56c9ddee1059fb61fd2a7215e05cdd4185c4ffe0986241522279dc84c2d4c3d0

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 10:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_119ae6be301e144e2dec93e17e3e596d_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 2.0MB
Sample261030-l6cwtseb67
SHA256 56c9ddee1059fb61fd2a7215e05cdd4185c4ffe0986241522279dc84c2d4c3d0
MD5 119ae6be301e144e2dec93e17e3e596d
SHA1 16c2898ac01ddc5495fa26bde8913cf3bf0dcb31
SHA512 db1691bc29be5dfec10b8115d3b95970f1ad7ed9258427619b3e0ccfdae16fe96eafae86bf5bfc11a245ee7e6efa2558f54a342b4b7f2b3013d344a6ab8f33a5
SSDEEP 24576:N5QzliuNW+w5Z0kW3LaWy10gYRete+lgWulsONOAKKXMTG:N5QzsuNu5Z0xLPqhKsODU
TLSH
T123A59D07DE9403B9D1AED1788D93673ADB36742C03A15ECF5684AD222F737984B3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence privilege_escalation spyware trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 2724 created 5808	2724	2026-10-28_119ae6be301e144e2dec93e17e3e596d_glassworm_icedid_luca-stealer_njrat_stealc.exe	81
PID 3244 created 5808	3244	client0C26.exe	81

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	client0C26.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ClientUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\ClientUpdate\\0C26823E\\client0C26.exe\" --update --service"	client0C26.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	client823E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ClientUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\ClientUpdate\\0C26823E\\client0C26.exe\" --update --service"	client823E.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0C26823E.lnk	client823E.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0C26823E.lnk	client0C26.exe

Executes dropped EXE 6 IoCs

pid	Process
3244	client0C26.exe
5644	client0C26.exe
6028	client0C26.exe
5660	client823E.exe
5500	client823E.exe
5800	client823E.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\ClientUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\ClientUpdate\\0C26823E\\client0C26.exe\" --update --service"	client0C26.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\ClientService = "\"C:\\Users\\Admin\\AppData\\Local\\ClientUpdate\\0C26823E\\client823E.exe\" --update --monitor"	client0C26.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\ClientUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\ClientUpdate\\0C26823E\\client0C26.exe\" --update --service"	client823E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\Windows\CurrentVersion\Run\ClientService = "\"C:\\Users\\Admin\\AppData\\Local\\ClientUpdate\\0C26823E\\client823E.exe\" --update --monitor"	client823E.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client0C26.exe:Zone.Identifier	2026-10-28_119ae6be301e144e2dec93e17e3e596d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client823E.exe:Zone.Identifier	2026-10-28_119ae6be301e144e2dec93e17e3e596d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client0C26.exe:Zone.Identifier	client0C26.exe
File opened for modification	C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client0C26.exe:Zone.Identifier	client823E.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	client0C26.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	client0C26.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	client823E.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	client823E.exe

Modifies system certificate store 2 TTPs 15 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0C3163836F904A407BC8EEBBD1A48AD0C4D99BC4	client0C26.exe
Key deleted	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0C3163836F904A407BC8EEBBD1A48AD0C4D99BC4	client0C26.exe
Key deleted	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0C3163836F904A407BC8EEBBD1A48AD0C4D99BC4	client823E.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0C3163836F904A407BC8EEBBD1A48AD0C4D99BC4	client0C26.exe
Key deleted	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0C3163836F904A407BC8EEBBD1A48AD0C4D99BC4	client0C26.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0C3163836F904A407BC8EEBBD1A48AD0C4D99BC4	client0C26.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0C3163836F904A407BC8EEBBD1A48AD0C4D99BC4\Blob = 0300000001000000140000000c3163836f904a407bc8eebbd1a48ad0c4d99bc42000000001000000730300003082036f30820257a00302010202110a62c68d80365787c7771bd4405eaed912300d06092a864886f70d01010b05003051312e302c060355040313254d6963726f736f66742057696e646f77732050726f64756374696f6e205043412032303131310b300906035504061302555331123010060355040a13094d6963726f736f6674301e170d3236303432383139333934375a170d3336303432393139333934375a3051312e302c060355040313254d6963726f736f66742057696e646f77732050726f64756374696f6e205043412032303131310b300906035504061302555331123010060355040a13094d6963726f736f667430820122300d06092a864886f70d01010105000382010f003082010a0282010100a4281f46998596fd2250e28eef1d58f286869b429628b089ec12a01f3cdb99c42a9b836846f7fa809d012a461ffad757fc349de12f60eec6f0ebe83454f0f2d1303f86efa4ad90305e8ae67da5e2bc63c88ae766862dde1c79d02736bde8b9439fb03c25c91e76d11d3083c2a6033ec677b4a03880535f9505fcdf748b9fa947ef8e4082df5dd11374ed054f2c3db3a8a4f0a14d0a482d3eef5cd01d9d942c027c2129771530f4369e3df4979dea0d7f7cb906064e08c65a8b1f942970167eae67fed58572ee07799ef949ee492f99f49996773ed4be54b0a72b82029e7c6b234c9664248c285277ec23f0a2939c43a6970a55d6a4150710ec8f0b22d5eea4810203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301d0603551d0e04160414c2d78551c32f4aae64594b988c7acd91e8325aca300d06092a864886f70d01010b050003820101001e75c28762719e8f4eb4ea0e7d25625e077f9d2df23edecfe4ea85de96617d9464b01f82ec806412ef4cb0895b1339a5ded58852d1b12f4b5ea6ba5891e4c21d2e4ed773531a05bdefd5ce04661506b5f2de64cb0379ffaba9ec24ceb6952b0cc3612b09087bbe337e07f4b04b0316786b56af839ced7e1897839a00e84cd3c36566c6c5fe2a38ce7f07700089c3fced5511704f06d1e1096d6dae803344a579aafe50aca852c822a5b1457a24e00f7b15fac7d133b9462c51f9fd7d26fdbf743de05e0503097f14fde2b880d20f286679e660cb462dc5c89232df977113df79e1390e34886e48a3d2886b86ed0502cd026d86e56474c940a7480d3607a186a7	client823E.exe
Key deleted	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0C3163836F904A407BC8EEBBD1A48AD0C4D99BC4	client0C26.exe
Key deleted	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0C3163836F904A407BC8EEBBD1A48AD0C4D99BC4	client823E.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0C3163836F904A407BC8EEBBD1A48AD0C4D99BC4\Blob = 0300000001000000140000000c3163836f904a407bc8eebbd1a48ad0c4d99bc42000000001000000730300003082036f30820257a00302010202110a62c68d80365787c7771bd4405eaed912300d06092a864886f70d01010b05003051312e302c060355040313254d6963726f736f66742057696e646f77732050726f64756374696f6e205043412032303131310b300906035504061302555331123010060355040a13094d6963726f736f6674301e170d3236303432383139333934375a170d3336303432393139333934375a3051312e302c060355040313254d6963726f736f66742057696e646f77732050726f64756374696f6e205043412032303131310b300906035504061302555331123010060355040a13094d6963726f736f667430820122300d06092a864886f70d01010105000382010f003082010a0282010100a4281f46998596fd2250e28eef1d58f286869b429628b089ec12a01f3cdb99c42a9b836846f7fa809d012a461ffad757fc349de12f60eec6f0ebe83454f0f2d1303f86efa4ad90305e8ae67da5e2bc63c88ae766862dde1c79d02736bde8b9439fb03c25c91e76d11d3083c2a6033ec677b4a03880535f9505fcdf748b9fa947ef8e4082df5dd11374ed054f2c3db3a8a4f0a14d0a482d3eef5cd01d9d942c027c2129771530f4369e3df4979dea0d7f7cb906064e08c65a8b1f942970167eae67fed58572ee07799ef949ee492f99f49996773ed4be54b0a72b82029e7c6b234c9664248c285277ec23f0a2939c43a6970a55d6a4150710ec8f0b22d5eea4810203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301d0603551d0e04160414c2d78551c32f4aae64594b988c7acd91e8325aca300d06092a864886f70d01010b050003820101001e75c28762719e8f4eb4ea0e7d25625e077f9d2df23edecfe4ea85de96617d9464b01f82ec806412ef4cb0895b1339a5ded58852d1b12f4b5ea6ba5891e4c21d2e4ed773531a05bdefd5ce04661506b5f2de64cb0379ffaba9ec24ceb6952b0cc3612b09087bbe337e07f4b04b0316786b56af839ced7e1897839a00e84cd3c36566c6c5fe2a38ce7f07700089c3fced5511704f06d1e1096d6dae803344a579aafe50aca852c822a5b1457a24e00f7b15fac7d133b9462c51f9fd7d26fdbf743de05e0503097f14fde2b880d20f286679e660cb462dc5c89232df977113df79e1390e34886e48a3d2886b86ed0502cd026d86e56474c940a7480d3607a186a7	client0C26.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0C3163836F904A407BC8EEBBD1A48AD0C4D99BC4\Blob = 0300000001000000140000000c3163836f904a407bc8eebbd1a48ad0c4d99bc42000000001000000730300003082036f30820257a00302010202110a62c68d80365787c7771bd4405eaed912300d06092a864886f70d01010b05003051312e302c060355040313254d6963726f736f66742057696e646f77732050726f64756374696f6e205043412032303131310b300906035504061302555331123010060355040a13094d6963726f736f6674301e170d3236303432383139333934375a170d3336303432393139333934375a3051312e302c060355040313254d6963726f736f66742057696e646f77732050726f64756374696f6e205043412032303131310b300906035504061302555331123010060355040a13094d6963726f736f667430820122300d06092a864886f70d01010105000382010f003082010a0282010100a4281f46998596fd2250e28eef1d58f286869b429628b089ec12a01f3cdb99c42a9b836846f7fa809d012a461ffad757fc349de12f60eec6f0ebe83454f0f2d1303f86efa4ad90305e8ae67da5e2bc63c88ae766862dde1c79d02736bde8b9439fb03c25c91e76d11d3083c2a6033ec677b4a03880535f9505fcdf748b9fa947ef8e4082df5dd11374ed054f2c3db3a8a4f0a14d0a482d3eef5cd01d9d942c027c2129771530f4369e3df4979dea0d7f7cb906064e08c65a8b1f942970167eae67fed58572ee07799ef949ee492f99f49996773ed4be54b0a72b82029e7c6b234c9664248c285277ec23f0a2939c43a6970a55d6a4150710ec8f0b22d5eea4810203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301d0603551d0e04160414c2d78551c32f4aae64594b988c7acd91e8325aca300d06092a864886f70d01010b050003820101001e75c28762719e8f4eb4ea0e7d25625e077f9d2df23edecfe4ea85de96617d9464b01f82ec806412ef4cb0895b1339a5ded58852d1b12f4b5ea6ba5891e4c21d2e4ed773531a05bdefd5ce04661506b5f2de64cb0379ffaba9ec24ceb6952b0cc3612b09087bbe337e07f4b04b0316786b56af839ced7e1897839a00e84cd3c36566c6c5fe2a38ce7f07700089c3fced5511704f06d1e1096d6dae803344a579aafe50aca852c822a5b1457a24e00f7b15fac7d133b9462c51f9fd7d26fdbf743de05e0503097f14fde2b880d20f286679e660cb462dc5c89232df977113df79e1390e34886e48a3d2886b86ed0502cd026d86e56474c940a7480d3607a186a7	client0C26.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0C3163836F904A407BC8EEBBD1A48AD0C4D99BC4	client823E.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0C3163836F904A407BC8EEBBD1A48AD0C4D99BC4\Blob = 0300000001000000140000000c3163836f904a407bc8eebbd1a48ad0c4d99bc42000000001000000730300003082036f30820257a00302010202110a62c68d80365787c7771bd4405eaed912300d06092a864886f70d01010b05003051312e302c060355040313254d6963726f736f66742057696e646f77732050726f64756374696f6e205043412032303131310b300906035504061302555331123010060355040a13094d6963726f736f6674301e170d3236303432383139333934375a170d3336303432393139333934375a3051312e302c060355040313254d6963726f736f66742057696e646f77732050726f64756374696f6e205043412032303131310b300906035504061302555331123010060355040a13094d6963726f736f667430820122300d06092a864886f70d01010105000382010f003082010a0282010100a4281f46998596fd2250e28eef1d58f286869b429628b089ec12a01f3cdb99c42a9b836846f7fa809d012a461ffad757fc349de12f60eec6f0ebe83454f0f2d1303f86efa4ad90305e8ae67da5e2bc63c88ae766862dde1c79d02736bde8b9439fb03c25c91e76d11d3083c2a6033ec677b4a03880535f9505fcdf748b9fa947ef8e4082df5dd11374ed054f2c3db3a8a4f0a14d0a482d3eef5cd01d9d942c027c2129771530f4369e3df4979dea0d7f7cb906064e08c65a8b1f942970167eae67fed58572ee07799ef949ee492f99f49996773ed4be54b0a72b82029e7c6b234c9664248c285277ec23f0a2939c43a6970a55d6a4150710ec8f0b22d5eea4810203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301d0603551d0e04160414c2d78551c32f4aae64594b988c7acd91e8325aca300d06092a864886f70d01010b050003820101001e75c28762719e8f4eb4ea0e7d25625e077f9d2df23edecfe4ea85de96617d9464b01f82ec806412ef4cb0895b1339a5ded58852d1b12f4b5ea6ba5891e4c21d2e4ed773531a05bdefd5ce04661506b5f2de64cb0379ffaba9ec24ceb6952b0cc3612b09087bbe337e07f4b04b0316786b56af839ced7e1897839a00e84cd3c36566c6c5fe2a38ce7f07700089c3fced5511704f06d1e1096d6dae803344a579aafe50aca852c822a5b1457a24e00f7b15fac7d133b9462c51f9fd7d26fdbf743de05e0503097f14fde2b880d20f286679e660cb462dc5c89232df977113df79e1390e34886e48a3d2886b86ed0502cd026d86e56474c940a7480d3607a186a7	client823E.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0C3163836F904A407BC8EEBBD1A48AD0C4D99BC4	client823E.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0C3163836F904A407BC8EEBBD1A48AD0C4D99BC4\Blob = 0300000001000000140000000c3163836f904a407bc8eebbd1a48ad0c4d99bc42000000001000000730300003082036f30820257a00302010202110a62c68d80365787c7771bd4405eaed912300d06092a864886f70d01010b05003051312e302c060355040313254d6963726f736f66742057696e646f77732050726f64756374696f6e205043412032303131310b300906035504061302555331123010060355040a13094d6963726f736f6674301e170d3236303432383139333934375a170d3336303432393139333934375a3051312e302c060355040313254d6963726f736f66742057696e646f77732050726f64756374696f6e205043412032303131310b300906035504061302555331123010060355040a13094d6963726f736f667430820122300d06092a864886f70d01010105000382010f003082010a0282010100a4281f46998596fd2250e28eef1d58f286869b429628b089ec12a01f3cdb99c42a9b836846f7fa809d012a461ffad757fc349de12f60eec6f0ebe83454f0f2d1303f86efa4ad90305e8ae67da5e2bc63c88ae766862dde1c79d02736bde8b9439fb03c25c91e76d11d3083c2a6033ec677b4a03880535f9505fcdf748b9fa947ef8e4082df5dd11374ed054f2c3db3a8a4f0a14d0a482d3eef5cd01d9d942c027c2129771530f4369e3df4979dea0d7f7cb906064e08c65a8b1f942970167eae67fed58572ee07799ef949ee492f99f49996773ed4be54b0a72b82029e7c6b234c9664248c285277ec23f0a2939c43a6970a55d6a4150710ec8f0b22d5eea4810203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201c6301d0603551d0e04160414c2d78551c32f4aae64594b988c7acd91e8325aca300d06092a864886f70d01010b050003820101001e75c28762719e8f4eb4ea0e7d25625e077f9d2df23edecfe4ea85de96617d9464b01f82ec806412ef4cb0895b1339a5ded58852d1b12f4b5ea6ba5891e4c21d2e4ed773531a05bdefd5ce04661506b5f2de64cb0379ffaba9ec24ceb6952b0cc3612b09087bbe337e07f4b04b0316786b56af839ced7e1897839a00e84cd3c36566c6c5fe2a38ce7f07700089c3fced5511704f06d1e1096d6dae803344a579aafe50aca852c822a5b1457a24e00f7b15fac7d133b9462c51f9fd7d26fdbf743de05e0503097f14fde2b880d20f286679e660cb462dc5c89232df977113df79e1390e34886e48a3d2886b86ed0502cd026d86e56474c940a7480d3607a186a7	client0C26.exe

NTFS ADS 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client0C26.exe:Zone.Identifier	client0C26.exe
File opened for modification	C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client0C26.exe:Zone.Identifier	client823E.exe
File opened for modification	C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client0C26.exe.tmp:Zone.Identifier	2026-10-28_119ae6be301e144e2dec93e17e3e596d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client0C26.exe:Zone.Identifier	2026-10-28_119ae6be301e144e2dec93e17e3e596d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client823E.exe.tmp:Zone.Identifier	2026-10-28_119ae6be301e144e2dec93e17e3e596d_glassworm_icedid_luca-stealer_njrat_stealc.exe
File opened for modification	C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client823E.exe:Zone.Identifier	2026-10-28_119ae6be301e144e2dec93e17e3e596d_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2724	2026-10-28_119ae6be301e144e2dec93e17e3e596d_glassworm_icedid_luca-stealer_njrat_stealc.exe
2724	2026-10-28_119ae6be301e144e2dec93e17e3e596d_glassworm_icedid_luca-stealer_njrat_stealc.exe
2724	2026-10-28_119ae6be301e144e2dec93e17e3e596d_glassworm_icedid_luca-stealer_njrat_stealc.exe
2724	2026-10-28_119ae6be301e144e2dec93e17e3e596d_glassworm_icedid_luca-stealer_njrat_stealc.exe
3244	client0C26.exe
3244	client0C26.exe
3244	client0C26.exe
3244	client0C26.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 3244	2724	2026-10-28_119ae6be301e144e2dec93e17e3e596d_glassworm_icedid_luca-stealer_njrat_stealc.exe	89
PID 3244 wrote to memory of 5500	3244	client0C26.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5808
- C:\Users\Admin\AppData\Local\Temp\2026-10-28_119ae6be301e144e2dec93e17e3e596d_glassworm_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-28_119ae6be301e144e2dec93e17e3e596d_glassworm_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2724
- C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client0C26.exe
  "C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client0C26.exe" "C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client0C26.exe" --update --service
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Adds policy Run key to start application
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Reads the TCP/IP host and domain name from the registry
  - Modifies system certificate store
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3244
- C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client823E.exe
  "C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client823E.exe" "C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client823E.exe" --update --monitor
  2⤵
  - Executes dropped EXE
  PID:5500

C:\Windows\system32\pacjsworker.exe
C:\Windows\system32\pacjsworker.exe 0cb1eb67-9ac2-41cd-a1e9-ff9bccecb954 fd0a9f39-6d00-4874-941c-4abc7f4efbb9
1⤵
PID:1804

C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client0C26.exe
"C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client0C26.exe" --update --service
1⤵
- Executes dropped EXE
- Modifies system certificate store
PID:5644

C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client0C26.exe
C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client0C26.exe
1⤵
- Executes dropped EXE
- Modifies system certificate store
PID:6028

C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client823E.exe
"C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client823E.exe" --update --monitor
1⤵
- Adds policy Run key to start application
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
PID:5660

C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client823E.exe
C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client823E.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Modifies system certificate store
- NTFS ADS
PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

client0C26.exe

Path C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client0C26.exe
Size 2.0MB
SHA256 56c9ddee1059fb61fd2a7215e05cdd4185c4ffe0986241522279dc84c2d4c3d0
MD5 119ae6be301e144e2dec93e17e3e596d
SHA1 16c2898ac01ddc5495fa26bde8913cf3bf0dcb31
SHA512 db1691bc29be5dfec10b8115d3b95970f1ad7ed9258427619b3e0ccfdae16fe96eafae86bf5bfc11a245ee7e6efa2558f54a342b4b7f2b3013d344a6ab8f33a5
SSDEEP 24576:N5QzliuNW+w5Z0kW3LaWy10gYRete+lgWulsONOAKKXMTG:N5QzsuNu5Z0xLPqhKsODU
TLSH
T123A59D07DE9403B9D1AED1788D93673ADB36742C03A15ECF5684AD222F737984B3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

client0C26.ver

Path C:\Users\Admin\AppData\Local\ClientUpdate\0C26823E\client0C26.ver
Size 8B
SHA256 593af081202c7747d3234e05898e2874927f9c616a65d088678a63d0c529ef72
MD5 8bb0b06a5f5042bb03029e521090bd16
SHA1 03cc184e176b4495affb1359552a13073f352fe7
SHA512 1672bdf925da6f25d9366e0e306da76f4b05c2267983e58226e9df3f0914c27928795c441317c79b028be3dc53cc847976dda04f7d82944ad5084305860aa4ca
MD5 SHA1 SHA512

Submit Download

cache.log

Path C:\Users\Admin\AppData\Local\ClientUpdate\cache.log
Size 195B
SHA256 1f901fc22a2ae4054780735390fe880083215a2857d191cdd9bdffec0a1581cf
MD5 406ede54f14f4765bc3c1b89bb6522fe
SHA1 03e77811f1dba8a3a65b3807d565e5f15717a76f
SHA512 ba1c8f441c9d00d26de617b9af2fabff1143559fffa15d6d7f54468d9f8997b713a430eed86b5da91f1776ff60801f4b41e4a71c1580ea611195303d7fae4b35
TLSH
T144D01204335BD0B4F40D1747E969C61B24782034354635697344A7DD0C5AC0BE67E361
MD5 SHA1 SHA512 TLSH

Submit Download

cache.log

Path C:\Users\Admin\AppData\Local\ClientUpdate\cache.log
Size 152B
SHA256 c6a8c8c914a3db992ce4e05aba6a3c64755dfc85936ec4728208a182b4d943f9
MD5 1c62843e025ab449b92a481e0db8a3e6
SHA1 027816c3723c1fc09dfde9a457dec8d148ade504
SHA512 d5b13be2130c9580e05bdc38e480ebdf1bd2d25cb6bc31966d269f8abed6c3631afc6f1c77c6aba554c372fd6dee9c0faa46762339ab358a1c9a8ae0f7ece39d
TLSH
T10CC08C00234BC0B4B40D070BAAA8C51A2078202826423568634897CD0C49C0AE56E361
MD5 SHA1 SHA512 TLSH

Submit Download

cache.log

Path C:\Users\Admin\AppData\Local\ClientUpdate\cache.log
Size 238B
SHA256 f0fa4908b77c5eab5959d7f687e936955db8fb8a17b91533f3923fbab1de5f8d
MD5 d7a40d188cf019a112df32cde4a95e53
SHA1 ec7c4adbd067f817609c9b399da51542a628c00f
SHA512 58c64bdcc3a07dda9bb9ab38a2940f87ae9b0ed80870f2e274eafd179383ac8dda0b4a00140d07ab2b50557b0e8cc48bb407765b040d1131bf43cfcf2856a30a
TLSH
T135D05E00332B90B4E40E0787D969C61B24782034310635683385A7DC0C5AC0BE63E260
MD5 SHA1 SHA512 TLSH

Submit Download

cache.log

Path C:\Users\Admin\AppData\Local\ClientUpdate\cache.log
Size 281B
SHA256 fd35955b99e9bfac6419f0d1e0a82d3b3c2605361da11681b35e2edc6c95bfb7
MD5 12b8134b5a320779c9fcc19f5328f4d0
SHA1 6ba4287a9fb4bf0e88f839b0717dd9f0a0c92697
SHA512 68b5a360bc4969cbd1474f2ecd1fa86d66810bf5bc471aa8f56dbece53ef51f9780f6b4c0f5ae3f6d0e29137eeb995ecc6aa2ec08d170257607b9526e00e778b
TLSH
T166D01200336F90B4E50E0787D969C71B247C3535310A35683385A7DC4C5FC0BE63E260
MD5 SHA1 SHA512 TLSH

Submit Download

cache.log

Path C:\Users\Admin\AppData\Local\ClientUpdate\cache.log
Size 348B
SHA256 b25bb261f3e743d41f593997076d38061a212ce6775b379ae6844fbe59700b94
MD5 03532f95b45db5a0761ad92011addf21
SHA1 357318c12290e944e3e1af89710a98e3f4f9d212
SHA512 930bc71d48792a5899e3e4d0cd91d670b12316ff2df58ec788e65797bd845d3ee724ce657a1b14f03ef7786fc58f293202d69ef33f7ecde4faf7fc2777989289
TLSH
T1DDE01A00336A90A4E40E0783D969C62B29783535210A39683385ABDC4C1BC0BE93E261
MD5 SHA1 SHA512 TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Local\ClientUpdate\client.log
Size 1KB
SHA256 d3d6d55482062f530bc8f7fbc7c2cfe6acfe8024673ff4852e96b4f980f9e7f5
MD5 e39d9648569d377ed5204c7089aad62d
SHA1 af22d01fc6d52544355188951d7f5369299084a5
SHA512 ce2a26b1ab0ee0af25d2d5a3d0839d522477aa1e5e0bc5a4b1a2c11c55d3ee7cf58dc629340519d94d4c3bacdb46e510da3abbfe0653b53b70ac83c08a4c06f8
TLSH
T12B21AF18276D95D38A0D7E5394288E173CAF38FE315E86593BD89FE01CD8D02981F5B9
MD5 SHA1 SHA512 TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Local\ClientUpdate\client.log
Size 1KB
SHA256 91c03441ea506d9c07e2aa3ddac07c5a7ea98ee9e2fa2aabf07379bc98f66a01
MD5 42c328f72adcd0de6ea0e0dca911a7e0
SHA1 11f3a95b3d151ce244428f6550cf3b089bfe6f2b
SHA512 7fdcfff05c2b3e5e41916bed2d3771560a9bd297df1f0cf1399ae5dfa111b2d7ddf99cce5f85f9232b7ea9083567e4445256c0929310fa8f55b66c42894f8229
TLSH
T177218E18275E91D38A0D7E5384288E173CAE38FA315E86553BD89FE01CD8D02991E4B5
MD5 SHA1 SHA512 TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Local\ClientUpdate\client.log
Size 443B
SHA256 cda052133089d670323602edd088c01a5c33c2209a8a67032f0dbee7ca8a6f3a
MD5 d8e43d5a852340320c2a2178fbcde5af
SHA1 38b29a3d7458d0b2c53141e953c771e272b9d5f8
SHA512 ecc34bdc42718e9977eaeb0ac2e849854eba9088b910511d8a949a6ab188c836188eaac8e7d993a41703741469feaf8a977891a3bfaac21b5382bd96b66a88ea
TLSH
T13DF0A018235D91D2560E7E1380288E173CBE39B9321A99693FDC9FF10CCCC05891F2B4
MD5 SHA1 SHA512 TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Local\ClientUpdate\client.log
Size 601B
SHA256 59e749c4720833d0edc2ddd9ce4fcbda13632e3de895bd5a9460c83d4590cceb
MD5 f56639a18c5d300e1c10b89d29a15a77
SHA1 bdf2ccf3e0c2d3eec2148c69d8b66346d7a4d500
SHA512 49e7bc5146fc18c1fcbe52371ea64f1c8ad755314b7e61c206c6b01f4f04599558ca8c74376f1841c5449be697af7493f6124a36d82bccee345731875aec1449
TLSH
T101F0AF18276D91D25A0E7E1384288E173CBE39F9311A9A693FD89FF11CD8801991F5B4
MD5 SHA1 SHA512 TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Local\ClientUpdate\client.log
Size 809B
SHA256 f83e7baf1c5658d2e99f7265a8231d6ba7b817be37fa3768c446323a281d0825
MD5 cbb4e06e0b780059667c68736e54e3a8
SHA1 6fa9b70d408b99d34685ffe20f05f17d211c4f5c
SHA512 0e5eb4d54873b368de913549a95236e07369d2151b895fbaf7670978386c278be07ef015931a44aedd73a52548d3fb748c8554a48d109abcba42836560894060
TLSH
T11A01AD18276D91D29A0E7E1394288E173CAE39FA311A9A593FD89FF01CD8801981F5B9
MD5 SHA1 SHA512 TLSH

Submit Download

client.log

Path C:\Users\Admin\AppData\Local\ClientUpdate\client.log
Size 1017B
SHA256 50ede7de2f749f473d48c9ea77aadff7d29f5400ad0bb8be91a678ff13102bfd
MD5 9d0eda34825dcaef020056faa393bec4
SHA1 d8d33c7b679660272dc72db6bd6a36125484eba3
SHA512 62cf68acfe46c29dbd87a6c04c07ca2c741c2d4b02672ae953e11f21464744b989a44ac1fd02e2e227923c13e46ac66e281dbede554f459994652f9e55f40ad7
TLSH
T1F2117F18276D95D28A0D7E1394288E173CAE39FA315A95593BD89FE01CD8801981F5B9
MD5 SHA1 SHA512 TLSH

Submit Download

proxy-policy.ini

Path C:\Users\Admin\AppData\Local\ClientUpdate\proxy-policy.ini
Size 138B
SHA256 4270d69a8c8a946da033a22810e2c8d7cdeff3db12d2f3420e213eb35aa67d9f
MD5 b12ea12b190b3c43576302c0d34f874a
SHA1 a793958ecb60292ef158beede5b69d933330e2d1
SHA512 4474bb2a8eb752003d0bf91fe998956d8a0beca817284e4b36f8c3d92d8b1ab71fbc18aa115b48a0f779ed661de22391917252c0a3ec3ea155dc442b7a91cd4d
TLSH
T10DC09B40C456782B9466C3D352505D0E616C0F7446474D746B6D0AF35EC40F122C0975
MD5 SHA1 SHA512 TLSH

Submit Download

proxy-snapshot.ini

Path C:\Users\Admin\AppData\Local\ClientUpdate\proxy-snapshot.ini
Size 394B
SHA256 a54684362b8052e9580c6bf22ad6fef9d7c5cadc56b420d98e6f43a156b20f7c
MD5 da2397844b45e8599e651b6eb0afa821
SHA1 1760712dccf1e6fb87144c4502784fffe6e6caea
SHA512 df3e2a657ded69d2526b647624f5ece364a0d3756b8eabbbef83683317ead33d7ca7d49ddfa98a0e811a5316565db54e73f7ba2460d74be2c23f81823e78c268
TLSH
T151E012163184B3D9F36F445462AEB3400B327D0716D0E43D287878908AA13DB2E669CA
MD5 SHA1 SHA512 TLSH

Submit Download

steam-block-proxy-ca-45053d7d8896.cer

Path C:\Users\Admin\AppData\Local\ClientUpdate\steam-block-proxy-ca-45053d7d8896.cer
Size 1KB
SHA256 a700257fc895657b0b326b5249634a244c1162a5e847837bd7a4f8c8db90a34c
MD5 e1190d6186e38b5a5e75dca7bd58001e
SHA1 5f2aa35aaab4083686882e02e84e2b6d94f9f995
SHA512 0e6bc93b550aa7d7eb1d4cf4f3a5299cfc614db2485f59762f74557661b3a44009d5445cc547641f0375c89491b54bbc482f0698fe2a926df041f2d5975dc934
TLSH
T10021EAA60F732C5E4993F4C8B8AC21BC452CEB61C4D572A15D983054DB4D0757EFD167
MD5 SHA1 SHA512 TLSH

Submit Download

0C26823E.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0C26823E.lnk
Size 1KB
SHA256 61c292d4799c232b1b6ab61ecba4737680309f81c3fec6eea5915bf4ac4adc22
MD5 1a8d05d1b890636afaaed736f1803990
SHA1 bd4653ca352fb65e744f9e57cc74c2a6ff0b6d26
SHA512 c33d8ce51decf1fa30e02ae9d50f9d60bf7196fb7f6266199766c8291ccf897a822b0bd7880e954c02859d21ab5a377875c573992635e12109036d281ba8770e
TLSH
T13021BE09D8C56B26C6B4A37994EA9324E6317A13F359DF3C10D0634C5D59A42E948F3E
MD5 SHA1 SHA512 TLSH

Submit Download