Overview

overview

10

Static

static

10

2026-09-25...lc.exe

windows10-2004-x64

7

2026-09-25...lc.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 17:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-25_ee550f9000309bd4e4b8b597ba41838d_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
  • Size 9.5MB
  • Sample260925-v677easdqf
  • SHA256 220816ae15e5d34a46de30eec0f36a802b526a21f7b4dbaafc4ac53c64bbaea4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-25_ee550f9000309bd4e4b8b597ba41838d_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-25_ee550f9000309bd4e4b8b597ba41838d_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
    1⤵
    • Checks for any installed AV software in registry
    • Enumerates connected drives
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4852
    • C:\Program Files\7-Zip\7z.exe
      "C:\Program Files\7-Zip\7z.exe" a "-p5fc7f97eb00ffd41" -mhe=on -t7z -mx9 "C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\22f476-Admin.7z" "C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\*"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2608

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        22f476-Admin.7z
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\22f476-Admin.7z
        • Size 3.7MB
        • SHA256 454f9bd3015379dc151e7fe0d2d5404c57ee7c37239b7652e76776e95ccb0eaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        History.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\Browser\Edge\History.txt
        • Size 66B
        • SHA256 982bc4c33531c8dc768a76be5913cb723f5641b0432febd4339d6f1ad88f0ac6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Bookmarks.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\Browser\Firefox\Bookmarks.txt
        • Size 367B
        • SHA256 4dc748ca7535f1c6a8cc1414733d9459457b3d2080a3a5e96386570af9a0647d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        history.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\Credentials\Edge\history.txt
        • Size 70B
        • SHA256 b7f309d4b10a925559913cb035068575c2486f7ef1a4cf16068820a10573a380
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        email_clients.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\Credentials\email_clients.txt
        • Size 205B
        • SHA256 21eb4b3d1d345f9892a6020bc9ecb597ce0e969bf89735a839741b83cf8e6e8a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Desktop.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\Directories\Desktop.txt
        • Size 1KB
        • SHA256 dd3fceea9d86b427bbaf43fd67f199b8d87d3d46d0840c0b484263f75519d7de
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Documents.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\Directories\Documents.txt
        • Size 921B
        • SHA256 a719f64527ab98efae333038d94b00ef49a982aaaf69c2f5373bb3cafcc7624b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Downloads.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\Directories\Downloads.txt
        • Size 1KB
        • SHA256 d7407c4034ba47c2d0ee06a4465f24a87c1dc4b125082c08c769a20b7002ae4f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Music.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\Directories\Music.txt
        • Size 460B
        • SHA256 e9d76ae7f49e5e1f92965c689232895e02084497ebaf3030c4024ee75de7b657
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Pictures.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\Directories\Pictures.txt
        • Size 1KB
        • SHA256 c49cb767a855d236e214fe6e0411e7d13c5718dcb51f544ec97a917457bf8afc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Videos.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\Directories\Videos.txt
        • Size 64B
        • SHA256 0168720facabf636d9307e93790f3326f5e32601d23b172a41e4436d8f0072ae
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        items.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\Other\Bookmarks\items.txt
        • Size 467B
        • SHA256 c96f18685c55242c5715b74af17c1a9358defc38120652c9438c9e7f830b9af5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        items.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\Other\Email\items.txt
        • Size 239B
        • SHA256 9605351f81575fc0e55d227ab2e83e3ec5a956d39fbaae2d8dfc06da7b9a8648
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        items.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\Other\Environment\items.txt
        • Size 655B
        • SHA256 1e75d6ef9377579bcf62f75bcd4f7a4a67fefec9fbe6f2e0968865ef72226be8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        items.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\Other\Fingerprint\items.txt
        • Size 429B
        • SHA256 e49a9d83d772f2954afa792424d5a1af0d44488b1f21797ccea6aed5d4ba55ec
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        items.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\Other\Processes\items.txt
        • Size 6KB
        • SHA256 f6494865272b8617dd901c6b7af677d463b1ed491433023cc79203f62e4573d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        items.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\Other\ProductKey\items.txt
        • Size 88B
        • SHA256 f6e3c61f1b91066d5981a4b932a9f573d2d678cef5d02453b2558622b270fb71
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        items.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\Other\Software\items.txt
        • Size 2KB
        • SHA256 5a195eb70f8b570058793212cb263725822fa3fec2d54bfdbd8c5c366ad23186
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Antivirus.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\System\Antivirus.txt
        • Size 31B
        • SHA256 7b56726c474b8da981e067e36bcd5fbd9efcec4cadc69d2a1c416b9832eede97
        • MD5 SHA1 SHA512
        Submit Download

        MAC Addresses.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\System\MAC Addresses.txt
        • Size 34B
        • SHA256 c093271ec043f0aa7a26240d761e6c31534c39552de09b8a7d384d54579f3ebb
        • MD5 SHA1 SHA512
        Submit Download

        System Info.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\System\System Info.txt
        • Size 724B
        • SHA256 0a80ff77b46cd209198be71769fa4e890fd8182dabcab7aca901c9794f0c0e06
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Task List.txt
        • Path C:\Users\Admin\AppData\Local\Temp\vg__7vb1tqx\organized\System\Task List.txt
        • Size 2KB
        • SHA256 60489217f21cf791c0c726eb121edc91721a7f117005feb759d73dd6a1f57ba7
        • MD5 SHA1 SHA512 TLSH
        Submit Download