939f688c233f5779bb737a5a573885436d5b4dd1a18ef57cc1e8aaef416764e0

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/09/2026, 22:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_fe430427335a4a2c1d4ef63a3af0b218_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Size 9.4MB
Sample260901-2mcdysck4v
SHA256 939f688c233f5779bb737a5a573885436d5b4dd1a18ef57cc1e8aaef416764e0
MD5 fe430427335a4a2c1d4ef63a3af0b218
SHA1 049423b1ca8c829f4b37c952fc357d90237e58c4
SHA512 85125a86978b21a28dc61c5225c79b112a455be77be8a57c521140805513a5089a1b8875e43731d4574163f43cdb803f5fce8cfd881ad8cf5681345cf683fdcc
SSDEEP 196608:e83DGUbeWpQj3emtIpt+h+UOjtP+cR5X:RzPbeWpQj3emtIpt+h+UOZP+O
TLSH
T1D6A68C55E37800D8D4ABC2B8C7465253D771744A03B0ABDF1B90AEA62F33AE51E7B712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	2026-08-31_fe430427335a4a2c1d4ef63a3af0b218_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4612	2026-08-31_fe430427335a4a2c1d4ef63a3af0b218_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
4612	2026-08-31_fe430427335a4a2c1d4ef63a3af0b218_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4044	7z.exe
Token: 35	4044	7z.exe
Token: SeSecurityPrivilege	4044	7z.exe
Token: SeSecurityPrivilege	4044	7z.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 4044	4612	2026-08-31_fe430427335a4a2c1d4ef63a3af0b218_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-31_fe430427335a4a2c1d4ef63a3af0b218_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_fe430427335a4a2c1d4ef63a3af0b218_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
1⤵
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" a "-p6d55a9befce09ea9" -mhe=on -t7z -mx9 "C:\Users\Admin\AppData\Local\Temp\vg__3mro12tl\33f020-Admin.7z" "C:\Users\Admin\AppData\Local\Temp\vg__3mro12tl\organized\*"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

T1518

Security Software Discovery

T1518.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

33f020-Admin.7z

Path C:\Users\Admin\AppData\Local\Temp\vg__3mro12tl\33f020-Admin.7z
Size 2KB
SHA256 8dbedebce00652c7a7e44e4958a625b7ea7c97b2c6a708c7c4478d3fec2c2a14
MD5 2975850d2773d63c752fbf99f0f5630e
SHA1 adc54f9acb616a31142b9dbd1c37dd9709ff893b
SHA512 c991d99bde8c0b8bcadde5443cf655fef27cc2f85a98f63834900572770067c29a14243af4ca9f9c50c9116f0de84956e2a2659d220a3aa4bd8bae5658560560
TLSH
T10F515F8E96A6B3B4F98717541E002105EBD43CBECE0A73772EC8D062C3562D743CA5D9
MD5 SHA1 SHA512 TLSH

Submit Download

Desktop.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__3mro12tl\organized\Directories\Desktop.txt
Size 780B
SHA256 8e4d20fd0ce92a7e503f5a13403b05de8849baa8f83738ca2e54389296ae8b66
MD5 31c89e851df27c03c3772d6083ed9f1c
SHA1 a0763818348f7d12bd74bc83af22617e727af01b
SHA512 b9390ab8b2ed893fdf8488f8a543736568486ae4c0294c2c2116fa702f3def5f2415223f4e1cee0926d3316cab6458a47feae6ef3a64ffa409c3ddbd05d399f7
TLSH
T15C01D00F397CEC231B995CFC0F21798716E69AC90D9BDBA6BBCECD31A6457072461405
MD5 SHA1 SHA512 TLSH

Submit Download

Documents.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__3mro12tl\organized\Directories\Documents.txt
Size 509B
SHA256 cfe9360aea8b8f29e29fa27a99f28cd502fd9aa32cb2497d347eb0282a5f4999
MD5 2295c1912e8647652ac1b1de1011cf25
SHA1 d2a6d16255c090785efeffeb9762d75cd546abf6
SHA512 87ae8ab8c21535ab6c814b74b35d8271042e7363808abd9005f5efc67986383b85c1789d1e3070f04f2fb0d4f4842f5e04c10a2f4be92b7e9c631d1b635881a4
TLSH
T1CBF09ACC48B9EE6A8903E8E44360769306D21ECB9F78F9BF736F8964118152402DCC0B
MD5 SHA1 SHA512 TLSH

Submit Download

Downloads.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__3mro12tl\organized\Directories\Downloads.txt
Size 1KB
SHA256 daf4b783629c539d6bbb37e25d74fc37e6b51830c57b597058913d7a12c530cf
MD5 37607cf71155d1f36c664ee82de45927
SHA1 4cade8fdd8d4e0219c55a98c22f2eefb5012dd37
SHA512 9e2826f35def5bf16f426d0dc6deeb799df1cd8b8143ccfd07320ffa60b4665df5bed4ba7b876c164ba68975f6939af1fcf5994e7b436b16dc3006c85cb52b48
TLSH
T1BB21F4D61E75EE299A8056E40F51760306DE04CE2FA5E4B23FDFDCF00B5630EA125817
MD5 SHA1 SHA512 TLSH

Submit Download

Music.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__3mro12tl\organized\Directories\Music.txt
Size 640B
SHA256 86ddcdf30250413862826b8ad4a76b773b6b7d4b15a51eafcfdec55dbc9836fb
MD5 7fa23efb2cf8c73d85ce00ec0702125f
SHA1 47b45c505fbcf19c3a7be84eeb046ca48356e8f4
SHA512 fbbce9f800b8a6c726515d4f96216736ad784cd56f03116db0704747b36a4159785c38dfd547fa1037ee82c16a3aa7cbeeab94c11fd4794938c31e5521395379
TLSH
T1EEF099C55239DA4F5E826D901302741343C54ECB6DB8F1BA388FDD914203C4458EEC01
MD5 SHA1 SHA512 TLSH

Submit Download

Pictures.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__3mro12tl\organized\Directories\Pictures.txt
Size 903B
SHA256 d3c857c228b971cfb76ba283bf8dbeaab4fde355ecddb5553910821c11c027cc
MD5 cf2cd23b02745f7c436b90abdfe5fc52
SHA1 df34ee624835e8a73c615c56e361277235a21936
SHA512 eaa63d523f0ac19b8ec7a84754f468f3cabd569e006871f822d21627fec023b8474f7be715bf6d7cd3bc565d42a820cad76567143f953d5ed477b6a705895799
TLSH
T14A11598F3479ED2325616CA91F64718706C919CF9D01E9F676DFDCA36A095074631C42
MD5 SHA1 SHA512 TLSH

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__3mro12tl\organized\Directories\Videos.txt
Size 64B
SHA256 0168720facabf636d9307e93790f3326f5e32601d23b172a41e4436d8f0072ae
MD5 8100dc3aba0a9885142dcf57555aeb26
SHA1 dad54e7648029a2821f0ccbe29d6c19565eb859e
SHA512 391c3ace74e6c4c56dc7f1fda276f5bea8dd5572db784528156f3c3c4f9771600bd0b9f59f01b85462acc4d14292aad646422588d0bfed8396cfaa6a8bf54595
TLSH
T174A0220A38AF0E2B000C20E20238E00CC38F0C823F802A0833838280C8030200AB00A2
MD5 SHA1 SHA512 TLSH

Submit Download

System Info.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__3mro12tl\organized\System\System Info.txt
Size 65B
SHA256 b975f5f4c8442c5c8862124525ddb2eb739d44d11356f82caa67857877d6b61f
MD5 cb91436f426e9a88f5497691a1b8c5db
SHA1 5c7753589fc975191fe01fe6c4e2837703bc0481
SHA512 4c281ed136fba3cb18658cdfadd6024db683cc7d412dbdc9b8d420ab5f5e0e92adf7dbac83f5257a3598f3f2607e70085ec0059d343e3de2b7b40d2e4d00a9bc
TLSH
T1FCA022F230C332CCA2EF0000200200CA0030AE8AF08BF208203C00C20E3C0CCC3CC08B
MD5 SHA1 SHA512 TLSH

Submit Download

Task List.txt

Path C:\Users\Admin\AppData\Local\Temp\vg__3mro12tl\organized\System\Task List.txt
Size 2KB
SHA256 205727a6fd4a2461590c1b53218002661ebe123b68f4cb8ad9ec4a710d87dc0b
MD5 3e3f4560b2c973b1e42bc41744bbe5ce
SHA1 950ab1d43ee39e1c5e7fab5a41500f94dffa9806
SHA512 ef69d10589c63754e3c3071bca6faf165f220794e0d7f132165cce0f40adb2e011e3f500c2e10a9766a3d603448c130da356c1463914cd737cc6bb9603420f21
TLSH
T1A841A507D19FD6DED1D510EF3E212A1F1BAB092C044F5CE972421AEC29B0C1DDA4A71D
MD5 SHA1 SHA512 TLSH

Submit Download