General
- Target 2026-10-28_119ae6be301e144e2dec93e17e3e596d_glassworm_icedid_luca-stealer_njrat_stealc
- Size 2.0MB
- Sample261030-l6cwtseb67
- SHA256 56c9ddee1059fb61fd2a7215e05cdd4185c4ffe0986241522279dc84c2d4c3d0
Score
10/10
Malware Config
Targets
-
- Target 2026-10-28_119ae6be301e144e2dec93e17e3e596d_glassworm_icedid_luca-stealer_njrat_stealc
- Size 2.0MB
- SHA256 56c9ddee1059fb61fd2a7215e05cdd4185c4ffe0986241522279dc84c2d4c3d0
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Adds policy Run key to start application
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1