aa9101be40a898db320981b3f41c7db4040a5eda4e1984c06560102d6c6291b8

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_7f815c157bc619596deb26c2b9e3fb7e_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Size 9.5MB
Sample260809-ckh2aaybrh
SHA256 aa9101be40a898db320981b3f41c7db4040a5eda4e1984c06560102d6c6291b8
MD5 7f815c157bc619596deb26c2b9e3fb7e
SHA1 23216ff7581795a249f7bc0715edd4a9040ae96e
SHA512 d36f64d95b5258f69156599b373a7dbbd09d696db7142230778f4dc36fd18a89c333407fc7c033922e62683c21ec9fb5b14e55640fe4b7ebcbc885c50ef8070e
SSDEEP 98304:/kJJPu6KZ6o1sw5H4BftoasojQcx91XyO6Yujw+BxS:/kJRc6isw5H4BftoasojQcx91XH6b0S
TLSH
T10BA68C56E37800E8D4AAC2B9C7465153D771744A03B0ABDF1A90AEA12F37AE51F3F712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5656	runtime_service.exe
3344	runtime_service.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\BoundRuntime\\runtime_service.exe"	2026-08-09_7f815c157bc619596deb26c2b9e3fb7e_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	2026-08-09_7f815c157bc619596deb26c2b9e3fb7e_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
3	api.ipify.org
6	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3180	2026-08-09_7f815c157bc619596deb26c2b9e3fb7e_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
3180	2026-08-09_7f815c157bc619596deb26c2b9e3fb7e_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4628	7z.exe
Token: 35	4628	7z.exe
Token: SeSecurityPrivilege	4628	7z.exe
Token: SeSecurityPrivilege	4628	7z.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 4628	3180	2026-08-09_7f815c157bc619596deb26c2b9e3fb7e_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	89
PID 3180 wrote to memory of 5656	3180	2026-08-09_7f815c157bc619596deb26c2b9e3fb7e_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-09_7f815c157bc619596deb26c2b9e3fb7e_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_7f815c157bc619596deb26c2b9e3fb7e_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
1⤵
- Adds Run key to start application
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" a "-pVoidGX123" -mhe=on -t7z -mx9 "C:\Users\Admin\AppData\Local\Temp\vg__xlfg\Logs.7z" "C:\Users\Admin\AppData\Local\Temp\vg__xlfg\organized\*"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4628
- C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe"
  2⤵
  - Executes dropped EXE
  PID:5656

C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe
C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe
1⤵
- Executes dropped EXE
PID:3344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Software Discovery

T1518

Security Software Discovery

T1518.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Logs.7z

Path C:\Users\Admin\AppData\Local\Temp\vg__xlfg\Logs.7z
Size 1.3MB
SHA256 446b196dd5db02f79d88bbf40b4760034714c0f673d82b486ed05260b72ce590
MD5 e91d40cbc9b88c8305f2163320d20229
SHA1 9c73d80e00fea45b5f8bb94b648b9aed869851f2
SHA512 fb793fd0573195fd5e984351085aac5849a10fcfc393a7affcfe7cc7d30a8db32293ca07c8551d58a617dfb900bd6f589cf849bbed1e2ae5af70ebd84c24d1e6
SSDEEP 24576:t8kXbnA5AJpUm8dkWjBCdTtI/MTQjxlgVjc14/2ChFyCCbNw9q:t8kbnA5AJpUm8dkWjodTsMTGxlKjh2Q+
TLSH
T19365336DB436BD01F13513B19BEA8A76D8C886C924B37ED3E9C44DCD784748971BA283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__xlfg\organized\Browser\Edge\History.txt
Size 66B
SHA256 982bc4c33531c8dc768a76be5913cb723f5641b0432febd4339d6f1ad88f0ac6
MD5 be64fd54e7f4a36bba743f42b9b7c173
SHA1 246d187d57af5a80fd876fac33b96d7471ede520
SHA512 8e24b27c432d59ceaebe1047837764bf5b3567ca5b8b3848b7b142014d83daa4edb219d6ad4091e9141c2f017181bbdb116b16ad606ab603ed1ccf3924a4aabf
TLSH
T120A02208E22280CA0B2C00303A8B8008282EA00E03882022A0C00882F808A3B02C2CF3
MD5 SHA1 SHA512 TLSH

Submit Download

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__xlfg\organized\Browser\Firefox\Bookmarks.txt
Size 367B
SHA256 4dc748ca7535f1c6a8cc1414733d9459457b3d2080a3a5e96386570af9a0647d
MD5 1e5809dc37fdb89a5f31aefd8d07e742
SHA1 7d7e459b5709f8480d7b4100ce232c2ce1e5d1ca
SHA512 e76ec273e7a47a9ef0bd69e36c44a601bc49a51005a2263c1f1d2c115c7702045e55a8d70518b750ae8fc4ad5aae23dcb116a5f322cd7f6922f52434e985128e
TLSH
T1F1E0D8A3627241EB4F018B1870297A16644B8708DFF959DEE046247244A93A440E6B4C
MD5 SHA1 SHA512 TLSH

Submit Download

history.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__xlfg\organized\Credentials\Edge\history.txt
Size 70B
SHA256 b7f309d4b10a925559913cb035068575c2486f7ef1a4cf16068820a10573a380
MD5 3bd183c888644c4d8d042b1f89302b9e
SHA1 c68b79aa7f24c055a9e5c724775d07cef3d6011c
SHA512 3ac3f114aad9105a65f75441cbaa9784f5f8325195630db6ef05215b5356cf12f803417bb60029d53076a8fb9d1246ae34201b58da6eb86988e09abb830fe7be
TLSH
T14CA02208E22380CA0B3C00303A8F8008A82EA00E83882023B0C02882F808A3B02C2CFB
MD5 SHA1 SHA512 TLSH

Submit Download

email_clients.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__xlfg\organized\Credentials\email_clients.txt
Size 205B
SHA256 f98851768243ae20f6e1d6991a9e74fe51d120aa4598341675dc304431f5f7b4
MD5 6d1bc2075d982dbe1f42e51a5450bb11
SHA1 470932d8a65bd774fe2055b4c651584bc870c221
SHA512 7c129250425ff2959c7917fa861f9a23cd00e9d2d8f04c35884d7da3b3379b739686c2585a1b4304071b3dbe9e0dd90448962384715e99cce9474e7edd38240e
TLSH
T1D9D01282037E90238830FED43610C6EC3BD6414A32871AC3108EDF0C41071A217ED8AF
MD5 SHA1 SHA512 TLSH

Submit Download

Desktop.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__xlfg\organized\Directories\Desktop.txt
Size 960B
SHA256 9e489435ba3819ed4a64befc3b52efd548bba4deb5057f7c0f752d13b82b8c48
MD5 56d3b93f8f712dc62e8a35092c0c2e93
SHA1 dd942221219d0f965ff10fd04f1b362be187c92c
SHA512 c5f362316ea63a6a8f56802dbf5f2a285fb5e0d991e72d5672a557f7c767147e34b20c6fb626f474a2e37f3fdf168f91a5b84fc327244c075262509edaaa21f0
TLSH
T1FB11BA4F2934EC2E286666ED8BA1FE9302C969CC8E7DF63377CEDAD1A1063944425003
MD5 SHA1 SHA512 TLSH

Submit Download

Documents.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__xlfg\organized\Directories\Documents.txt
Size 817B
SHA256 6a7012954ba8c06d644693682319c7937761abb9c664c2a451e91a89d41dd6de
MD5 8b3e89e93137b92745d6aeb1e37db874
SHA1 d54f4612cac204471dcf0f32ae2486870950b4bb
SHA512 96ae395deb3d9d8a0d8a7873f215057f5a4a6316581d4c00dc6f7274ba0a9f2d0b77588256a4c5617eae68fdc443224996a998c89ff454e98baa8f724c86a168
TLSH
T194014496517EDA2F6963AEA84780786711DC05CB9C70F07B7BCEEE612182B365894C03
MD5 SHA1 SHA512 TLSH

Submit Download

Downloads.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__xlfg\organized\Directories\Downloads.txt
Size 1KB
SHA256 0ba7b3aa09077a43137b9d7b4c01d339e71a044a64e45da02e3e9ca8c29f3363
MD5 780dfd5e9bca2eaa590852dc5a5e6b9d
SHA1 9663ee099cb6d724d80437c0439bad3008d5e7d7
SHA512 7efe67d43387d322e070edbc74352b4c488dc714be8d5aa2dd1693fb693c63681f45b6751dbcdb0d677e6743df5cb522069c4009b026eca658a25e515889096d
TLSH
T1372175AA0B75DB2DBFA133991B60748726C84CCA4E10C96137CDDCB21B447095892C83
MD5 SHA1 SHA512 TLSH

Submit Download

Music.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__xlfg\organized\Directories\Music.txt
Size 549B
SHA256 a9bc852a183c2fc805553ea72e7222f49e7ecba476fc93ae8174fb97e7375267
MD5 c658a1d293ff0cd9f2e33de18d31dcb1
SHA1 734ea6fe32738bcd5a5d22f804532211e555fc01
SHA512 c4ad3a8ff7ca7c4bae53548a4d19c47b12256b24b644e95f9e8ed35fa3085b97ac1d79d7eb10a88cd1b2facb669a04f57124b834eaf505ca239fcc08b14cc85c
TLSH
T1F6F08BC2143ECD5888172E211F63B30303D10BCB1B78F6BD39CEAC74200AA1050E4C42
MD5 SHA1 SHA512 TLSH

Submit Download

Pictures.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__xlfg\organized\Directories\Pictures.txt
Size 1KB
SHA256 8a450cad269e7206bba38b99de621c470f5eee4fde06843eb0f9f8c237a6bfef
MD5 2b485ac990d24247e36222bebccead9e
SHA1 585b203bfee1636b4050204914d24be65cf37fbe
SHA512 94ad5982a95c1b9d05e4c323abf56878e1498b70485668b650a193b254fb74a572abc9ed2e50524dc2d0123d3d344a941a393ae2787cefcb4b9aa64363352d13
TLSH
T1D421C04FA578ED124E4718B91F647A4316D0F5CE9E06F871B3CEACA7DA1130A0562887
MD5 SHA1 SHA512 TLSH

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__xlfg\organized\Directories\Videos.txt
Size 64B
SHA256 0168720facabf636d9307e93790f3326f5e32601d23b172a41e4436d8f0072ae
MD5 8100dc3aba0a9885142dcf57555aeb26
SHA1 dad54e7648029a2821f0ccbe29d6c19565eb859e
SHA512 391c3ace74e6c4c56dc7f1fda276f5bea8dd5572db784528156f3c3c4f9771600bd0b9f59f01b85462acc4d14292aad646422588d0bfed8396cfaa6a8bf54595
TLSH
T174A0220A38AF0E2B000C20E20238E00CC38F0C823F802A0833838280C8030200AB00A2
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__xlfg\organized\Other\Bookmarks\items.txt
Size 467B
SHA256 c96f18685c55242c5715b74af17c1a9358defc38120652c9438c9e7f830b9af5
MD5 98dea30b7155d5ace37749f44523438c
SHA1 6f9e7de66f62d2792eefcc130d844199d1dad0f1
SHA512 8d105b4804e6aadb379961a181effc9c6592f182ba34de63fde293d88d2591215d0b9634dfd483a63af381f989188214f91ce583e9903634fa21f343d64de519
TLSH
T156F0A763E5F1C5AD0F508928F5143109168B670CCBD9517EE046383269B63D810EC3CC
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__xlfg\organized\Other\Email\items.txt
Size 239B
SHA256 1c0e7066dc228c73f5d0014723d2ca5af9460a2f5c92d9abf1eedd73ec79710e
MD5 e35659b415df465cc89d5f6cec62bbf6
SHA1 c172bcc60c2b024d27f9864d677caf6fb3d2a5ce
SHA512 d1eb135e57bd4e4a8a50151e51017f65f91e298a1bbb564fe0da4bc354943486919c0058f21d5ce3112bf3cdafc76ce0783d44656cc04a1b681366527c3594fb
TLSH
T111D0A702C96DD0234570BC992E50C6E03B6F040E754755F740E7E74861331EA42EC1AE
MD5 SHA1 SHA512 TLSH

Submit Download

items.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__xlfg\organized\Other\ProductKey\items.txt
Size 88B
SHA256 f6e3c61f1b91066d5981a4b932a9f573d2d678cef5d02453b2558622b270fb71
MD5 e4857f3979642857537fd1cc63813acd
SHA1 c15ddf9e4a2dd339f36e7fa640c98ace8ff5d79d
SHA512 141d2a8e3b4feddd9f9c2d5a33da65194213d13efdc6d262cebc981fab5f9ae009381d2874b7b60d8b9372f99bbd3ea31e606bab2fff4e026fa0c9c206b4a506
TLSH
T1D7B01240C85DD146F470001214B433C0101E342B44C4046850B0D1D9743204D836422D
MD5 SHA1 SHA512 TLSH

Submit Download

MAC Addresses.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__xlfg\organized\System\MAC Addresses.txt
Size 34B
SHA256 ce3112d92be2f3d7f1382b34b6bdd05f46f28f9bdc2d69e3714b60db5c37fb0e
MD5 11e288228753bc5a0ef49d95be9c289c
SHA1 1b88381ceba27aab3fe357f826621eeb3eea5431
SHA512 3c0e87d954316582ecea1b4116384b1d020ecb0a9f39dd35d1c6effb011172acb3ed956af04d67238dd7ad8ac524553ab847b2e022b5c8b545b8d4df08bf70aa
MD5 SHA1 SHA512

Submit Download

System Info.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__xlfg\organized\System\System Info.txt
Size 578B
SHA256 98e2bb63da66939392ba2036ed878f08166d236765aea923449cf270a91c4c25
MD5 2712ab5c551967b15c42c31448f74801
SHA1 6388c26efbbcaef666fed5ea24b9a62c096827ba
SHA512 464e73c4a37e08c3076173df54a3b5fdb6b399be0eaf06760ab4a3c5d1b5d7874586d4d6cf8a86094ee6728993879ee666112d6edef6c4ef4d035e6481529be3
TLSH
T1C2F0E1E0635C0001D56E46F51357678227F589C6129BF83C71EB81C83FF11CB5799056
MD5 SHA1 SHA512 TLSH

Submit Download

Task List.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__xlfg\organized\System\Task List.txt
Size 2KB
SHA256 0311f7e97f3c31da6d7f20e19babd08125c9d0e6d023d0a5cb18d7cbb875645c
MD5 c968fc95e0f40d87bcb077989a31019b
SHA1 71b737c04bc668ebcf976b106689edd25fbc233a
SHA512 d1ce77c11cfc2615ff0e425cb0fcc3de471b9cce9b7c4808da89ca294051228814a3bd0c8a8f7dbacf3e1c4ec3ded9ce8eb4929153d9d4c5d7c39fe6e00fe700
TLSH
T1D541A50B95AFA5DEE6C521EF3E21124E0BAB001C044F1CE9B15205EC28B0C1DEA87B6D
MD5 SHA1 SHA512 TLSH

Submit Download

runtime_service.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\BoundRuntime\runtime_service.exe
Size 29KB
SHA256 927004a7ed771954853acfd331baf0a2d74c84037d4adff5a4a65fb1b287e586
MD5 dbd2194b7a5b38636edf7112ebc6fe91
SHA1 6fea8daee367fbdee5a299a214c0419ef04ea7bb
SHA512 238cf410957b64bc0f8997fb3669b6f362e6b170c942fecca43ddc72a73ebffe75d829f0bade82cc712ca6786d6083921df9648d8c7a19ddc1e0de55cc526d42
SSDEEP 384:rHrg8dKZcKMUK+ftkHia5hPAiGfWjf4qHWv6wzbkROjDAZBoVYUb+harH+AtN7hO:rHrJdW1g4N6IgO8oVFChcWqfvB+A5+z
TLSH
T1FFD2290173EC863BE6FA8BB555B151220BB3B99B1572FBCE5D94508E0CB3B409311B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5656-45-0x000001BD0DF40000-0x000001BD0DF4E000-memory.dmp

Download

memory/5656-44-0x00007FFCCE8FF000-0x00007FFCCE900000-memory.dmp

Download

memory/5656-46-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/5656-47-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/5656-48-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/5656-49-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/5656-50-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/5656-51-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/5656-52-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download

memory/5656-54-0x00007FFCCE770000-0x00007FFCCF114000-memory.dmp

Download