8f109f3c2b0bd7becb77f58dc3b90e208bfcdb83cec65286075ff01cf21e37ec

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 01:57

Target
2026-08-21_35bfc8439f88ca2233aa9f4a76c3346d_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 1.2MB
Sample260821-cdl5cs1aje
SHA256 8f109f3c2b0bd7becb77f58dc3b90e208bfcdb83cec65286075ff01cf21e37ec
MD5 35bfc8439f88ca2233aa9f4a76c3346d
SHA1 0ccc1f78a53ff77d7695d46cb669391086f41c92
SHA512 33f297264692e0de3723ceada417e7d3fca837c64f5efce539b199556c494e26a6f2f63540be047d1ef8ebc3b8ec5f585e595791f1a599c0ac1ed2d318dc6b1c
SSDEEP 24576:CRIka7Py8epKeHfoyFENH7Eomp+/BkbstNKl5NfI3//V5dK858Rh0lhSMXlr5:CRaW8epKeAtF7SptbstNKl5NfI3hM4
TLSH
T16D45AE56A7B440F9D1ABC179CA52860BEBB27805137097CF07E48AA62F236E15F3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4332 set thread context of 1228	4332	2026-08-21_35bfc8439f88ca2233aa9f4a76c3346d_glassworm_icedid_luca-stealer_njrat_stealc.exe	90

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 1228	4332	2026-08-21_35bfc8439f88ca2233aa9f4a76c3346d_glassworm_icedid_luca-stealer_njrat_stealc.exe	90
PID 4332 wrote to memory of 1228	4332	2026-08-21_35bfc8439f88ca2233aa9f4a76c3346d_glassworm_icedid_luca-stealer_njrat_stealc.exe	90
PID 4332 wrote to memory of 1228	4332	2026-08-21_35bfc8439f88ca2233aa9f4a76c3346d_glassworm_icedid_luca-stealer_njrat_stealc.exe	90
PID 4332 wrote to memory of 1228	4332	2026-08-21_35bfc8439f88ca2233aa9f4a76c3346d_glassworm_icedid_luca-stealer_njrat_stealc.exe	90
PID 4332 wrote to memory of 1228	4332	2026-08-21_35bfc8439f88ca2233aa9f4a76c3346d_glassworm_icedid_luca-stealer_njrat_stealc.exe	90
PID 4332 wrote to memory of 1228	4332	2026-08-21_35bfc8439f88ca2233aa9f4a76c3346d_glassworm_icedid_luca-stealer_njrat_stealc.exe	90
PID 4332 wrote to memory of 1228	4332	2026-08-21_35bfc8439f88ca2233aa9f4a76c3346d_glassworm_icedid_luca-stealer_njrat_stealc.exe	90
PID 4332 wrote to memory of 1228	4332	2026-08-21_35bfc8439f88ca2233aa9f4a76c3346d_glassworm_icedid_luca-stealer_njrat_stealc.exe	90
PID 4332 wrote to memory of 1228	4332	2026-08-21_35bfc8439f88ca2233aa9f4a76c3346d_glassworm_icedid_luca-stealer_njrat_stealc.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-21_35bfc8439f88ca2233aa9f4a76c3346d_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_35bfc8439f88ca2233aa9f4a76c3346d_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\System32\svchost.exe
  "C:/Windows/System32/svchost.exe"
  2⤵
  PID:1228

memory/1228-0-0x0000024682760000-0x0000024682899000-memory.dmp

Download