Overview

overview

9

Static

static

3

2026-05-25...at.exe

windows10-2004-x64

9

2026-05-25...at.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/05/2026, 00:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-25_54977b4cef8131246d293a936ae37cbb_blankgrabber_icedid_luca-stealer_njrat.exe
  • Size 15.1MB
  • Sample260525-av97eahy6m
  • SHA256 2b4e9fdc90f0d410a5798f2ae0a95a8ddf276d11d818cc038813eb5e7c0274eb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasionexecutionspywarestealer

Malware Config

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-25_54977b4cef8131246d293a936ae37cbb_blankgrabber_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-25_54977b4cef8131246d293a936ae37cbb_blankgrabber_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4868
    • C:\Users\Admin\AppData\Local\Temp\2026-05-25_54977b4cef8131246d293a936ae37cbb_blankgrabber_icedid_luca-stealer_njrat.exe
      C:\Users\Admin\AppData\Local\Temp\2026-05-25_54977b4cef8131246d293a936ae37cbb_blankgrabber_icedid_luca-stealer_njrat.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3776
      • C:\Users\Admin\AppData\Local\Temp\2026-05-25_54977b4cef8131246d293a936ae37cbb_blankgrabber_icedid_luca-stealer_njrat.exe
        C:\Users\Admin\AppData\Local\Temp\2026-05-25_54977b4cef8131246d293a936ae37cbb_blankgrabber_icedid_luca-stealer_njrat.exe -m pip install pycryptodome requests psutil --quiet
        3⤵
        • Loads dropped DLL
        PID:4148
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        3⤵
        • Loads dropped DLL
        PID:208
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        3⤵
        • Loads dropped DLL
        PID:3136
      • C:\Users\Admin\AppData\Local\Temp\2026-05-25_54977b4cef8131246d293a936ae37cbb_blankgrabber_icedid_luca-stealer_njrat.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-05-25_54977b4cef8131246d293a936ae37cbb_blankgrabber_icedid_luca-stealer_njrat.exe" "--multiprocessing-fork" "parent_pid=3776" "pipe_handle=816"
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5116
        • C:\Users\Admin\AppData\Local\Temp\2026-05-25_54977b4cef8131246d293a936ae37cbb_blankgrabber_icedid_luca-stealer_njrat.exe
          C:\Users\Admin\AppData\Local\Temp\2026-05-25_54977b4cef8131246d293a936ae37cbb_blankgrabber_icedid_luca-stealer_njrat.exe -m pip install pycryptodome requests psutil --quiet
          4⤵
            PID:2920
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /F /IM Telegram.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2072
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\tmp5v8vvz26.ps1
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2056
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
        PID:1540
      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
        1⤵
          PID:1900

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              __PSScriptPolicyTest_0th1y3fn.4gc.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0th1y3fn.4gc.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              81d243bd2c585b0f4821__mypyc.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\81d243bd2c585b0f4821__mypyc.pyd
              • Size 213KB
              • SHA256 ba7fc544994f126cb7485ce52d265d2f32e93c4f1ea1fcd6fcdee3918f271979
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _raw_aes.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\Crypto\Cipher\_raw_aes.pyd
              • Size 34KB
              • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _raw_aesni.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\Crypto\Cipher\_raw_aesni.pyd
              • Size 15KB
              • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _cpuid_c.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\Crypto\Util\_cpuid_c.pyd
              • Size 10KB
              • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCRUNTIME140.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\VCRUNTIME140.dll
              • Size 117KB
              • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _bz2.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\_bz2.pyd
              • Size 84KB
              • SHA256 1bf985b54f529a3cbb3e52532791cc4d4c64009142d37b54eb3521adec203d5c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _cffi_backend.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\_cffi_backend.pyd
              • Size 176KB
              • SHA256 d5b09da2e726b4e90cf0edad5d2a0ec52f369dfd060e14d3807a32b2205031fa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ctypes.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\_ctypes.pyd
              • Size 131KB
              • SHA256 96b07339d52c74f2a1dd043df5eb931e4072eed90a3a8715ffec751d818e4117
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _hashlib.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\_hashlib.pyd
              • Size 67KB
              • SHA256 50f3ce7a2281fd32f378f3ba5067bdd13e18ee95877db5199c6a0babdc9c516a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _lzma.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\_lzma.pyd
              • Size 155KB
              • SHA256 51815b6474d4216c6a2aeaffdae5d2ff4acb7a0236254f2cfe43247022f3d781
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _queue.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\_queue.pyd
              • Size 34KB
              • SHA256 b5b5368026c33ade7651fb4cf4c6c1ca7eecc9c8cdad0af007da8a3ac0e067f7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _socket.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\_socket.pyd
              • Size 84KB
              • SHA256 8676f3cebd9d01c7ad51a29b3f7ff429c0a8f6bc564cab21eb6cdaa2e26fd259
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _sqlite3.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\_sqlite3.pyd
              • Size 127KB
              • SHA256 bb80e54f2de8aa3cddc00a2a2f893c432d45ecd64a5c55758a4eb6d2e3007127
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ssl.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\_ssl.pyd
              • Size 177KB
              • SHA256 b8118580b461801df12ec12d3d666aa0ebc2b3750bcf92b90b92789b152bf856
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _uuid.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\_uuid.pyd
              • Size 27KB
              • SHA256 0116497261edadfe42ba7daf367c8a9ea27a1db210c8384943c890f532e3ce72
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _wmi.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\_wmi.pyd
              • Size 38KB
              • SHA256 9a7255064ea143895b28efea6d78e9e518bac290900aec52a6a0435c36a172fb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cacert.pem
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\certifi\cacert.pem
              • Size 230KB
              • SHA256 7cef540c6af3bf0a3c7d0070bd3fd7aae34f8aa805b408d1c27a01c8aeb305df
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cd.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\charset_normalizer\cd.pyd
              • Size 10KB
              • SHA256 2e9f5049b3c5db7ab78c6abb94dfbbfe035ebab8f40594320f8c92221f486f24
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _rust.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\cryptography\hazmat\bindings\_rust.pyd
              • Size 9.4MB
              • SHA256 051e355666d8d242827c7969b70f6da6b7f27aa23fcd5c36fcb0c81bc25a6856
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libcrypto-3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\libcrypto-3.dll
              • Size 5.0MB
              • SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libffi-8.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\libffi-8.dll
              • Size 38KB
              • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libssl-3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\libssl-3.dll
              • Size 776KB
              • SHA256 cf1a5fdcefa3daf69041f31f98ece1d7911ca4fcb8e9f1043b4d0f459ae4c936
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              output.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\output.dll
              • Size 27.4MB
              • SHA256 338f1586daac2ba519541926c3d9dad51bb2d0e2d40926f56196e1e7e91cad01
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _psutil_windows.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\psutil\_psutil_windows.pyd
              • Size 69KB
              • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              python3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\python3.dll
              • Size 70KB
              • SHA256 cbc4876275178244905ee45a9ee6ec9fa4bfb9aad6209a03b756d38a186f80d1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              python313.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\python313.dll
              • Size 5.8MB
              • SHA256 6964e590037c41d631fd1215f05af154f7fa68105993c6f573a20689b473f1ac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              select.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\select.pyd
              • Size 32KB
              • SHA256 ddf1221851814943a82ed8a986d228463404da2ada969661bdd69223f14fc050
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              sqlite3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\sqlite3.dll
              • Size 1.5MB
              • SHA256 5932500d09fbd72559173b5abb7f5174d400f968f08680a1090e75b75bb03bc9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              unicodedata.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\unicodedata.pyd
              • Size 695KB
              • SHA256 b965a80346ee95dbec0b147faab329f3276ba24fceb8df5df171367649f116f3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcruntime140_1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_4868_347293_UCV7qHww1ic\vcruntime140_1.dll
              • Size 48KB
              • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/2056-161-0x00000272FEFF0000-0x00000272FF012000-memory.dmp
              Download

              memory/2056-164-0x00000272FEFD0000-0x00000272FEFDA000-memory.dmp
              Download

              memory/2056-165-0x00000272FFE90000-0x00000272FFEB6000-memory.dmp
              Download

              memory/2056-166-0x00000272FEFE0000-0x00000272FEFE8000-memory.dmp
              Download

              memory/2056-169-0x00000272FF390000-0x00000272FFE51000-memory.dmp
              Download