Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
05/05/2026, 04:05
General
- Target 2026-05-05_82625d8efe32c9569f86c1902f4e8561_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 6.7MB
- Sample260505-enzvbaf18x
- SHA256 c75a0f7f2e8f7bb7918817973ec2167a5e6663fe72581ea85fab18f33ea0fab9
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
- UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-05_82625d8efe32c9569f86c1902f4e8561_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_82625d8efe32c9569f86c1902f4e8561_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-05-05_82625d8efe32c9569f86c1902f4e8561_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_82625d8efe32c9569f86c1902f4e8561_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libssl-3.dll
python314.dll
select.pyd
unicodedata.pyd
memory/5080-34-0x00007FFFD0F20000-0x00007FFFD0F4C000-memory.dmp
memory/5080-54-0x00007FFFBCBC0000-0x00007FFFBD2C6000-memory.dmp
memory/5080-18-0x00007FFFBCBC0000-0x00007FFFBD2C6000-memory.dmp
memory/5080-36-0x00007FFFCC2F0000-0x00007FFFCC370000-memory.dmp
memory/5080-37-0x00007FFFBCBC0000-0x00007FFFBD2C6000-memory.dmp
memory/5080-39-0x00007FFFBCBC0000-0x00007FFFBD2C6000-memory.dmp
memory/5080-84-0x00007FFFBCBC0000-0x00007FFFBD2C6000-memory.dmp
memory/5080-44-0x00007FFFBCBC0000-0x00007FFFBD2C6000-memory.dmp
memory/5080-49-0x00007FFFBCBC0000-0x00007FFFBD2C6000-memory.dmp
memory/5080-32-0x00007FFFD1FB0000-0x00007FFFD1FCA000-memory.dmp
memory/5080-59-0x00007FFFBCBC0000-0x00007FFFBD2C6000-memory.dmp
memory/5080-64-0x00007FFFBCBC0000-0x00007FFFBD2C6000-memory.dmp
memory/5080-69-0x00007FFFBCBC0000-0x00007FFFBD2C6000-memory.dmp
memory/5080-81-0x00007FFFD0F20000-0x00007FFFD0F4C000-memory.dmp
memory/5080-80-0x00007FFFD1FB0000-0x00007FFFD1FCA000-memory.dmp
memory/5080-85-0x00007FFFCC2F0000-0x00007FFFCC370000-memory.dmp
memory/5080-83-0x000001D4D3660000-0x000001D4D39D8000-memory.dmp
memory/6136-38-0x0000024134FE0000-0x0000024135358000-memory.dmp
memory/6136-86-0x0000024134FE0000-0x0000024135358000-memory.dmp