Overview

overview

10

Static

static

10

2026-09-09...lc.exe

windows10-2004-x64

9

2026-09-09...lc.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 00:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-09_0415427418a2736793841ba8379a4601_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
  • Size 9.7MB
  • Sample260910-bam2tavxhx
  • SHA256 1871fd0591792cfb332c9e3c608ca903ee4efd86655c1c280a3cfca2c5b5c7b1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Detects executables referencing many IR and analysis tools 1 IoCs
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-09_0415427418a2736793841ba8379a4601_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-09_0415427418a2736793841ba8379a4601_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
    1⤵
    • Creates a file in the Startup directory
    • Adds Run key to start application
    • Checks for any installed AV software in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5064
    • C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /tn "MicrosoftEdgeUpdate_3y4qw" /tr "\"C:\Users\Admin\AppData\Local\Temp\2026-09-09_0415427418a2736793841ba8379a4601_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe\"" /sc ONLOGON /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3692
    • C:\Program Files\7-Zip\7z.exe
      "C:\Program Files\7-Zip\7z.exe" a "-pa147347d69d0b9c5" -mhe=on -t7z -mx9 "C:\Users\Admin\AppData\Local\Temp\vg__s12re5\32d6ba-Admin.7z" "C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\*"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3704
    • C:\Users\Admin\AppData\Local\Temp\runtime__89ccofec.exe
      "C:\Users\Admin\AppData\Local\Temp\runtime__89ccofec.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2168
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c title Sentialist
        3⤵
        • Executes a command shell one-liner
        PID:6032
  • C:\Users\Admin\AppData\Local\Temp\2026-09-09_0415427418a2736793841ba8379a4601_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-09_0415427418a2736793841ba8379a4601_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
    1⤵
      PID:4256
    • C:\Users\Admin\AppData\Local\Temp\2026-09-09_0415427418a2736793841ba8379a4601_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-09_0415427418a2736793841ba8379a4601_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
      1⤵
        PID:4236

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            Windows Command Shell

            1
            T1059.003

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            2
            T1547.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            2
            T1547.001

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Modify Registry

            1
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            2
            T1552

            Credentials In Files

            1
            T1552.001

            Credentials in Registry

            1
            T1552.002

            Discovery

            Browser Information Discovery

            1
            T1217

            Query Registry

            2
            T1012

            Software Discovery

            1
            T1518

            Security Software Discovery

            1
            T1518.001

            System Information Discovery

            1
            T1082

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Data from Local System

            2
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            runtime__89ccofec.exe
            • Path C:\Users\Admin\AppData\Local\Temp\runtime__89ccofec.exe
            • Size 477KB
            • SHA256 a17385324dbbb12770ad6a4c2a6eea3813c9ee94278311857ce733cade74bdb2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            32d6ba-Admin.7z
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\32d6ba-Admin.7z
            • Size 1.3MB
            • SHA256 a60d5353fd9d491cea0ad89cf61fe96baddae07be45ea4416847430abcf0b2df
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            History.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\Browser\Edge\History.txt
            • Size 66B
            • SHA256 982bc4c33531c8dc768a76be5913cb723f5641b0432febd4339d6f1ad88f0ac6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Bookmarks.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\Browser\Firefox\Bookmarks.txt
            • Size 367B
            • SHA256 4dc748ca7535f1c6a8cc1414733d9459457b3d2080a3a5e96386570af9a0647d
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            history.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\Credentials\Edge\history.txt
            • Size 70B
            • SHA256 b7f309d4b10a925559913cb035068575c2486f7ef1a4cf16068820a10573a380
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            email_clients.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\Credentials\email_clients.txt
            • Size 205B
            • SHA256 f98851768243ae20f6e1d6991a9e74fe51d120aa4598341675dc304431f5f7b4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Desktop.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\Directories\Desktop.txt
            • Size 960B
            • SHA256 9e489435ba3819ed4a64befc3b52efd548bba4deb5057f7c0f752d13b82b8c48
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Documents.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\Directories\Documents.txt
            • Size 817B
            • SHA256 6a7012954ba8c06d644693682319c7937761abb9c664c2a451e91a89d41dd6de
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Downloads.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\Directories\Downloads.txt
            • Size 1KB
            • SHA256 0ba7b3aa09077a43137b9d7b4c01d339e71a044a64e45da02e3e9ca8c29f3363
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Music.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\Directories\Music.txt
            • Size 549B
            • SHA256 a9bc852a183c2fc805553ea72e7222f49e7ecba476fc93ae8174fb97e7375267
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Pictures.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\Directories\Pictures.txt
            • Size 1KB
            • SHA256 8a450cad269e7206bba38b99de621c470f5eee4fde06843eb0f9f8c237a6bfef
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Videos.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\Directories\Videos.txt
            • Size 64B
            • SHA256 0168720facabf636d9307e93790f3326f5e32601d23b172a41e4436d8f0072ae
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            items.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\Other\Bookmarks\items.txt
            • Size 467B
            • SHA256 c96f18685c55242c5715b74af17c1a9358defc38120652c9438c9e7f830b9af5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            items.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\Other\Email\items.txt
            • Size 239B
            • SHA256 1c0e7066dc228c73f5d0014723d2ca5af9460a2f5c92d9abf1eedd73ec79710e
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            items.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\Other\Environment\items.txt
            • Size 655B
            • SHA256 5c0ea19cc36ce24f635998b0da74860eadb3f2b13bae9116226bb9fe4a35f614
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            items.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\Other\Fingerprint\items.txt
            • Size 429B
            • SHA256 ef4d7ea95e7e5a6cefd384ffa06b26909ddf728860c5917fb9e63e6ae05641de
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            items.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\Other\Processes\items.txt
            • Size 6KB
            • SHA256 287beffe3e2b7d9ad300a6a972f3efbb6b24931d724fa36a950e021edf836d2e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            items.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\Other\ProductKey\items.txt
            • Size 88B
            • SHA256 f6e3c61f1b91066d5981a4b932a9f573d2d678cef5d02453b2558622b270fb71
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            items.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\Other\Software\items.txt
            • Size 2KB
            • SHA256 5a195eb70f8b570058793212cb263725822fa3fec2d54bfdbd8c5c366ad23186
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Antivirus.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\System\Antivirus.txt
            • Size 31B
            • SHA256 7b56726c474b8da981e067e36bcd5fbd9efcec4cadc69d2a1c416b9832eede97
            • MD5 SHA1 SHA512
            Submit Download

            MAC Addresses.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\System\MAC Addresses.txt
            • Size 34B
            • SHA256 ce3112d92be2f3d7f1382b34b6bdd05f46f28f9bdc2d69e3714b60db5c37fb0e
            • MD5 SHA1 SHA512
            Submit Download

            System Info.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\System\System Info.txt
            • Size 724B
            • SHA256 984185585fa7505529c3d072945efdc84cef36fc03cab27fcaeaa548258d70ab
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Task List.txt
            • Path C:\Users\Admin\AppData\Local\Temp\vg__s12re5\organized\System\Task List.txt
            • Size 2KB
            • SHA256 3a250c243b697fcd0eb2692d952fab9ba600c977ae33a890f1edc1bf9b7966c7
            • MD5 SHA1 SHA512 TLSH
            Submit Download