Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
11/10/2026, 16:49
General
- Target 2026-10-10_390449c305d1ea15d451598e7bb8b815_glassworm_icedid_luca-stealer_njrat_stealc.exe
- Size 9.0MB
- Sample261011-vbqnwadf66
- SHA256 c1a41e8ee2fae112ffff9409658d8c73005f2051caa994e82515a15c2de556c7
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs
- Windows security bypass 2 TTPs 6 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 1 IoCs
- Windows security modification 2 TTPs 9 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks for any installed AV software in registry 1 TTPs 16 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- NTFS ADS 3 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious use of AdjustPrivilegeToken 49 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_390449c305d1ea15d451598e7bb8b815_glassworm_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_390449c305d1ea15d451598e7bb8b815_glassworm_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for any installed AV software in registry
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Reads the TCP/IP host and domain name from the registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -EP Bypass -W Hidden -File "C:\Users\Admin\AppData\Local\Temp\dgsipzev.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -EP Bypass -W Hidden -File "C:\Users\Admin\AppData\Local\Temp\trbhkdze.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -EP Bypass -W Hidden -File "C:\Users\Admin\AppData\Local\Temp\ukbzzuqx.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" config MBAMService start=disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -EP Bypass -W Hidden -File "C:\Users\Admin\AppData\Local\Temp\hmiuwgay.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -EP Bypass -W Hidden -File "C:\Users\Admin\AppData\Local\Temp\pbqcbodd.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -EP Bypass -W Hidden -File "C:\Users\Admin\AppData\Local\Temp\tnpktcnp.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -EP Bypass -W Hidden -File "C:\Users\Admin\AppData\Local\Temp\tzuauxhc.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /TN System\SACOff /TR "reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f" /SC ONLOGON /RU SYSTEM /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c schtasks /create /tn "\Microsoft\Windows\WindowsUpdate\SecurityHealthCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-10-10_390449c305d1ea15d451598e7bb8b815_glassworm_icedid_luca-stealer_njrat_stealc.exe" /sc ONLOGON /rl HIGHEST /f >nul 2>&12⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "\Microsoft\Windows\WindowsUpdate\SecurityHealthCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-10-10_390449c305d1ea15d451598e7bb8b815_glassworm_icedid_luca-stealer_njrat_stealc.exe" /sc ONLOGON /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\reg.exereg1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_390449c305d1ea15d451598e7bb8b815_glassworm_icedid_luca-stealer_njrat_stealc.exeC:\Users\Admin\AppData\Local\Temp\2026-10-10_390449c305d1ea15d451598e7bb8b815_glassworm_icedid_luca-stealer_njrat_stealc.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Windows security bypass
- Windows security modification
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\WindowsShell.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Shell\WindowsShell.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Windows security bypass
- Executes dropped EXE
- Windows security modification
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
WindowsShell.exe
__PSScriptPolicyTest_smo2pfqe.el0.psm1
dgsipzev.ps1
hmiuwgay.ps1
pbqcbodd.ps1
tnpktcnp.ps1
trbhkdze.ps1
tzuauxhc.ps1
ukbzzuqx.ps1
memory/1476-55-0x000001F3EFD10000-0x000001F3F06B4000-memory.dmp
memory/2452-63-0x0000028C2E430000-0x0000028C2EDD4000-memory.dmp
memory/2628-79-0x000002A15F630000-0x000002A15FFD4000-memory.dmp
memory/2816-47-0x0000027024F80000-0x0000027025924000-memory.dmp
memory/3116-71-0x0000020BC5B20000-0x0000020BC64C4000-memory.dmp
memory/4224-21-0x0000025CD89D0000-0x0000025CD9374000-memory.dmp
memory/4224-7-0x0000025CD89D0000-0x0000025CD9374000-memory.dmp
memory/4224-25-0x0000025CD89D0000-0x0000025CD9374000-memory.dmp
memory/4224-28-0x0000025CD89D0000-0x0000025CD9374000-memory.dmp
memory/4224-29-0x0000025CD89D0000-0x0000025CD9374000-memory.dmp
memory/4224-9-0x0000025CD89D0000-0x0000025CD9374000-memory.dmp
memory/4224-23-0x0000025CD89D0000-0x0000025CD9374000-memory.dmp
memory/4224-2-0x0000025CD89D0000-0x0000025CD9374000-memory.dmp
memory/4224-22-0x0000025CD89D0000-0x0000025CD9374000-memory.dmp
memory/4224-13-0x0000025CD89D0000-0x0000025CD9374000-memory.dmp
memory/4224-16-0x0000025CF1850000-0x0000025CF186E000-memory.dmp
memory/4224-24-0x0000025CD89D0000-0x0000025CD9374000-memory.dmp
memory/4224-10-0x0000025CD89D0000-0x0000025CD9374000-memory.dmp
memory/4224-20-0x0000025CF1870000-0x0000025CF187A000-memory.dmp
memory/4224-6-0x0000025CD89D0000-0x0000025CD9374000-memory.dmp
memory/4224-17-0x0000025CF1B30000-0x0000025CF1BE2000-memory.dmp
memory/4224-19-0x0000025CD89D0000-0x0000025CD9374000-memory.dmp
memory/4224-3-0x0000025CF17B0000-0x0000025CF17D2000-memory.dmp
memory/4224-18-0x0000025CD89D0000-0x0000025CD9374000-memory.dmp
memory/4224-1-0x0000025CD916C000-0x0000025CD916D000-memory.dmp
memory/4224-12-0x0000025CD89D0000-0x0000025CD9374000-memory.dmp
memory/4224-11-0x0000025CD89D0000-0x0000025CD9374000-memory.dmp
memory/5172-39-0x000001B3C0C40000-0x000001B3C15E4000-memory.dmp