Analysis

  • max time kernel
    152s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/08/2026, 22:07

General

  • Target
    2026-08-14_29cd90635ab7ae05baacc16b453bbad5_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
  • Size 116.5MB
  • Sample260814-11xflsam31
  • SHA256 f8ebeab16d8964bbb70474a4cdfdf1a49df4bb79f00fb41ec154916f887e1ba0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Looks for VMWare services registry key. 1 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 13 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Checks processor information in registry 2 TTPs 26 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_29cd90635ab7ae05baacc16b453bbad5_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_29cd90635ab7ae05baacc16b453bbad5_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:1848
    • C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\bin\javaw.exe
      C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\bin\javaw.exe -cp C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\modules.jar;C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\libs\* e C:\Users\Admin\AppData\Local\Temp\2026-08-14_29cd90635ab7ae05baacc16b453bbad5_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat_zxxz.exe
      2⤵
      • Enumerates VirtualBox registry keys
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Looks for VMWare Tools registry key
      • Looks for VMWare services registry key.
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2164

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\bin\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.dll

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\bin\java.dll
        • Size 119KB
        • SHA256 bd32ce0677b5dc044305db88153414ed2e2529e7d07b29c70599d569f6eab503
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\bin\javaw.exe
        • Size 49KB
        • SHA256 0773cc34c8468eae9caf31fc2c36548a2b5d92762cd912a43354f2bee9dcab87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jimage.dll

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\bin\jimage.dll
        • Size 33KB
        • SHA256 3720bd728631cca1fbfdb328adc6d9aca225c766118952c59e0721b429597741
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jli.dll

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\bin\jli.dll
        • Size 87KB
        • SHA256 4ac0488a5604ad6d509cbfa88eeabbd6ed59d8c3f246b7eecafb0280c6d84171
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msvcp140.dll

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\bin\msvcp140.dll
        • Size 561KB
        • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
        • MD5 SHA1 SHA512 SSDEEP TLSH

        net.dll

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\bin\net.dll
        • Size 58KB
        • SHA256 7be667a7a539a410a0fe28808068f57a01a011f6a6899c930823a8d7229a7815
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nio.dll

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\bin\nio.dll
        • Size 78KB
        • SHA256 258ff5c878daf328ad6dca0df2101ac432b4461cb7669077659a1431bd8e6224
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jvm.dll

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\bin\server\jvm.dll
        • Size 13.3MB
        • SHA256 9dac8ae1dfe88cb107e27ee952071682f48ab67266920cbecf03b15bb02ce181
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcruntime140_1.dll

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\bin\vcruntime140_1.dll
        • Size 48KB
        • SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zip.dll

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\bin\zip.dll
        • Size 85KB
        • SHA256 a7730f7aedad64aa48dc9d1b886ff96f22ed7f43497a8b8f4683cd55f9c36fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.security

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\conf\security\java.security
        • Size 70KB
        • SHA256 de75a6bb6a9cd330717507cd16b3179d0caac696e98063c0bc98c99070099b96
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default_US_export.policy

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\conf\security\policy\unlimited\default_US_export.policy
        • Size 146B
        • SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
        • MD5 SHA1 SHA512 TLSH

        default_local.policy

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\conf\security\policy\unlimited\default_local.policy
        • Size 193B
        • SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
        • MD5 SHA1 SHA512 TLSH

        jvm.cfg

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\lib\jvm.cfg
        • Size 29B
        • SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
        • MD5 SHA1 SHA512

        modules

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\lib\modules
        • Size 22.1MB
        • SHA256 21041258ad52c04b4ed840307943232a88cb8fa432f9cd2ebd5bd50ba590c780
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tzdb.dat

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\lib\tzdb.dat
        • Size 100KB
        • SHA256 36cf71e63ce2816fe4456e9195e6c27fa7c9cd431c89ba762eba394ec2c7a1e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        release

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\jre\release
        • Size 110B
        • SHA256 0727484b6c682a5cad1baf656e36582c89565ec15b82aa115cdf1b4ca01eb141
        • MD5 SHA1 SHA512 TLSH

        imgui-java-binding-1.86.12.jar

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\libs\imgui-java-binding-1.86.12.jar
        • Size 145KB
        • SHA256 be59b856753f40159cf2847e40eeb833e7b512ef2520218af47244029f930fed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        imgui-java-lwjgl3-1.86.12.jar

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\libs\imgui-java-lwjgl3-1.86.12.jar
        • Size 33KB
        • SHA256 ada91c37cd42b261e1f92b305f57f5b5da1d9ba1f569422644cd44b035171721
        • MD5 SHA1 SHA512 SSDEEP TLSH

        imgui-java-natives-windows-1.86.12.jar

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\libs\imgui-java-natives-windows-1.86.12.jar
        • Size 6.0MB
        • SHA256 a4fff05cd7058145a5f3688d8ce5cd927608fa9a1acf2687c3c50e4f7940216a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jna-5.14.0.jar

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\libs\jna-5.14.0.jar
        • Size 1.1MB
        • SHA256 0e2589f3ca403d6775efef17e01cd089a32b1796e482efb40a003ecdd219608c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jna-platform-5.14.0.jar

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\libs\jna-platform-5.14.0.jar
        • Size 2.2MB
        • SHA256 7a57d7f12c0f1e2e6250ccf6e94c9a8d0d1de3c9a940cf0207b2135f1adcf06a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        json-20231013.jar

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\libs\json-20231013.jar
        • Size 72KB
        • SHA256 0f18192df289114e17aa1a0d0a7f8372cc9f5c7e4f7e39adcf8906fe714fa7d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lwjgl-3.3.3-natives-windows.jar

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\libs\lwjgl-3.3.3-natives-windows.jar
        • Size 161KB
        • SHA256 5ee63a19187efe5bb8747fd24f7b13257db348df5ad641113a3695e43f213959
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lwjgl-3.3.3.jar

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\libs\lwjgl-3.3.3.jar
        • Size 1.9MB
        • SHA256 34753697153f3d1a042524ad9202ffa25e028e34b86ac60ec9d2de71c5c46864
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lwjgl-glfw-3.3.3-natives-windows.jar

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\libs\lwjgl-glfw-3.3.3-natives-windows.jar
        • Size 162KB
        • SHA256 98155b451dfc6f585089dec77a12f9c05789c4dceb8da472f9d308160101a70d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lwjgl-glfw-3.3.3.jar

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\libs\lwjgl-glfw-3.3.3.jar
        • Size 132KB
        • SHA256 bedc757fd2b1b255146db26b74b9cbd1fcf5644b89b47b104fa721c741604259
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lwjgl-opengl-3.3.3-natives-windows.jar

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\libs\lwjgl-opengl-3.3.3-natives-windows.jar
        • Size 99KB
        • SHA256 f45e5f60596b03b2e3d8b98a123c855ebd0b5154c8155dc2a56b890ccc907477
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lwjgl-opengl-3.3.3.jar

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\libs\lwjgl-opengl-3.3.3.jar
        • Size 2.5MB
        • SHA256 79748ab0dda78568d62ac5d021f773fe03d2ff1cbdf48913983baec61b991739
        • MD5 SHA1 SHA512 SSDEEP TLSH

        okhttp-3.12.0.jar

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\libs\okhttp-3.12.0.jar
        • Size 412KB
        • SHA256 71787f2c599e0441c7a4413983bfdd93d40b56e1badc5e0413d6a4c485ba3f35
        • MD5 SHA1 SHA512 SSDEEP TLSH

        okio-1.17.6.jar

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\libs\okio-1.17.6.jar
        • Size 90KB
        • SHA256 8e88b055523cc80613dfb844d598740e10ada62f4bd98304cdd140c5854cc3b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        slf4j-api-2.0.9.jar

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\libs\slf4j-api-2.0.9.jar
        • Size 63KB
        • SHA256 0818930dc8d7debb403204611691da58e49d42c50b6ffcfdce02dadb7c3c2b6c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sqlite-jdbc-3.44.1.0.jar

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\libs\sqlite-jdbc-3.44.1.0.jar
        • Size 1.4MB
        • SHA256 0f4afd09c858d563ada37dea771bfb47301b02f869009634272fe609672db9c5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        modules.jar

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\modules.jar
        • Size 939KB
        • SHA256 fc2f647e7838b92d6351b6369821c77b109fbdff95c34d0171f3e1d70080d591
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_key_dll.dll

        • Path C:\Users\Admin\AppData\Local\Cached_Software_Ltd\Cached_Exchange_Sync\cache\cb1278be068577ed5921\native\chrome_key_dll.dll
        • Size 153KB
        • SHA256 eab8d2d75e9571e1b91e1b02774c3871d3e944556fc77453c0934d1c55aa16d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jna7655439642576190138.dll

        • Path C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna7655439642576190138.dll
        • Size 248KB
        • SHA256 69c45175ecfd25af023f96ac0bb2c45e6a95e3ba8a5a50ee7969ccab14825c44
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sqlite-3.44.1.0-9b29f0c4-b869-4140-813a-6623edc9de1d-sqlitejdbc.dll

        • Path C:\Users\Admin\AppData\Local\Temp\sqlite-3.44.1.0-9b29f0c4-b869-4140-813a-6623edc9de1d-sqlitejdbc.dll
        • Size 933KB
        • SHA256 393e8faa8231ac4090f4feabecaf2db00c7bff4b2671c685850b36910d694967
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2164-266-0x00007FFFE2CE0000-0x00007FFFE2DD0000-memory.dmp