5b02b5c193e4d80d44236bb1d1bb52ed529741e51cb189e94cd554862406d82a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 06:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_326a3493ed3c93858cbceec122964745_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 4.4MB
Sample260810-het49ashpe
SHA256 5b02b5c193e4d80d44236bb1d1bb52ed529741e51cb189e94cd554862406d82a
MD5 326a3493ed3c93858cbceec122964745
SHA1 dc8a5bc2ccd526728c8e8987dd03d7c3adb115dc
SHA512 cf43a168547b6975d2e533e0750ef6115d83cbd327aff640d665636f970c07fb0e81cbe68c1c56373ad7497fd07c60f32eb87d0bad6f90ae5f9b8d961ed9c4ae
SSDEEP 49152:BgiLUc9I7UhUJdeOo48nJ5Znl8Ir7IZAPKYNO/zoHiR6N2R7Kmv:Ba9wDn2YY/Yrmv
TLSH
T1D7267D46B39580E4C466813989979697F7B17C210F609BCB72A0776E2F33BE16E3B701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion persistence

Malware Config

Signatures

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	2026-08-10_326a3493ed3c93858cbceec122964745_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\oczcfybyJhQCFdvNfrkwfRR\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\oczcfybyJhQCFdvNfrkwfRR"	kdmapper.exe

Executes dropped EXE 1 IoCs

pid	Process
1672	kdmapper.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1672	kdmapper.exe
1672	kdmapper.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
1672	kdmapper.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1672	kdmapper.exe
Token: SeLoadDriverPrivilege	1672	kdmapper.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 1672	3380	2026-08-10_326a3493ed3c93858cbceec122964745_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-10_326a3493ed3c93858cbceec122964745_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_326a3493ed3c93858cbceec122964745_blankgrabber_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modify Registry: Disable Windows Driver Blocklist
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Users\Admin\AppData\Local\Temp\kdmapper.exe
  "C:\Users\Admin\AppData\Local\Temp\kdmapper.exe" "C:\Users\Admin\AppData\Local\Temp\RobloxInjectorDrv.sys"
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:1672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kdmapper.exe

Path C:\Users\Admin\AppData\Local\Temp\kdmapper.exe
Size 148KB
SHA256 6d48c596a32b7b417c251aaf8a8fbf189304b538f9184a3724d4239ed73b0aa9
MD5 e62571e47cf2927a880c261227e22607
SHA1 9016c13e1c8653c708c965c29e6263e65b715089
SHA512 110868638318f5397e11e791369b13063751c41d3607ff92275ad4f99be0e4dd4e20a5d776ba683e5b47f3c55e26aac1849d497abafe2adff1e90adc5a9a7836
SSDEEP 3072:Uevouo2mGuyyRShDA07VokwbmJTQSaMm5/6RqP2uHW:Uevouo2ORAA0xDWl+22
TLSH
T1D9E32B1797A51029E1B7DAB9CAB24902EB717C450B74D6CF135048B90F62BE0BF3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d031bbba323fd9e5b47e0ee5a0353f11-le64.cache-9

Path C:\Users\Admin\AppData\Local\fontconfig\cache\d031bbba323fd9e5b47e0ee5a0353f11-le64.cache-9
Size 1.7MB
SHA256 10468ca79739dd743edd5eacf5e19f72b0862c0fa351c86ba6893e8369d234c2
MD5 1fecc921c4116498f7570b568eedee8f
SHA1 dedc83342e714b7008e973cf921e7b9263886e2c
SHA512 7b91f5e958571d29aea6088a3d5d23e252903f5ee692943661dc729bd78cabcdc7801aa7905aefbaf0b2fe6672960f2cb1bb7f31a5459aad4d7f0d43b19de114
SSDEEP 3072:Re3Bpb7qjP1gvRpqP+pTzrKlNCLUqAIIffBwZkto8/HG5j75degpgTXccovE1rSU:gfPANL5PHuTa
TLSH
T1F0853305E7E0CD73CE52527684A7021F7A30DF9567A6DB8760887A793C373DA2E182B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download