Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/08/2026, 23:48
General
- Target 2026-08-14_55a0c83f9123839c8e5ce1d238e908de_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 8.1MB
- Sample260814-3tw8dabm7x
- SHA256 c9a05ac8a76b76deca9178e129e68a861f720a87c0c2be0bf12d7befdc8c75e1
Malware Config
Extracted
-
xworm
-
5.0
-
nuuky-78-173-142-62.run.pinggy-free.link:46399
-
NSP88JwIvfBJJhk0
-
install_file
USB.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_55a0c83f9123839c8e5ce1d238e908de_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_55a0c83f9123839c8e5ce1d238e908de_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_55a0c83f9123839c8e5ce1d238e908de_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_55a0c83f9123839c8e5ce1d238e908de_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\decrypted_payload.exeC:\Users\Admin\AppData\Local\Temp\decrypted_payload.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\c2.exe"C:\Users\Admin\AppData\Roaming\c2.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Injector.exe"C:\Users\Admin\AppData\Roaming\Injector.exe"4⤵
- Executes dropped EXE
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_lzma.pyd
base_library.zip
python312.dll
ucrtbase.dll
decrypted_payload.exe
Injector.exe
c2.exe
memory/816-90-0x0000017C40380000-0x0000017C40A3C000-memory.dmp
memory/2516-84-0x0000000000480000-0x000000000048E000-memory.dmp
memory/2740-68-0x00000000001A0000-0x00000000001FE000-memory.dmp
memory/2740-83-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/2740-70-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/2740-85-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/2740-88-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp
memory/2740-67-0x00007FF90CBCF000-0x00007FF90CBD0000-memory.dmp
memory/2740-91-0x00007FF90CA40000-0x00007FF90D3E4000-memory.dmp