Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 04:38
General
- Target 2026-10-22_920fa76450fc9b5ffcf9a61ce71208a8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat.exe
- Size 74.8MB
- Sample261024-e9h4pahx6m
- SHA256 c2fdcef224813c4a1ca06dc96ff4b0043f8171a00c32918554257a16ae607286
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 12 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Detects Pyinstaller 1 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Kills process with taskkill 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 28 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_920fa76450fc9b5ffcf9a61ce71208a8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_920fa76450fc9b5ffcf9a61ce71208a8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_920fa76450fc9b5ffcf9a61ce71208a8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_920fa76450fc9b5ffcf9a61ce71208a8_blankgrabber_coinminer_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /query3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn TelemetrySync /tr \"C:\Users\Admin\AppData\Roaming/SystemInformer\InformerUpdate.exe\" /sc onlogon /rl highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\SystemInformer\InformerUpdate.exeC:\Users\Admin\AppData\Roaming/SystemInformer\InformerUpdate.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SystemInformer\InformerUpdate.exeC:\Users\Admin\AppData\Roaming/SystemInformer\InformerUpdate.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ConfigService\SysSettingSvc.exeC:\Users\Admin\AppData\Roaming/Microsoft/Windows/ConfigService\SysSettingSvc.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ConfigService\SysSettingSvc.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\ConfigService\SysSettingSvc.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /IM Telegram.exe /F7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill /IM Discord.exe /F7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\SystemInformer\InformerUpdate.exe"C:\Users\Admin\AppData\Roaming/SystemInformer\InformerUpdate.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SystemInformer\InformerUpdate.exe"C:\Users\Admin\AppData\Roaming/SystemInformer\InformerUpdate.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x000000000000048C 0x00000000000004F81⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_ctypes.pyd
base_library.zip
InformerUpdate.exe
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
_psutil_windows.pyd
python3.DLL
python312.dll
select.pyd
VCRUNTIME140.dll
_bz2.pyd
_lzma.pyd
python3.DLL
python312.dll
ucrtbase.dll
__PSScriptPolicyTest_3dj3bbom.ksc.ps1
screenshot.png
memory/1960-329-0x00007FF6D1A50000-0x00007FF6D5696000-memory.dmp
memory/3288-359-0x00007FFEF7EC0000-0x00007FFEFCD72000-memory.dmp
memory/3288-334-0x00007FFEF7EC0000-0x00007FFEFCD72000-memory.dmp
memory/3288-331-0x00007FFEF7EC0000-0x00007FFEFCD72000-memory.dmp
memory/3288-330-0x00007FF6D1A50000-0x00007FF6D5696000-memory.dmp
memory/3288-337-0x00007FFEF7EC0000-0x00007FFEFCD72000-memory.dmp
memory/3288-342-0x00007FFEF7EC0000-0x00007FFEFCD72000-memory.dmp
memory/3288-345-0x00007FFEF7EC0000-0x00007FFEFCD72000-memory.dmp
memory/3288-348-0x00007FFEF7EC0000-0x00007FFEFCD72000-memory.dmp
memory/3288-353-0x00007FFEF7EC0000-0x00007FFEFCD72000-memory.dmp
memory/3288-356-0x00007FFEF7EC0000-0x00007FFEFCD72000-memory.dmp
memory/3288-362-0x00007FFEF7EC0000-0x00007FFEFCD72000-memory.dmp
memory/3288-365-0x00007FFEF7EC0000-0x00007FFEFCD72000-memory.dmp
memory/3288-368-0x00007FFEF7EC0000-0x00007FFEFCD72000-memory.dmp
memory/5096-46-0x00007FFF0FB6F000-0x00007FFF0FB70000-memory.dmp
memory/5096-77-0x00000263F7A79000-0x00000263F7A7F000-memory.dmp
memory/5096-76-0x00007FFF0F9E0000-0x00007FFF10384000-memory.dmp
memory/5096-73-0x00007FFF0F9E0000-0x00007FFF10384000-memory.dmp
memory/5096-328-0x00007FFF0F9E0000-0x00007FFF10384000-memory.dmp
memory/5096-74-0x00007FFF0F9E0000-0x00007FFF10384000-memory.dmp
memory/5096-72-0x00007FFF0F9E0000-0x00007FFF10384000-memory.dmp
memory/5096-71-0x00000263F7BA0000-0x00000263F7BAA000-memory.dmp
memory/5096-70-0x00000263F7DE0000-0x00000263F7E92000-memory.dmp
memory/5096-69-0x00000263F7B80000-0x00000263F7B9E000-memory.dmp
memory/5096-62-0x00007FFF0F9E0000-0x00007FFF10384000-memory.dmp
memory/5096-61-0x00007FFF0F9E0000-0x00007FFF10384000-memory.dmp
memory/5096-60-0x00007FFF0F9E0000-0x00007FFF10384000-memory.dmp
memory/5096-59-0x00007FFF0F9E0000-0x00007FFF10384000-memory.dmp
memory/5096-58-0x00007FFF0F9E0000-0x00007FFF10384000-memory.dmp
memory/5096-57-0x00007FFF0F9E0000-0x00007FFF10384000-memory.dmp
memory/5096-56-0x00007FFF0F9E0000-0x00007FFF10384000-memory.dmp
memory/5096-55-0x00007FFF0F9E0000-0x00007FFF10384000-memory.dmp
memory/5096-53-0x00000263F7AE0000-0x00000263F7B02000-memory.dmp
memory/5096-54-0x00007FFF0F9E0000-0x00007FFF10384000-memory.dmp