97cfe80e5ee5b5c1b51419c1348d6c95b5aa8eeb22fb04f2d9e99ffba3ca6d95

Analysis

max time kernel
150s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_08d7fc50eeebefe865da496349cd0ea3_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 9.3MB
Sample260924-sav6vsff39
SHA256 97cfe80e5ee5b5c1b51419c1348d6c95b5aa8eeb22fb04f2d9e99ffba3ca6d95
MD5 08d7fc50eeebefe865da496349cd0ea3
SHA1 303a2d909f5c35256204f2ee48d8d2f997676cca
SHA512 e48f9f5e8c3a79024bbf80ec37bc43331de2d65b25d132effd7151c500f195c43ff3aadbe3e9d70f5a258ed3cdbe73f24a2cc743e23cf3cb6debec9033353c39
SSDEEP 196608:l+Qb6PZ/CnZZfZFWpuj0o36SG2Pwxz1w+I216dz/o:wQ2RKZZfZFWpwh36CPV+I21q/o
TLSH
T15CA6011AA2A801EAD0FAD179CF579427FB73784A033596FF03E0C5561F176219A3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4852	2026-09-23_08d7fc50eeebefe865da496349cd0ea3_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeIncBasePriorityPrivilege	4852	2026-09-23_08d7fc50eeebefe865da496349cd0ea3_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: 33	4852	2026-09-23_08d7fc50eeebefe865da496349cd0ea3_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	256	2026-09-23_08d7fc50eeebefe865da496349cd0ea3_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeIncBasePriorityPrivilege	256	2026-09-23_08d7fc50eeebefe865da496349cd0ea3_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: 33	256	2026-09-23_08d7fc50eeebefe865da496349cd0ea3_glassworm_icedid_luca-stealer_njrat_stealc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-23_08d7fc50eeebefe865da496349cd0ea3_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_08d7fc50eeebefe865da496349cd0ea3_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Users\Admin\AppData\Local\Temp\2026-09-23_08d7fc50eeebefe865da496349cd0ea3_glassworm_icedid_luca-stealer_njrat_stealc.exe
C:\Users\Admin\AppData\Local\Temp\2026-09-23_08d7fc50eeebefe865da496349cd0ea3_glassworm_icedid_luca-stealer_njrat_stealc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

corex.ini

Path C:\Users\Admin\AppData\Roaming\CoreX\corex.ini
Size 780B
SHA256 e710ef20b0fa00279dedbd9fcc44fc152f60a8fa76a717fc0220aa5c65d28194
MD5 381ad252907523c2f9c6adec50d04e09
SHA1 4f8c3228f81f87753a2ec8cace6e86c84ba095b7
SHA512 fda4112d410b23f8f180bb99bf550550c88d88c838f10e8f9e240bb8c10b02060ff3a5bea1944004c78090487d1ea802ee549bdd19eb436d5a1b5692520d2b19
TLSH
T17301711716F90014F1F29BD8EFF96472A772BC621819C82C51D2434E8AF5E41A4533BB
MD5 SHA1 SHA512 TLSH

Submit Download