1fe6b32759dd5ea31e313f7cdbafa9bc638d6fd1f5724486df35eeed20fb24f3

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_c70006a1266f7db1c2617d09a3e07ed3_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 3.0MB
Sample260819-e1t5ladm9x
SHA256 1fe6b32759dd5ea31e313f7cdbafa9bc638d6fd1f5724486df35eeed20fb24f3
MD5 c70006a1266f7db1c2617d09a3e07ed3
SHA1 8991fb009997658856a432f8385eb285b4bc79e3
SHA512 01446cf9bd1f70b2db27dfd3615e9df7166a7900385673830810346ffb2ba7e8d55d6297b7fbcbcd1563757e0dc18e98a8b5a27ab690710e552c9f670cd764c1
SSDEEP 49152:HIQY2cWH+t/KcAXvgTOtiZLNHQLLzuwy9KtIzHUdrDmFQVA:QsoBctUUdba
TLSH
T1C8E59D66A3A901ACD0A7C174CE465947D7B2B44613B28FDF53D09EAA1F137B11E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5812	decoy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 5812	4376	2026-08-19_c70006a1266f7db1c2617d09a3e07ed3_glassworm_icedid_luca-stealer_njrat_stealc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-19_c70006a1266f7db1c2617d09a3e07ed3_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_c70006a1266f7db1c2617d09a3e07ed3_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\decoy\decoy.exe
  "C:\Users\Admin\AppData\Local\Temp\decoy\decoy.exe"
  2⤵
  - Executes dropped EXE
  PID:5812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

decoy.exe

Path C:\Users\Admin\AppData\Local\Temp\decoy\decoy.exe
Size 109KB
SHA256 e9a340ae5edac9f70dc143231f32270789a200456a03b3a04287e01a743a5fbb
MD5 dc3130e90449e01fc8985e447c029c24
SHA1 9482ed2b7a911c89356985676377e3ea3ea0aff0
SHA512 7679ae8a5b5a65799dba9cad9b357c4b826b7ceaff0f92d71f4ca43477d6790e543d77e2b9a5c29235a7e3aebf6fff0d503be6f63807315d02d05241749bebe5
SSDEEP 3072:t42DoVLQVDPePRnnTypkqM4JHav9Vrvs:fDOLQVwnTKBLQ3s
TLSH
T11AB36B5B63E531F9E4B3823988650A05E776B83117A08FEF03A4465A5F236D18D3EF22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download