Analysis
- max time kernel
150s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 06:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_fa1673a6ac6cde0b0423f5d5357130d2_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_fa1673a6ac6cde0b0423f5d5357130d2_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-08-16_fa1673a6ac6cde0b0423f5d5357130d2_glassworm_icedid_luca-stealer_njrat_stealc.exe
- Size 6.1MB
- Sample260816-gr4nsa1ckd
- SHA256 5c65da0a6e22c82436355ba194a9bdb8105d71f0929362809190284a3f9ea194
- MD5 fa1673a6ac6cde0b0423f5d5357130d2
- SHA1 4710025ea09b70a8cf85bc745af6788415fd60ea
- SHA512 69c8f90b9810a7181b92d8da55fb3d169f059922a227b4fa4ce9e10bb785014f1dc04bc16eea8347cad789e6cdf9dd73aea4c22d9a64eb8a9b832af051e1c736
- SSDEEP 49152:OrzLiZYr929mG0q26zlHtqvVW9VAs8aHCAz4g0+dcqHd4XmqOnp/ziTxbziyB:Or6TCE9KJeFx/zuxb+c
- TLSH T12856E8AAD67641E5D4FAD075C266A22BFC717C9EC130A707A780A7171B36B60F63E700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2980 2026-08-16_fa1673a6ac6cde0b0423f5d5357130d2_glassworm_icedid_luca-stealer_njrat_stealc.exe 2980 2026-08-16_fa1673a6ac6cde0b0423f5d5357130d2_glassworm_icedid_luca-stealer_njrat_stealc.exe 2980 2026-08-16_fa1673a6ac6cde0b0423f5d5357130d2_glassworm_icedid_luca-stealer_njrat_stealc.exe 2980 2026-08-16_fa1673a6ac6cde0b0423f5d5357130d2_glassworm_icedid_luca-stealer_njrat_stealc.exe 2980 2026-08-16_fa1673a6ac6cde0b0423f5d5357130d2_glassworm_icedid_luca-stealer_njrat_stealc.exe 2980 2026-08-16_fa1673a6ac6cde0b0423f5d5357130d2_glassworm_icedid_luca-stealer_njrat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_fa1673a6ac6cde0b0423f5d5357130d2_glassworm_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_fa1673a6ac6cde0b0423f5d5357130d2_glassworm_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2980
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4840