a79347143c477ea7638190310986f60daa0e5b9435e3f8cc5a498bee6a66768a

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/11/2026, 12:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-11_523f69edd5662fc39740756b3a10bda9_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Size 9.5MB
Sample261113-pj8a1aae37
SHA256 a79347143c477ea7638190310986f60daa0e5b9435e3f8cc5a498bee6a66768a
MD5 523f69edd5662fc39740756b3a10bda9
SHA1 184d46b3e183e3d2ac0bc6dcf7f70492a6cf94e2
SHA512 5d440a4e570323da591c8be05775952483c136c64b869c93dfb392b696c6ffd3d794428d0af23799adf1c0d6e09035acc5e584ba9f2593f8f964506f034f2cb1
SSDEEP 196608:uFZ1RkczVv077HWJcHCMwXjo0Nw9y34nOZA:cLVv077HWJcHCMwXjo0C9yRS
TLSH
T126A68D15E33800E8D4ABC6B8C7465157D771B44A13B0ABDF0A90AEA52F27AE51F7F702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2026-11-11_523f69edd5662fc39740756b3a10bda9_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	2026-11-11_523f69edd5662fc39740756b3a10bda9_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-11-11_523f69edd5662fc39740756b3a10bda9_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-11-11_523f69edd5662fc39740756b3a10bda9_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4596	2026-11-11_523f69edd5662fc39740756b3a10bda9_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
4596	2026-11-11_523f69edd5662fc39740756b3a10bda9_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-11_523f69edd5662fc39740756b3a10bda9_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-11_523f69edd5662fc39740756b3a10bda9_blankgrabber_coinminer_glassworm_icedid_ngrbot_njrat_stealc.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads