73746c74329f57f32b4f42166a341867484ac8c714dcd61f130bf981c15d97a6

General

Target
2026-08-09_540e2363ae106657affd88e8638a1c8f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
Size 111.6MB
Sample260809-vb2fdasbme
SHA256 73746c74329f57f32b4f42166a341867484ac8c714dcd61f130bf981c15d97a6
MD5 540e2363ae106657affd88e8638a1c8f
SHA1 f001048882b0c82ca82fec0305cbeabcbad4d5cf
SHA512 90a0953cc6ce2ef9adff0a9292e2262c8eda015dbf9043371c3b6185e0cfca9cef8f8393cbff555a45cffc5780ddb06839201b6dd0983c23bf544dac0872d0e8
SSDEEP 1572864:1Pp36F/iKRzfo0EL9uXpXFxAI/MZqNrGZVOc4XIoC3MnluZQrZc:1PpIlfheuXpX/z/5NivOcC7hlTr+
TLSH
T15548F01663E111AAD577D178C7AB6203EB72B40713308BDB329C43652F73AE45E7AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

execution

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002439f-26.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4724	powershell.exe
3068	powershell.exe
4724	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1620	4J3cADIHD1vd.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	4J3cADIHD1vd.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4136	cmd.exe
3800	cmd.exe
2468	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3068	powershell.exe
3068	powershell.exe
4724	powershell.exe
4724	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	4724	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 4136	4124	2026-08-09_540e2363ae106657affd88e8638a1c8f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe	83
PID 4136 wrote to memory of 3068	4136	cmd.exe	85
PID 4124 wrote to memory of 3800	4124	2026-08-09_540e2363ae106657affd88e8638a1c8f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe	91
PID 3800 wrote to memory of 2140	3800	cmd.exe	93
PID 2140 wrote to memory of 4156	2140	net.exe	94
PID 4124 wrote to memory of 2468	4124	2026-08-09_540e2363ae106657affd88e8638a1c8f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe	95
PID 2468 wrote to memory of 4724	2468	cmd.exe	97
PID 4724 wrote to memory of 3600	4724	powershell.exe	98
PID 4124 wrote to memory of 1620	4124	2026-08-09_540e2363ae106657affd88e8638a1c8f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-09_540e2363ae106657affd88e8638a1c8f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_540e2363ae106657affd88e8638a1c8f_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command [void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('version 1.0.0','Program','OK','Information')"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command [void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms'); [System.Windows.Forms.MessageBox]::Show('version 1.0.0','Program','OK','Information')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP,'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'; gpupdate /force""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath $env:TEMP,'C:\ProgramData','C:\ProgramData\Windows\Microsoft','C:\ProgramData\Microsoft\Windows'; gpupdate /force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4724
  - - C:\Windows\system32\gpupdate.exe
      "C:\Windows\system32\gpupdate.exe" /force
      4⤵
      PID:3600
- C:\ProgramData\4J3cADIHD1vd.exe
  C:\ProgramData\4J3cADIHD1vd.exe
  2⤵
  - Executes dropped EXE
  - Checks for VirtualBox DLLs, possible anti-VM trick
  PID:1620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4J3cADIHD1vd.exe

Path C:\ProgramData\4J3cADIHD1vd.exe
Size 522KB
SHA256 d261a0c229797901352ef1c2258d4434e61762b6d8fddd87f7f010c260d0aceb
MD5 2f87247d0199f9d1364460c2b839b979
SHA1 7c4c18c58c31d2c724868b53998358ac557f139a
SHA512 f661c8221b58194446f94f060063115af44f6120e8b4620f6d8c1326b2ea2bde82745306d37077ddac0485f98e4f5aa90ce9bd553eb0c2566dea60777831b976
SSDEEP 12288:j/ZRkI5Q4uqnWYU6/JOwvr5QM60s5SmVzUY:dLfyv6/JPvr5QMJs5Rp
TLSH
T176B46BA3A39627FCC1E6C374C006362DF6713FA142298696465AF7214F336886F7EB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 8d0896f043e62ea4952833cb20d23fc5f39f2a004bada23c71fc41af8b37a6e2
MD5 4b6a25c71368c32af07089d65cb075f5
SHA1 489f98f82b860b96b375af8b236d2a390c6e2fd4
SHA512 24f6478e8bc175d10bd849356a35b421daf718839c344ce1a14ac0324d4c90162df618f690de61d992a92fc4c9b8cf8bb46eddb8560da5a126ad0904456ef4c9
TLSH
T10F51DF313376B0D888163F461D691AC053BF4355FA94AF1CB698625EDE2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 2b3d52ecaba1d9bd5b96025bbfb0bb2cf5a9346ecca3fe3f52f5f5321d83c286
MD5 cf055f134cfc9e1d69fde29624247b3c
SHA1 e62edc04bd376cc7cf4b70212f736ae1e91e1801
SHA512 022d9ec493bd011d4a43b846f06926566979d6d2a2171aaefaa575897f21e6171d4cdf6593021e51fd02e83f2ef74d6e913a4b923d6fac319a8be7d448adaa07
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_5lgiazhu.smm.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5lgiazhu.smm.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3068-1-0x0000028178570000-0x0000028178580000-memory.dmp

Download

memory/3068-2-0x0000028178570000-0x0000028178580000-memory.dmp

Download

memory/3068-3-0x000002817A760000-0x000002817A782000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads