64952402556ae8a0eee90c67d8c04ac6204b5a508dfbb7992754f8c2e515dc2b

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 22:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-20_ef2e7a6ab5ed27f5562d540365ed4ade_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Size 9.5MB
Sample260920-2qphpafk8x
SHA256 64952402556ae8a0eee90c67d8c04ac6204b5a508dfbb7992754f8c2e515dc2b
MD5 ef2e7a6ab5ed27f5562d540365ed4ade
SHA1 4df6f1b5e79f244072272f5a5c47c89ab6f30b2b
SHA512 9cbeace33f4f53eada5603bf0d572b7b70e9f41fb647cd06d2c3216b6eb939ecaa98ef89c1bbde08c73082d8ba10899414df65a16cbbdb4711ce157ef63640c4
SSDEEP 98304:Lev3LWULLX+ZKteVQUYE96jOzumrUNekktV6Thsx+34f:CjWoLX+ZKteVQUYHOSmrUNekktuo1
TLSH
T14CA68C15A37800E8D4ABC2B8C7465153D771784A13B0ABDF0A90AEA52F27EF51F7B712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-09-20_ef2e7a6ab5ed27f5562d540365ed4ade_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-09-20_ef2e7a6ab5ed27f5562d540365ed4ade_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1936	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-09-20_ef2e7a6ab5ed27f5562d540365ed4ade_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-09-20_ef2e7a6ab5ed27f5562d540365ed4ade_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4184	2026-09-20_ef2e7a6ab5ed27f5562d540365ed4ade_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
4184	2026-09-20_ef2e7a6ab5ed27f5562d540365ed4ade_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4184 wrote to memory of 4980	4184	2026-09-20_ef2e7a6ab5ed27f5562d540365ed4ade_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe	90
PID 4980 wrote to memory of 1936	4980	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-09-20_ef2e7a6ab5ed27f5562d540365ed4ade_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-20_ef2e7a6ab5ed27f5562d540365ed4ade_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4184
- C:\Windows\system32\cmd.exe
  /c timeout /t 2 /nobreak >nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\2026-09-20_ef2e7a6ab5ed27f5562d540365ed4ade_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads