Overview

overview

10

Static

static

10

2026-08-09...lc.exe

windows10-2004-x64

7

2026-08-09...lc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 02:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_7f815c157bc619596deb26c2b9e3fb7e_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
  • Size 9.5MB
  • Sample260809-ckh2aaybrh
  • SHA256 aa9101be40a898db320981b3f41c7db4040a5eda4e1984c06560102d6c6291b8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_7f815c157bc619596deb26c2b9e3fb7e_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_7f815c157bc619596deb26c2b9e3fb7e_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
    1⤵
    • Adds Run key to start application
    • Checks for any installed AV software in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3216
    • C:\Program Files\7-Zip\7z.exe
      "C:\Program Files\7-Zip\7z.exe" a "-pVoidGX123" -mhe=on -t7z -mx9 "C:\Users\Admin\AppData\Local\Temp\vg__eskyv\Logs.7z" "C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\*"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3048
    • C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe"
      2⤵
      • Executes dropped EXE
      PID:3728
  • C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe
    1⤵
    • Executes dropped EXE
    PID:3380

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        2
        T1552

        Credentials In Files

        1
        T1552.001

        Credentials in Registry

        1
        T1552.002

        Discovery

        Browser Information Discovery

        1
        T1217

        Query Registry

        1
        T1012

        Software Discovery

        1
        T1518

        Security Software Discovery

        1
        T1518.001

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Lateral Movement

        Collection

        Data from Local System

        2
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Logs.7z
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\Logs.7z
        • Size 8.0MB
        • SHA256 727b8738354944e314203a07ddca359e90d8526f902c0d761b3464f6c1338bae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Bookmarks.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Browser\Firefox\Bookmarks.txt
        • Size 367B
        • SHA256 4dc748ca7535f1c6a8cc1414733d9459457b3d2080a3a5e96386570af9a0647d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ConvertReceive.rtf
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Common Files\Documents\ConvertReceive.rtf
        • Size 827KB
        • SHA256 14358bcafbeef3cd46a482750228ae8da1a4993d7e5615af17381a2f63d7a01e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DisableInvoke.xlsx
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Common Files\Documents\DisableInvoke.xlsx
        • Size 11KB
        • SHA256 154ad13c3d8cb01626affe4e13123c38f043b7a6655c1f0eb210bab58d158a82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EditApprove.docx
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Common Files\Documents\EditApprove.docx
        • Size 14KB
        • SHA256 db8f13e7301ae9dbc49186deffe992c025374ef8d1299edd494e85c5035a5553
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EnablePush.docx
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Common Files\Documents\EnablePush.docx
        • Size 13KB
        • SHA256 b60fcb5f336544d0747abbd6f31ab2f329916545f513438e33ea9535137d617c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GetPush.xlsx
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Common Files\Documents\GetPush.xlsx
        • Size 11KB
        • SHA256 3f451b0888edce40846f0d4bd6d6211caf69629439eb1d9370ef7a4fba6ec77e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MeasureCopy.xlsx
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Common Files\Documents\MeasureCopy.xlsx
        • Size 11KB
        • SHA256 5c7fcd39bf19bbb374e332f41b0d7f129ffcf11901ec90333e09ab81b8f65556
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MoveUndo.pdf
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Common Files\Documents\MoveUndo.pdf
        • Size 1.0MB
        • SHA256 47f2700db1222e80ff1c8c53b00e2019173a68854aecc9082c0ffbf8df9b16ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PingInstall.docx
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Common Files\Documents\PingInstall.docx
        • Size 897KB
        • SHA256 8cf3c4da20e880b0c33beb661cb654f8d5b29a54304aecfd76c6b9e9fcb52174
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PushSelect.xlsx
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Common Files\Documents\PushSelect.xlsx
        • Size 1.4MB
        • SHA256 9514c3a8cfc61591afdc237dd4cd592268116879723142bb9919432ed3ef1d54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RedoExpand.csv
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Common Files\Documents\RedoExpand.csv
        • Size 1.5MB
        • SHA256 e885bb47b977644e3a0b4fb5f40d9718f2d8dba5729b2e6052b6df17b58af174
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        RenameUse.xlsx
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Common Files\Documents\RenameUse.xlsx
        • Size 10KB
        • SHA256 9378ff265278a3f6e88e912437dc3d6bf5cf500b24e70bdafea115aae0b29e8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SendGrant.docx
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Common Files\Documents\SendGrant.docx
        • Size 16KB
        • SHA256 76fc733cde904b0efc101c03c9a37be37c4250ff9331bfcebe7632da2d8c0d38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SendOptimize.xlsx
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Common Files\Documents\SendOptimize.xlsx
        • Size 12KB
        • SHA256 92b977204f01dfdf22617142372784edbf2165960dda16debbf1337d99c50a7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SplitConfirm.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Common Files\Documents\SplitConfirm.txt
        • Size 973KB
        • SHA256 8b9c10f387f58e5fc4d192f1a3f041cc84b588d9ae6f87896d67441fef13fdb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StepOptimize.docx
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Common Files\Documents\StepOptimize.docx
        • Size 19KB
        • SHA256 b0bf0b99dbc1b835ff06ddfdeedb0ce68ce5b440e83bac571d354092acd7fc91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TraceDisconnect.csv
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Common Files\Documents\TraceDisconnect.csv
        • Size 1.4MB
        • SHA256 2b3940f745479815dac6d42d5702d7ae674274df2513cf98aaa600617fb7698c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        email_clients.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Credentials\email_clients.txt
        • Size 205B
        • SHA256 823a9d96026822191f9b73e645cde5b2f09e3f9b62baed52581d98010256c7aa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Desktop.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Directories\Desktop.txt
        • Size 1KB
        • SHA256 f5f0c74100f3e7923c3db29e0452bee5f4b16e0be04f2412fb88386af87f0cad
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Documents.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Directories\Documents.txt
        • Size 929B
        • SHA256 002986e9209a06f0b775c698068ea269e90a745b0972c21551353697ce957674
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Downloads.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Directories\Downloads.txt
        • Size 1KB
        • SHA256 d28df0a16d078faadbe2665f8c4d9514f47af56936c0dcab90e65d40f7be4713
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Music.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Directories\Music.txt
        • Size 1KB
        • SHA256 b86d741acd67642a1c831c35a58d82c3e11406be54d8dd0b36a520931a37d121
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Pictures.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Directories\Pictures.txt
        • Size 1KB
        • SHA256 689493ccedf791f2a607190b8e3384b8f3f61379d165c0f69bba82b23b72dff9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Videos.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Directories\Videos.txt
        • Size 64B
        • SHA256 0168720facabf636d9307e93790f3326f5e32601d23b172a41e4436d8f0072ae
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        items.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Other\Bookmarks\items.txt
        • Size 467B
        • SHA256 c96f18685c55242c5715b74af17c1a9358defc38120652c9438c9e7f830b9af5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        items.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Other\Email\items.txt
        • Size 239B
        • SHA256 ad916c696e598b343c4eec19934f85fd19eae29c68148f502c05bd6aadd3c2f0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        items.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Other\Environment\items.txt
        • Size 655B
        • SHA256 7b22c5e6f0aea91005b95a3861ee3b4600067a7d4e958ee55d0827d82e665916
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        items.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Other\Fingerprint\items.txt
        • Size 429B
        • SHA256 b510738c0bf10bd977319bf661e87c8a488d792f8941d20daa513375788de54a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        items.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Other\Processes\items.txt
        • Size 6KB
        • SHA256 086243c00b0ebc2aebdffbaefde01093f4997405c8522936b9b192648481b9ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        items.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Other\ProductKey\items.txt
        • Size 199B
        • SHA256 ce2e17e65c944740d27137fb9a8e0e3231d626d427bd86106ba31ab1c84e0efd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        items.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\Other\Software\items.txt
        • Size 2KB
        • SHA256 5a195eb70f8b570058793212cb263725822fa3fec2d54bfdbd8c5c366ad23186
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Antivirus.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\System\Antivirus.txt
        • Size 31B
        • SHA256 7b56726c474b8da981e067e36bcd5fbd9efcec4cadc69d2a1c416b9832eede97
        • MD5 SHA1 SHA512
        Submit Download

        MAC Addresses.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\System\MAC Addresses.txt
        • Size 34B
        • SHA256 c91157d75e7f3f2ac5a04519291571b95733c2da70efea54b66bd94fc98d41e0
        • MD5 SHA1 SHA512
        Submit Download

        System Info.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\System\System Info.txt
        • Size 679B
        • SHA256 e58555bf0ae1550e1ce659d2cd43b5c2189b9801a0d1004bfe0cbc6c295a23fc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Task List.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\System\Task List.txt
        • Size 2KB
        • SHA256 bcd5ef6299f63f1a523efe18d703ee57b83bc6503e38cdd21685889f0d0f233a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        results.json
        • Path C:\Users\Admin\AppData\Local\Temp\vg__eskyv\organized\results.json
        • Size 35KB
        • SHA256 75780a0ce0ef965bec19f0d82435e57b2848867ba1cf871784c8a09214ff3b45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        runtime_service.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe
        • Size 29KB
        • SHA256 927004a7ed771954853acfd331baf0a2d74c84037d4adff5a4a65fb1b287e586
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3728-108-0x00000261BE220000-0x00000261BE22E000-memory.dmp
        Download

        memory/3728-109-0x00000261BE610000-0x00000261BE620000-memory.dmp
        Download

        memory/3728-111-0x00000261BE610000-0x00000261BE620000-memory.dmp
        Download