Analysis
- max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
17/10/2026, 14:19
General
- Target 2026-10-16_7746af6f2489b0c82c265b4623a6bf17_glassworm_icedid_luca-stealer_njrat_stealc.exe
- Size 3.6MB
- Sample261017-rmy8lsg121
- SHA256 94fe0e09dab2ffe45c808553ef4a438bebb6503a9a09996274301bac7bcd3bbb
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_7746af6f2489b0c82c265b4623a6bf17_glassworm_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-16_7746af6f2489b0c82c265b4623a6bf17_glassworm_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" qe System /q:"*[System[Provider[@Name='Microsoft-Windows-Kernel-Processor-Power'] and EventID=55]]" /c:16 /rd:true /f:xml2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue';$guid='40D2481D-95FE-47F8-B6BA-C058D3120294';$pnp='PCI\VEN_10EC&DEV_8139&SUBSYS_11001AF4&REV_20\3&11583659&0&18';$adapters=@(Get-NetAdapter -IncludeHidden -ErrorAction SilentlyContinue);$adapter=$null;if($guid){$adapter=$adapters|Where-Object{$_.InterfaceGuid -and ($_.InterfaceGuid.ToString() -ieq $guid)}|Select-Object -First 1};if(-not $adapter -and $pnp){$adapter=$adapters|Where-Object{($_.PnPDeviceID -as [string]) -ieq $pnp}|Select-Object -First 1};if(-not $adapter){[pscustomobject]@{AdapterFound=$false;RssFound=$false;Error='adapter-not-found'}|ConvertTo-Json -Compress;exit};$rss=Get-NetAdapterRss -Name $adapter.Name -ErrorAction SilentlyContinue;if(-not $rss){[pscustomobject]@{AdapterFound=$true;RssFound=$false;AdapterName=$adapter.Name;InterfaceDescription=$adapter.InterfaceDescription;Error='rss-not-found'}|ConvertTo-Json -Compress;exit};[pscustomobject]@{AdapterFound=$true;RssFound=$true;AdapterName=$adapter.Name;InterfaceDescription=$adapter.InterfaceDescription;Enabled=$rss.Enabled;BaseProcessorGroup=$rss.BaseProcessorGroup;BaseProcessorNumber=$rss.BaseProcessorNumber;MaxProcessorGroup=$rss.MaxProcessorGroup;MaxProcessorNumber=$rss.MaxProcessorNumber;MaxProcessors=$rss.MaxProcessors;NumberOfReceiveQueues=$rss.NumberOfReceiveQueues;Profile=$rss.Profile;Error=''}|ConvertTo-Json -Compress"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_0oer3ox5.pg0.psm1
DeviceTweaker_20261017_151923_817.log
DeviceTweaker_20261017_151923_817.log
memory/3316-95-0x00000233CBCA0000-0x00000233CBCBE000-memory.dmp
memory/3316-81-0x00007FF860B7F000-0x00007FF860B80000-memory.dmp
memory/3316-86-0x00007FF8609F0000-0x00007FF861394000-memory.dmp
memory/3316-87-0x00007FF8609F0000-0x00007FF861394000-memory.dmp
memory/3316-88-0x00007FF8609F0000-0x00007FF861394000-memory.dmp
memory/3316-90-0x00007FF8609F0000-0x00007FF861394000-memory.dmp
memory/3316-89-0x00007FF8609F0000-0x00007FF861394000-memory.dmp
memory/3316-91-0x00007FF8609F0000-0x00007FF861394000-memory.dmp
memory/3316-92-0x00007FF8609F0000-0x00007FF861394000-memory.dmp
memory/3316-83-0x00000233CB910000-0x00000233CB932000-memory.dmp
memory/3316-96-0x00000233CBCC0000-0x00000233CBD72000-memory.dmp
memory/3316-82-0x00007FF8609F0000-0x00007FF861394000-memory.dmp
memory/3316-97-0x00000233CBD80000-0x00000233CBD8A000-memory.dmp
memory/3316-98-0x00000233CBF00000-0x00000233CBF1E000-memory.dmp
memory/3316-99-0x00007FF8609F0000-0x00007FF861394000-memory.dmp
memory/3316-100-0x00007FF8609F0000-0x00007FF861394000-memory.dmp
memory/3316-101-0x00007FF8609F0000-0x00007FF861394000-memory.dmp
memory/3316-102-0x00007FF8609F0000-0x00007FF861394000-memory.dmp
memory/3316-103-0x00007FF8609F0000-0x00007FF861394000-memory.dmp
memory/3316-104-0x00000233CC550000-0x00000233CC712000-memory.dmp
memory/3316-105-0x00000233CCC50000-0x00000233CD178000-memory.dmp
memory/3316-107-0x00007FF8609F0000-0x00007FF861394000-memory.dmp