s55g\organized\*"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4104
- C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe"
  2⤵
  - Executes dropped EXE
  PID:1352

C:\Users\Admin\AppData\Local\Temp\2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
1⤵
PID:1768

C:\Users\Admin\AppData\Local\Temp\2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
C:\Users\Admin\AppData\Local\Temp\2026-08-09_97518d632963ea7cc4ea67337b0e688b_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
1⤵
PID:5912

C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe
C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe
1⤵
- Executes dropped EXE
PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Logs.7z

Path C:\Users\Admin\AppData\Local\Temp\vg__8s55g\Logs.7z
Size 2KB
SHA256 8c47979a368992c82720f556955528aed765e59fa48b95978660e3c3346ad4c5
MD5 fa8de40c82ee380cd55b26873491aec1
SHA1 801c07108117fea3e91eb5148ae0a960ccc522c0
SHA512 e6b98a7a05c0ecd8eb1918a5ecc5841cf11845d14dda37a0249fb23cbc8343ef544d0dec91a8bac931a1a1eb05a7ed00d2b7ac3f991fea437f6ff59cbf4ee512
TLSH
T1A1515B451A9A59DBC5B12FF8B98F14CFC830DF8B847C4CF8F888AB950835A6024D9891
MD5 SHA1 SHA512 TLSH

Submit Download

Desktop.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__8s55g\organized\Directories\Desktop.txt
Size 925B
SHA256 db566f9fe423e75f0bae3e1d8987107176b93239824df47d9cb40b8cb1734b7e
MD5 e7a9825b17e0f9a68a13f5520be1c98f
SHA1 2f7a56228352084d41ec21265d39948531345c55
SHA512 4064b532b99cbb72140b7d755194d7a8bf53b7b3e54013592b22d6ba5eae2e54445fb29bd6895c1135600f7d3ba3c1c2940ebc1e7296249dd5182f3ec2adf47d
TLSH
T18411DC894935EE3D4A1556E69B31F4470BCE0CC8AF89F8B233CFD894434F68590B8C1A
MD5 SHA1 SHA512 TLSH

Submit Download

Documents.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__8s55g\organized\Directories\Documents.txt
Size 559B
SHA256 0533c3e3bd22345db57c9b3ffbbdcec73bcd14829bf0e5f228d907956956be24
MD5 6cef10711a18248d91647793ea720499
SHA1 0bba42dfe18b2115eef6a40bbff396d708e6a925
SHA512 8826fa51970d047d14fb5bb60ac649b6dae66cf4aa43fd1dd42a88b8730ed1e7f7a0284db8bdfae653fdc59cbd9cbbaeeb9a4c62b016d284ef52ccec0c222279
TLSH
T169F08BC92075881E2283EED94BA0F98342E617CF8EB1F2BFBF6F8970500961044C8C07
MD5 SHA1 SHA512 TLSH

Submit Download

Downloads.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__8s55g\organized\Directories\Downloads.txt
Size 1KB
SHA256 96fe7465c605da3de6f2312c2ed4a628d37ed2789c32625ff4ff12f483e37adf
MD5 dc5e13c589481c4a2a118be13596dd68
SHA1 39c91fef9371954a0cce03faee94d8a9c5be0ba5
SHA512 2952431e521693419e88bf3f2d80b0bed9e7be00c13fa93b8fe868315169f2b4f7d8cd037375f697d75f13ce015a966aef617844c3fad6c1cb0b506c8443a371
TLSH
T1EF2103DA6571DE2E3A613E791B91744702C92CC55E33DFFBBBCED5D11A0AA091032842
MD5 SHA1 SHA512 TLSH

Submit Download

Music.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__8s55g\organized\Directories\Music.txt
Size 836B
SHA256 7a3c74585fd928d67c14fa73a6a173452e9fd57629691f5a2185011935f3fb28
MD5 240d1a7b8d21b4e3efec2a9ffb5d4322
SHA1 20b5af02f33011685c01db59dcde6334201671d3
SHA512 fc9f95e25ed9a73eb1a70646fd539de58f2202132efa3b6fd9eabb8c49034d62bfb2b25396ba4b65cbced5d697bfdf5dc3a29c9d00cedea8651708e14c604e17
TLSH
T1C40141D91435DD7A2A163DE41760B48703DE02DA1DA4E1B33FCDDDCA1645E0A8CB1C02
MD5 SHA1 SHA512 TLSH

Submit Download

Pictures.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__8s55g\organized\Directories\Pictures.txt
Size 663B
SHA256 3e83e19a303a73ed939a9e3134ffaea6e47b07368c9a01929bece6efef35efd5
MD5 034c919e5619b01095774e42d172d3f4
SHA1 21a654d8132bfb9b3aa928e1e31fb4a3421aeef4
SHA512 57bd762df8ed7835739b7e8594aac3c0726f3dfc0926c211007d476298d1556f91f0f8cbeab4b5b9ba6231a1bdbd69b148f68afdb9a595171957b9bfac5a0f43
TLSH
T105017DEB6A29D9109D071DE92FA1F64B82C40BC7AC20DE7F32DFCD12490560989A5CC3
MD5 SHA1 SHA512 TLSH

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__8s55g\organized\Directories\Videos.txt
Size 64B
SHA256 0168720facabf636d9307e93790f3326f5e32601d23b172a41e4436d8f0072ae
MD5 8100dc3aba0a9885142dcf57555aeb26
SHA1 dad54e7648029a2821f0ccbe29d6c19565eb859e
SHA512 391c3ace74e6c4c56dc7f1fda276f5bea8dd5572db784528156f3c3c4f9771600bd0b9f59f01b85462acc4d14292aad646422588d0bfed8396cfaa6a8bf54595
TLSH
T174A0220A38AF0E2B000C20E20238E00CC38F0C823F802A0833838280C8030200AB00A2
MD5 SHA1 SHA512 TLSH

Submit Download

System Info.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__8s55g\organized\System\System Info.txt
Size 65B
SHA256 b975f5f4c8442c5c8862124525ddb2eb739d44d11356f82caa67857877d6b61f
MD5 cb91436f426e9a88f5497691a1b8c5db
SHA1 5c7753589fc975191fe01fe6c4e2837703bc0481
SHA512 4c281ed136fba3cb18658cdfadd6024db683cc7d412dbdc9b8d420ab5f5e0e92adf7dbac83f5257a3598f3f2607e70085ec0059d343e3de2b7b40d2e4d00a9bc
TLSH
T1FCA022F230C332CCA2EF0000200200CA0030AE8AF08BF208203C00C20E3C0CCC3CC08B
MD5 SHA1 SHA512 TLSH

Submit Download

Task List.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__8s55g\organized\System\Task List.txt
Size 2KB
SHA256 b8a561864fc3ef12fa460e1366e66606f89dc6b29cf6a29dc59fc7baa124dfad
MD5 1a139f5a8190994641b85adfa595d695
SHA1 e6f7d7aa4a32c5c899a4718b1ccedd5391d07471
SHA512 a692090163896e9b8ea054af14a5ae970e3bbf68d54aa77b9be68bf22c65d1586f94eaaab7c3f5fd42a33bd0ea1e0a762aba3f18bb1cbd3e2a3a05ebd77c9e68
TLSH
T1ED41B407C19FC6DDD5D561EF3E242A5F1BAB042C000F6CDA728209EC68B0C1EDA4AB6D
MD5 SHA1 SHA512 TLSH

Submit Download

runtime_service.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe
Size 29KB
SHA256 927004a7ed771954853acfd331baf0a2d74c84037d4adff5a4a65fb1b287e586
MD5 dbd2194b7a5b38636edf7112ebc6fe91
SHA1 6fea8daee367fbdee5a299a214c0419ef04ea7bb
SHA512 238cf410957b64bc0f8997fb3669b6f362e6b170c942fecca43ddc72a73ebffe75d829f0bade82cc712ca6786d6083921df9648d8c7a19ddc1e0de55cc526d42
SSDEEP 384:rHrg8dKZcKMUK+ftkHia5hPAiGfWjf4qHWv6wzbkROjDAZBoVYUb+harH+AtN7hO:rHrJdW1g4N6IgO8oVFChcWqfvB+A5+z
TLSH
T1FFD2290173EC863BE6FA8BB555B151220BB3B99B1572FBCE5D94508E0CB3B409311B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1352-27-0x000001FC00130000-0x000001FC0013E000-memory.dmp

Download