Overview

overview

10

Static

static

10

2026-08-20...at.exe

windows10-2004-x64

9

2026-08-20...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/08/2026, 23:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_bec07c9a0ab86c60122fc4a76d5e9907_glassworm_icedid_luca-stealer_njrat.exe
  • Size 6.9MB
  • Sample260820-3e8ymack5x
  • SHA256 d3b6f4371584bd6dba8bca534c8b30e55f5cf15d1bf7d71b194079b955c9b7e2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoverythemidatrojan

Malware Config

Signatures

  • Detects executables packed with Enigma 1 IoCs
  • Detects executables packed with Themida 9 IoCs
  • Detects executables packed with VMProtect. 1 IoCs
  • Detects executables referencing many IR and analysis tools 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Themida packer 9 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_bec07c9a0ab86c60122fc4a76d5e9907_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_bec07c9a0ab86c60122fc4a76d5e9907_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Checks computer location settings
    • Checks for VirtualBox DLLs, possible anti-VM trick
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1432
    • C:\Users\Admin\AppData\Local\Temp\bnd3F08.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\bnd3F08.tmp.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of WriteProcessMemory
      PID:4420
      • C:\Users\Admin\AppData\Local\LV Software\payloads\loader\LV Software.exe
        "C:\Users\Admin\AppData\Local\LV Software\payloads\loader\LV Software.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:3720

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        608BDF3A6A78A24F1DA020C42ED37544
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\608BDF3A6A78A24F1DA020C42ED37544
        • Size 346B
        • SHA256 69a920394e1aa1d30e9c3fe19e5c9ff7253b5370ab76fe95abee6a985659adf0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8B2B9A00839EED1DFDCCC3BFC2F5DF12
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
        • Size 1KB
        • SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        B46811C17859FFB409CF0E904A4AA8F8
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
        • Size 528B
        • SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        608BDF3A6A78A24F1DA020C42ED37544
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\608BDF3A6A78A24F1DA020C42ED37544
        • Size 192B
        • SHA256 178a8be4448f158b526028adb007e3fa3c4fbd537d8bd423b59f72a1d9ccb035
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        8B2B9A00839EED1DFDCCC3BFC2F5DF12
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
        • Size 174B
        • SHA256 5f938ee744559054bfe3d1b42fb8762446279f07f5e7aa1f8b0a0079d3954caa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        B46811C17859FFB409CF0E904A4AA8F8
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
        • Size 170B
        • SHA256 8092b8b7b58fb3a214ce66d09657080c7a4fbe38e584352581b56c9369af2eb7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LV Software.exe
        • Path C:\Users\Admin\AppData\Local\LV Software\payloads\loader\LV Software.exe
        • Size 31.8MB
        • SHA256 f86b0295823071fc7c4401869ad5ef38b165ba3e6d7167b5dbe4bf4219a51bbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LV Software.exe.sha256
        • Path C:\Users\Admin\AppData\Local\LV Software\payloads\loader\LV Software.exe.sha256
        • Size 64B
        • SHA256 f5a5fd42d16a20302798ef6ed309979b43003d2320d9f0e8ea9831a92759fb4b
        • MD5 SHA1 SHA512
        Submit Download

        bnd3F08.tmp.exe
        • Path C:\Users\Admin\AppData\Local\Temp\bnd3F08.tmp.exe
        • Size 3.4MB
        • SHA256 5c7a64a60073761f386f069ddf2d4265b679915cbe274e935366e13014bae6d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1432-8-0x00000247C33D0000-0x00000247C33D1000-memory.dmp
        Download

        memory/1432-9-0x00000247C33D0000-0x00000247C33D1000-memory.dmp
        Download

        memory/4420-30-0x00007FF7B9280000-0x00007FF7B9BD4000-memory.dmp
        Download

        memory/4420-43-0x00007FF7B9280000-0x00007FF7B9BD4000-memory.dmp
        Download

        memory/4420-10-0x00007FF7B9280000-0x00007FF7B9BD4000-memory.dmp
        Download

        memory/4420-15-0x00007FF7B92D2000-0x00007FF7B92D3000-memory.dmp
        Download

        memory/4420-14-0x00007FF7B9280000-0x00007FF7B9BD4000-memory.dmp
        Download

        memory/4420-13-0x00007FF7B9280000-0x00007FF7B9BD4000-memory.dmp
        Download

        memory/4420-12-0x00007FF7B9280000-0x00007FF7B9BD4000-memory.dmp
        Download

        memory/4420-11-0x00007FF7B9280000-0x00007FF7B9BD4000-memory.dmp
        Download