e736b4c8da6483853ba7b576a5163ba7998b84cd9cf24b51317b508fbc461c3d

Analysis

max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_8181a500c126d667f14576979ec1cbb0_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 13.9MB
Sample260819-fx1nmsyyhs
SHA256 e736b4c8da6483853ba7b576a5163ba7998b84cd9cf24b51317b508fbc461c3d
MD5 8181a500c126d667f14576979ec1cbb0
SHA1 8910e192dda1e79c763a37b7bda272fc1ee08dba
SHA512 2ac5103972d38bde1585277100be70635046204999fa49c4c0109b48ff24eda494a8d4f6cc94edd3daf6b04b899cd6a28a9f6b54b7d78aba208a50683637931a
SSDEEP 393216:PdpSKPUFTVVMr3IOcVyumYtMAMc2aXbsL1BmC:Fpyu3Wtv1ux
TLSH
T10AE6F15665D002BCD066C239C18A1AAFF3B274490FB299CF2BD145412F73AD1DEB772A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4e7-12.dat	INDICATOR_EXE_Packed_VMProtect

Deletes itself 1 IoCs

pid	Process
4852	22c190638a36068c5f4e1c6ef4eec1f4a9daed8932c7ef63b8ee27091757a665.exe

Executes dropped EXE 3 IoCs

pid	Process
5728	starting.exe
4852	22c190638a36068c5f4e1c6ef4eec1f4a9daed8932c7ef63b8ee27091757a665.exe
1388	2026-08-19_8181a500c126d667f14576979ec1cbb0_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 5728	4564	2026-08-19_8181a500c126d667f14576979ec1cbb0_glassworm_icedid_luca-stealer_njrat_stealc.exe	89
PID 4564 wrote to memory of 4852	4564	2026-08-19_8181a500c126d667f14576979ec1cbb0_glassworm_icedid_luca-stealer_njrat_stealc.exe	91
PID 4852 wrote to memory of 1388	4852	22c190638a36068c5f4e1c6ef4eec1f4a9daed8932c7ef63b8ee27091757a665.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-19_8181a500c126d667f14576979ec1cbb0_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_8181a500c126d667f14576979ec1cbb0_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Strokora\startup\starting.exe
  "C:\Users\Admin\AppData\Local\Strokora\startup\starting.exe" "--track" "4564" "\\.\pipe\Strokora.Startup.4564.240720765" "Local\Strokora.StartupReady.4564.240720765"
  2⤵
  - Executes dropped EXE
  PID:5728
- C:\Users\Admin\AppData\Local\Strokora\launcher\22c190638a36068c5f4e1c6ef4eec1f4a9daed8932c7ef63b8ee27091757a665.exe
  "C:\Users\Admin\AppData\Local\Strokora\launcher\22c190638a36068c5f4e1c6ef4eec1f4a9daed8932c7ef63b8ee27091757a665.exe" "--apply-launcher-update" "4564" "C:\Users\Admin\AppData\Local\Temp\2026-08-19_8181a500c126d667f14576979ec1cbb0_glassworm_icedid_luca-stealer_njrat_stealc.exe" "22c190638a36068c5f4e1c6ef4eec1f4a9daed8932c7ef63b8ee27091757a665" "run" "Local\Strokora.LauncherApplyReady.4564.240762187" "\\.\pipe\Strokora.Startup.4564.240720765" "Local\Strokora.LauncherAuthorize.4564.240762187"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Users\Admin\AppData\Local\Temp\2026-08-19_8181a500c126d667f14576979ec1cbb0_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_8181a500c126d667f14576979ec1cbb0_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    3⤵
    - Executes dropped EXE
    PID:1388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

22c190638a36068c5f4e1c6ef4eec1f4a9daed8932c7ef63b8ee27091757a665.exe

Path C:\Users\Admin\AppData\Local\Strokora\launcher\22c190638a36068c5f4e1c6ef4eec1f4a9daed8932c7ef63b8ee27091757a665.exe
Size 14.0MB
SHA256 22c190638a36068c5f4e1c6ef4eec1f4a9daed8932c7ef63b8ee27091757a665
MD5 cf8f3dc90708b8e548c31d8e6fb0d79f
SHA1 d35ec761dd7c1f2154622515a519015ed81ef258
SHA512 8061953fd1be6ba6eba3f4316c29f6dcebd742d095038764a8dbfc2228c33acb4960330ad62d2420549601652a63eddb23acb3887508afee633d0a3677598d1b
SSDEEP 196608:rHh9HSg26ChUTPDAX7ayl4v4MLDTkqLIe3JHls/PcysbeX0LB+13L1VyE6tCF:3HRkPXjEzk8yPcfeSsL1BmC
TLSH
T16BE6F15665D001BCD4A6C239C18B0AAFF2B274094FB29A8F2FD145412F73AD1DDB772A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

starting.exe

Path C:\Users\Admin\AppData\Local\Strokora\startup\starting.exe
Size 139KB
SHA256 180d732909c29b4ca725cf35f59aaa6f47b7bd2e09e27d5b7e7408ee5fd76eaf
MD5 f467c948fef59038522c3b5529648d98
SHA1 da57edc507c7b146f254f5e364c7b9aea21ff949
SHA512 1e5e8f84a5d236407b7b0654a003e4f6a95925c8b507584f10feaca8e5bfdaaf6e4aef85307f71fc19fe8193faa45ef5d5928e2c4c1df3534b2c380463d6c3f9
SSDEEP 3072:bp4Kbg+CLEx/wHW6HFjNhLl/QXTj6wqmO14/J:bp4CxwVFjfJ/ic4R
TLSH
T1EDD36A4773A530F8E177C139C4924A05E772B8751761AFEF07A4826A5F236E09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH