04775d7c5d61ae79b73c1d4a3ecf1391271ab27434861bcafb79b21a36557348

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_fbdb0fb0a4321576d8a43f0f1bae4d6c_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Size 6.2MB
Sample260823-rt3jlsxelb
SHA256 04775d7c5d61ae79b73c1d4a3ecf1391271ab27434861bcafb79b21a36557348
MD5 fbdb0fb0a4321576d8a43f0f1bae4d6c
SHA1 5b40a64c378a73fb0901930103c4ee8f8933a3d0
SHA512 b2d4fcd2288b066368f2cff8bab8e6747b22d905b45f975992c72b603faae1b1f390b0388482f7ee5d2afb7d683a561c3f5cdca2a446997b021e03b75bf30e70
SSDEEP 49152:R2dGHel4jCvavCvtlzGsstu6th5g5TXp0OXGpyiKC9D8eI1WQcq7a0AkowrjPWi2:jCvfvtXTJg3INfSr856yGtvWfau+8U9
TLSH
T10E667D1E7A6E00E9C1BFE1788A87950BEAB17895033597CB66E18E550F13AF15F3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-08-23_fbdb0fb0a4321576d8a43f0f1bae4d6c_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-23_fbdb0fb0a4321576d8a43f0f1bae4d6c_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-08-23_fbdb0fb0a4321576d8a43f0f1bae4d6c_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-23_fbdb0fb0a4321576d8a43f0f1bae4d6c_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_fbdb0fb0a4321576d8a43f0f1bae4d6c_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads