cd25aa4dd27d92a8df30ded51a0bbb8dc5dd515e255999d98929502914744fae

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_58e53c81835e81fdf9424c8558591819_blankgrabber_glassworm_icedid_stealc_vidar.exe
Size 35.7MB
Sample261024-pmccqshy4x
SHA256 cd25aa4dd27d92a8df30ded51a0bbb8dc5dd515e255999d98929502914744fae
MD5 58e53c81835e81fdf9424c8558591819
SHA1 5af916e1d11d1e88dd2f1b4a355ea564bf5ff665
SHA512 e8fce4d5f032fcde606d440de487cc9008a3158f06112de6b99e206856ba7b765e4e34008c47c65b703a9b55cf8fcbb0ecdbf2384181182a4da177554a1dfabb
SSDEEP 786432:KptvMqdy6rKUlisR67UeXEtLYiZR+u6hggHh5Cmah9bOFnl:GvrOE8U4SNb6WMvCdDbOF
TLSH
T1EA8701D272E04069C162D67AC663EA1BD33FB4215B16639B2195A71A6F43780FF38F34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion persistence spyware trojan

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2064	rackeldevs.exe
1400	Prestige-loader.exe
5412	crypto-address-watch.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\CurrencyWatcher = "\"C:\\Program Files (x86)\\Currency\\crypto-address-watch.exe\""	reg.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Currency\crypto-address-watch.exe	Prestige-loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\936CDBA49963307FC509C72CD04E8D0CE0F7DADC\Blob = 030000000100000014000000936cdba49963307fc509c72cd04e8d0ce0f7dadc200000000100000039030000308203353082021da00302010202144abf3bc4e823c23fe46e28f486aa316c70c18084300d06092a864886f70d01010b050030283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f7879301e170d3236303930353031353033395a170d3336303930323031353033395a30283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f787930820122300d06092a864886f70d01010105000382010f003082010a0282010100b06f3c76bd287f1201f00ee106202e129ce565e9fa7c506b25f67653a732d4748134d9d83e0d882c28fd5081873bcba5211b65b1e0dd73ba172f89df8b1a735154573e1cbc1845096617c1120090f776be8243db93e3761cba55c28e72db70d6baa85b3fdc3731adea8041349053c2f1685e2a56a40e31f4c76c973c8272f1a636291693056fddc8a2fc45a20784a90fefcef24fc1c51fecda84a9834e82223697f7c4c3119f0d3dad6ddf6670a2074eef9839395d8e184deefcb42f887f64766a0ac1dac87664c29f512559a138aca1d9bee1852e658365e0ad729f01d987bd8740c7cc66601ea03a3bdfe37f55e8bf52490044bf936478ebd0baea87981e4d0203010001a3573055300f0603551d130101ff040530030101ff30130603551d25040c300a06082b06010505070301300e0603551d0f0101ff040403020106301d0603551d0e04160414fdbb3e6c8b88e47ab712b7a1b38a42305a38b60c300d06092a864886f70d01010b05000382010100346c58d908e7ec20f91774dd5827415fa878931f1f16269f42dc1f230d1f4e556b2374524ed01b17ef2fb904327c75a8844a315da6bd09bb578950b19d804fd5968aa5ab9455e5840dd658bde45d42e65c42323b2e9bf2fa1eb8b17fecdd0ad5a455831e69ebd0a164d059ae6c04741c936160a30f21724bb6ea81ea0fe7ff24c9b3caae2862fee0e87136f6368f676c3bce234e8238a981652f82d50100cf4ca4a01a6ff87cac90de7795c17fb6d352ce2da07a3c1cbfb68de8d306df183d3df1f5edb53d970176500bd9b1a8b5ac1ec6391b30f5b0209d593acb0b3c64f6eafad2a9528b9809c1637bfcc4aa7319440d55b721fcf4cba767d58fd2c1b760bc	rackeldevs.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1308	reg.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\936CDBA49963307FC509C72CD04E8D0CE0F7DADC	rackeldevs.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
1400	Prestige-loader.exe
1400	Prestige-loader.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe
2064	rackeldevs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2064	rackeldevs.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5556 wrote to memory of 2064	5556	2026-10-22_58e53c81835e81fdf9424c8558591819_blankgrabber_glassworm_icedid_stealc_vidar.exe	88
PID 5556 wrote to memory of 1400	5556	2026-10-22_58e53c81835e81fdf9424c8558591819_blankgrabber_glassworm_icedid_stealc_vidar.exe	89
PID 1400 wrote to memory of 1308	1400	Prestige-loader.exe	90
PID 1400 wrote to memory of 5412	1400	Prestige-loader.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-10-22_58e53c81835e81fdf9424c8558591819_blankgrabber_glassworm_icedid_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_58e53c81835e81fdf9424c8558591819_blankgrabber_glassworm_icedid_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5556
- C:\Users\Admin\AppData\Local\2026-10-22_58e53c81835e81fdf9424c8558591819_blankgrabber_glassworm_icedid_stealc_vidar\rackeldevs.exe
  "C:\Users\Admin\AppData\Local\2026-10-22_58e53c81835e81fdf9424c8558591819_blankgrabber_glassworm_icedid_stealc_vidar\rackeldevs.exe"
  2⤵
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Users\Admin\AppData\Local\2026-10-22_58e53c81835e81fdf9424c8558591819_blankgrabber_glassworm_icedid_stealc_vidar\Prestige-loader.exe
  "C:\Users\Admin\AppData\Local\2026-10-22_58e53c81835e81fdf9424c8558591819_blankgrabber_glassworm_icedid_stealc_vidar\Prestige-loader.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1400
- - C:\Windows\System32\reg.exe
    "C:\Windows\System32\reg.exe" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v CurrencyWatcher /t REG_SZ /d "\"C:\Program Files (x86)\Currency\crypto-address-watch.exe\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:1308
- - C:\Program Files (x86)\Currency\crypto-address-watch.exe
    "C:\Program Files (x86)\Currency\crypto-address-watch.exe"
    3⤵
    - Executes dropped EXE
    PID:5412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Prestige-loader.exe

Path C:\Users\Admin\AppData\Local\2026-10-22_58e53c81835e81fdf9424c8558591819_blankgrabber_glassworm_icedid_stealc_vidar\Prestige-loader.exe
Size 358KB
SHA256 5633efc6e876941a4a3fca6f876828e4b871fa237a9f79d5e6d4e7bde022de0e
MD5 693f27c97d998e157010ad2b2016804e
SHA1 f8a9c77f5c7b8848be74cbd6837761d4e0311304
SHA512 43f7f9f70c58669fe637eff7f0a8cfa5b3b6da4262c60807098cfe2334fa64952286c4fe7b7fdcc8beae279bfa3349cdb5682844fa06600a12f60a22d726d6f4
SSDEEP 6144:Ee9CuENLcnaOJOgx7U/RP9yGIvd6GcWbVpuUEuQmDHWIF0u1uFhfue5i:DUctJTx6ZkQmc9Fl5i
TLSH
T1C0744B11FA5518FCD05BC07482558A72AA7278CF0B31A9FF22D842393F6AAF55E3C764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crypto-address-watch.exe

Path C:\Users\Admin\AppData\Local\2026-10-22_58e53c81835e81fdf9424c8558591819_blankgrabber_glassworm_icedid_stealc_vidar\crypto-address-watch.exe
Size 387KB
SHA256 ad8584b4ea69237f92a3bffca9a9d35a0a13c31dfea14da74cdfd152d897838a
MD5 58fc0f65c952e2b8fd2deb14f9d0096e
SHA1 267ea9b97f015a18275ee7eeff490c0502de78b7
SHA512 3a6095bb6aea42bf12e28be291219dea56057f0abb654e08e86c725de2c6cc099ae51d0279c41d43ceedafbd5a5ff8386d2a389d275ca738a5069b6cccbd74ce
SSDEEP 6144:6l9pDvMxa04pxGBnNRRKjLhpfvvic65axnyGaTtNUCMUPA+uXen:6lfDT0KGHud6tNao3S
TLSH
T136844B11FA9518ECE057C07482558672A6B278CE0B32E9FF22D842793F7A6F55F38B14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rackeldevs.exe

Path C:\Users\Admin\AppData\Local\2026-10-22_58e53c81835e81fdf9424c8558591819_blankgrabber_glassworm_icedid_stealc_vidar\rackeldevs.exe
Size 34.8MB
SHA256 94d15295e9aff5160291a4980fdf4a1b4b32f74d30f979a9a3ad488d73f0a561
MD5 38a7b8515e9d762537d275b13dca80d5
SHA1 e8a52fabc691e4f05311e695a32f3675c19825a9
SHA512 c13933fa5a6c8d85b59990ac01b3c366645b567e136cfec7d775b0fde8aa90071f8c01a6894186cf2e29618973f859ffe29ad568a03c9244e0eeb130e1b056df
SSDEEP 786432:YptvMqdy6rKUlisR67UeXEtLYiZR+u6hggHh5Cmah9bOFnl:EvrOE8U4SNb6WMvCdDbOF
TLSH
T1F78701D272E04169C162DA7AC663EB1FD33FB4215B16638B2195AB1A5E43780FE34F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Inter.ttf

Path C:\Users\Admin\AppData\Local\OpenPrestige\Inter.ttf
Size 856KB
SHA256 29160a80ff49ddcab2c97711247e08b1fab27a484a329ce8b813d820dc559031
MD5 bff0f6e3b9e2259a28313168a907054f
SHA1 97d4f3722d62c6cc5340bf6220ada3d64ca367b1
SHA512 3b71d2ca0b0b7649d939f982fe5b973c913c4b0a89e1b07ea6b8b1fcf5f8c8f25b5cf293936f936b1e8b43831ea976bd82151cd0ad0d2847b254f6a3ac0b7f9c
SSDEEP 24576:PY598csuuuPz2iKeRpz6iruEOwRy+4FFhex:PYv8cB2iKeRpz6iar9FU
TLSH
T136158D53F682CF5AC259273486B30B9962395871FF17030F596A33B8BE933E1694D6E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmp9646.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp9646.tmp
Size 1KB
SHA256 66958b31ab05b82fecd628de7eacebc318582b89e95880587df35578b0fe0f6a
MD5 46e389512b7e53b8cd2a39a1641f19a1
SHA1 6d99e97755921bbb40a26793d6625b1f49e7004c
SHA512 5d8ae4f34f3abb805a76323a2b01b9badaaefa85af15b31cd476ab8b647d237edf396ef8968d362639b03d0f0ea9fac44f0084c0d474b21c3de153ab7e187e8b
TLSH
T17321AA68CE7145155D9FF02655AFC585443CD31128AE7C7E29433567BB4B13D077CD84
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp96D5.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp96D5.tmp
Size 2KB
SHA256 7dce6442311f6a6510810569ff964fe4574d00650fbd99cc626b9c09430d319c
MD5 d05de659f10754eee52d582cc090ffba
SHA1 520f9f18c8a4bd37ce754b49e5f2ba429c353be4
SHA512 4310347afeb6a6201a970bdcbe35ea0664109168b3520879a5321646c74264b01e1e254b0da82f81857ccce668eebac0cde6b5a6ee6a2c72b4db61121746bc03
TLSH
T11C512B53605A46A4BD6CCE2C1D0BD3405BE9C626D9923A9EB8F1518ACDD03B1EC1C51F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2064-16-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/2064-31-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/2064-32-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/2064-17-0x0000000000200000-0x00000000024D2000-memory.dmp

Download

memory/2064-15-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/2064-14-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/2064-13-0x00007FFB4E30F000-0x00007FFB4E310000-memory.dmp

Download

memory/2064-69-0x0000000024260000-0x0000000024272000-memory.dmp

Download

memory/2064-73-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download

memory/2064-74-0x00007FFB4E180000-0x00007FFB4EB24000-memory.dmp

Download