Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 02:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_f45ab3497fece331ff4d4f7265297639_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_f45ab3497fece331ff4d4f7265297639_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target 2026-08-14_f45ab3497fece331ff4d4f7265297639_glassworm_icedid_luca-stealer_njrat_stealc.exe
- Size 1.2MB
- Sample260815-ch143sdc85
- SHA256 eed8c52a07523c6005686c4024a4b3f06bf6b33988d1f9b49823e4c0f3b3f0f8
- MD5 f45ab3497fece331ff4d4f7265297639
- SHA1 38ec7e72fe0bbb73ebd968742983cc49ed70fdfc
- SHA512 5cf75a5cff6c72cbc01d96581aa41626ce22ad8d128e1d1d948c9742d807393836d1367f94670b07d35cefd9502844b9bc553b4a998c5d62a031099a6faab9e7
- SSDEEP 24576:P2+XQGb0WKBwDJ0YzZBWz/VLMy46Y/+cbQ5:PzWwDJpPWzNLwk
- TLSH T1DE454B1657D8027CF0F7D2F8DEA69C42DB76780A07B19AEF06C055664E27BA08E39713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-08-14_f45ab3497fece331ff4d4f7265297639_glassworm_icedid_luca-stealer_njrat_stealc.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files\AimCore\logs\installer.log 2026-08-14_f45ab3497fece331ff4d4f7265297639_glassworm_icedid_luca-stealer_njrat_stealc.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-08-14_f45ab3497fece331ff4d4f7265297639_glassworm_icedid_luca-stealer_njrat_stealc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2026-08-14_f45ab3497fece331ff4d4f7265297639_glassworm_icedid_luca-stealer_njrat_stealc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4848 2026-08-14_f45ab3497fece331ff4d4f7265297639_glassworm_icedid_luca-stealer_njrat_stealc.exe 4848 2026-08-14_f45ab3497fece331ff4d4f7265297639_glassworm_icedid_luca-stealer_njrat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_f45ab3497fece331ff4d4f7265297639_glassworm_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_f45ab3497fece331ff4d4f7265297639_glassworm_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4848
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\AimCore\logs\installer.log
- Size 2KB
- SHA256 a6431364c164d8ffa199b417eb787b82eb447038e58504bb43cfc83a7aaa7fae
- MD5 7a0f7947ea7d1da81af17100bc3df570
- SHA1 40902ed364553792ed34d8b5817f6166ed388059
- SHA512 ee40116123507aaa0f3df51368e533f0033dc5a6243c3fc47b273ecd8370753aff8b1dc59e04863403c791c68567f3382d1d231caf163fd390932bc9b6e6b802
- TLSH T17A51CE0E0FFBC33A2D03834ADB9D5FB373617E234A580D61B9AA434862C9C5D6D57860
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\AimCore\logs\installer.log
- Size 1KB
- SHA256 8d6a329540ef9f63ecf484461b29ea052973811f3bfc0b8029446d822d7f6f80
- MD5 0605e05bb2a87569dc302125f8c35352
- SHA1 3f89da7760ca4ff20bb11096f72e207356b99a43
- SHA512 38d07b83d1e36e591f2d212e37e794ba8bff6ed7ce85e60d89a4453e0967418eefac56c88503d789d7a47ab3401067bf7877ed36dd00445d8a66e50eb5fb9907
- TLSH T10E21AE0A9FBF836E3D43824AD7BD0FF2A7A4BE2749444D60BAA94A4462C5C1D295B520
- MD5 SHA1 SHA512 TLSH