4d8c545580c8d809a0c3aca79e14a135bb864992d09511792b39c84b001d5a60

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 06:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_ba66b0c229537894fa023a47c6aab10b_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 5.0MB
Sample260809-haa6kssdkd
SHA256 4d8c545580c8d809a0c3aca79e14a135bb864992d09511792b39c84b001d5a60
MD5 ba66b0c229537894fa023a47c6aab10b
SHA1 e1039504092c106be83cb5e6cc2b8e216d371bcd
SHA512 2836c876d8b95d7970d05be3c4d40749a63cd53aa9005f698730151f5cce7fd6f54c5345dfa7aff586d2901d7a9471f028df7f89f3f58c3b1a92ff933242af8e
SSDEEP 49152:fjSss9sGGcx7sXpjNEn1qCAMdeEFv6oDx7omnNYx+fGzNDw0xmYP+CW2sOFAybJ0:fet9N621loKP30I9/CO8RVFwMM
TLSH
T147367D46B6F501DCD1B7C0788A6A9107F7B2784917309BEB12D09A792F23ED05E7BB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3320	2026-08-09_ba66b0c229537894fa023a47c6aab10b_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3320	2026-08-09_ba66b0c229537894fa023a47c6aab10b_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 3320	4848	2026-08-09_ba66b0c229537894fa023a47c6aab10b_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe	89
PID 4848 wrote to memory of 4536	4848	2026-08-09_ba66b0c229537894fa023a47c6aab10b_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-09_ba66b0c229537894fa023a47c6aab10b_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_ba66b0c229537894fa023a47c6aab10b_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Users\Admin\AppData\Local\Temp\2026-08-09_ba66b0c229537894fa023a47c6aab10b_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-09_ba66b0c229537894fa023a47c6aab10b_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe --webconfig --mutex 42B4192A11A2BD4EB6470BAB848EF6C5
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3320
- C:\Users\Admin\AppData\Local\Temp\2026-08-09_ba66b0c229537894fa023a47c6aab10b_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-09_ba66b0c229537894fa023a47c6aab10b_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe --iswatched 0 --mutex 0EC3A28E2A271043A0062C99EAD0F5F6
  2⤵
  PID:4536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AssetConfigV2.bin

Path C:\Users\Admin\AppData\Roaming\AssetUPnP\uMediaLibrary-r8\AssetConfigV2.bin
Size 4B
SHA256 df3f619804a92fdb4057192dc43dd748ea778adc52bc498ce80524c014b81119
MD5 f1d3ff8443297732862df21dc4e57262
SHA1 9069ca78e7450a285173431b3e52c5c25299e473
SHA512 ec2d57691d9b2d40182ac565032054b7d784ba96b18bcb5be0bb4e70e3fb041eff582c8af66ee50256539f2181d7f9e53627c0189da7e75a4d5ef10ea93b20b3
MD5 SHA1 SHA512

Submit Download

AssetUPnPDefinedBrowseTreev7.txt

Path C:\Users\Admin\AppData\Roaming\AssetUPnP\uMediaLibrary-r8\AssetUPnPDefinedBrowseTreev7.txt
Size 3KB
SHA256 cc739d348d71f65f63252a959efdea1c9d300b6359c7d6a54ca9d0728944bdfb
MD5 2810615d301226027f5f1fe84e7bf1d8
SHA1 8adf2ce6fc0023333f19b36c44ee67dba24e033e
SHA512 3a00b37130f9b5cd94607e4ca13af09c75496c40cebbc879f7aabb66f83ce3dcbd4b36aaa2e20904b10975f8ae33cb5d133e7b7647b5dc4aeaa89427243f796c
TLSH
T1F5719D6293FD4054F3F7AF85EF7A48714B7A7CC92E39D42912D8100E49F1A55A8643B3
MD5 SHA1 SHA512 TLSH

Submit Download

AssetUPnPUserRenameList.txt

Path C:\Users\Admin\AppData\Roaming\AssetUPnP\uMediaLibrary-r8\AssetUPnPUserRenameList.txt
Size 768B
SHA256 bb68bf407f24d4e8b8318412ffdb99e919c367bbae196eb073e2c29ea7b13fc7
MD5 d0c6b3b2a1e774f6f175aad1a2fafedc
SHA1 29c2db1477e51e8c5d99f5ac9131bedff9318c88
SHA512 87ae7643560ac21b2300bc7664aebac10f2b4dffa25715822ad25218576c4a5e0a3734f5bbb307901f71bb853607a1a3311052bc66fcf7066df66a9c12eb0af2
TLSH
T12D014F9136FC8608B2F73F481EB126650F3FB855AC7DC65C0294910E4EFBA40D860BA3
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads