5b02b5c193e4d80d44236bb1d1bb52ed529741e51cb189e94cd554862406d82a

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_326a3493ed3c93858cbceec122964745_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 4.4MB
Sample260810-het49ashpe
SHA256 5b02b5c193e4d80d44236bb1d1bb52ed529741e51cb189e94cd554862406d82a
MD5 326a3493ed3c93858cbceec122964745
SHA1 dc8a5bc2ccd526728c8e8987dd03d7c3adb115dc
SHA512 cf43a168547b6975d2e533e0750ef6115d83cbd327aff640d665636f970c07fb0e81cbe68c1c56373ad7497fd07c60f32eb87d0bad6f90ae5f9b8d961ed9c4ae
SSDEEP 49152:BgiLUc9I7UhUJdeOo48nJ5Znl8Ir7IZAPKYNO/zoHiR6N2R7Kmv:Ba9wDn2YY/Yrmv
TLSH
T1D7267D46B39580E4C466813989979697F7B17C210F609BCB72A0776E2F33BE16E3B701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence

Malware Config

Signatures

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	2026-08-10_326a3493ed3c93858cbceec122964745_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\XXAbKvRlTGdYduMoUFEHRseZcj\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\XXAbKvRlTGdYduMoUFEHRseZcj"	kdmapper.exe

Executes dropped EXE 1 IoCs

pid	Process
3484	kdmapper.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3484	kdmapper.exe
3484	kdmapper.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3484	kdmapper.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3484	kdmapper.exe
Token: SeLoadDriverPrivilege	3484	kdmapper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 3484	5100	2026-08-10_326a3493ed3c93858cbceec122964745_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-10_326a3493ed3c93858cbceec122964745_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_326a3493ed3c93858cbceec122964745_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modify Registry: Disable Windows Driver Blocklist
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\kdmapper.exe
  "C:\Users\Admin\AppData\Local\Temp\kdmapper.exe" "C:\Users\Admin\AppData\Local\Temp\RobloxInjectorDrv.sys"
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kdmapper.exe

Path C:\Users\Admin\AppData\Local\Temp\kdmapper.exe
Size 148KB
SHA256 6d48c596a32b7b417c251aaf8a8fbf189304b538f9184a3724d4239ed73b0aa9
MD5 e62571e47cf2927a880c261227e22607
SHA1 9016c13e1c8653c708c965c29e6263e65b715089
SHA512 110868638318f5397e11e791369b13063751c41d3607ff92275ad4f99be0e4dd4e20a5d776ba683e5b47f3c55e26aac1849d497abafe2adff1e90adc5a9a7836
SSDEEP 3072:Uevouo2mGuyyRShDA07VokwbmJTQSaMm5/6RqP2uHW:Uevouo2ORAA0xDWl+22
TLSH
T1D9E32B1797A51029E1B7DAB9CAB24902EB717C450B74D6CF135048B90F62BE0BF3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d031bbba323fd9e5b47e0ee5a0353f11-le64.cache-9

Path C:\Users\Admin\AppData\Local\fontconfig\cache\d031bbba323fd9e5b47e0ee5a0353f11-le64.cache-9
Size 1.6MB
SHA256 496dc2480164700ffadfd2bdcec9b818f41295ab6ab85cd0ae08538c650554c5
MD5 333ed0df804be6eb7d7abee3acbade45
SHA1 bedb30edd1666a251c716fdea32e8bee8343bf30
SHA512 4266db2caf72e902bb399be73bc7490495293af0aac89c13a956f875253dd9996e45890b6352950c4c439a08c02dc774187da53fa150ea58399f2fa62525c46d
SSDEEP 3072:Q0pb7qjP1gvRpqP+pTzrKlNCLUqAIIffBwZkto8/HrUfzpc0IpgT+F1ovG1rLaGr:0p545POeYN
TLSH
T19C855405E7E0CD73CE52527644A7021F7A30DF9567A6DB8760887A793C373DA2E182B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download