Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 23:26

General

  • Target
    2026-06-02_d7caa8ce30287e84cb8e1d58566a2c49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 69.4MB
  • Sample260602-3ex65aez2x
  • SHA256 0aea461eeecdd554013acb2cd4b05e0a73545260f2c9acbab80f8a5c23e0e775
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Loads dropped DLL 47 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_d7caa8ce30287e84cb8e1d58566a2c49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_d7caa8ce30287e84cb8e1d58566a2c49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5000
    • C:\Users\Admin\AppData\Local\Temp\2026-06-02_d7caa8ce30287e84cb8e1d58566a2c49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-06-02_d7caa8ce30287e84cb8e1d58566a2c49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4948
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:4336

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
          • Size 211KB
          • SHA256 89b688b3848e196de02a444c72cfc25bb3efebaba84a28469ac1e7f5738e0564
          • MD5 SHA1 SHA512 SSDEEP TLSH

          VCRUNTIME140.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\VCRUNTIME140.dll
          • Size 116KB
          • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _bz2.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\_bz2.pyd
          • Size 82KB
          • SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _ctypes.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\_ctypes.pyd
          • Size 121KB
          • SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _lzma.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\_lzma.pyd
          • Size 155KB
          • SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-console-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-console-l1-1-0.dll
          • Size 12KB
          • SHA256 258ac28b71532d6f9419edce72961e2b9644b0f92de5ce002801cc9c3caf442e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-datetime-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-datetime-l1-1-0.dll
          • Size 11KB
          • SHA256 ed94f413f576835acf4dade22ead7e764dd2f0242581090e3a2424452b49b9fe
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-debug-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-debug-l1-1-0.dll
          • Size 11KB
          • SHA256 143c8bcc6ab0d6afa1dc03996b5256a6bccb3442dc4ff3182404fde8172de4b6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-errorhandling-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-errorhandling-l1-1-0.dll
          • Size 11KB
          • SHA256 3c186afd5cf0e4314d0e15bd55832e976368d162331d5cb065fe890b88c9cfbd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-file-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-file-l1-1-0.dll
          • Size 15KB
          • SHA256 17ad72adbef247080dd456bb54f11bc782801381fc2aa2abe005cca9db6254c0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-file-l1-2-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-file-l1-2-0.dll
          • Size 11KB
          • SHA256 1fa836b3704b29e7ad1ea1b0b457f62aae4435c6a1d745707631552a2f83d5f6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-file-l2-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-file-l2-1-0.dll
          • Size 11KB
          • SHA256 56bc7d3dd48d9cb209195f71be67d0a90ca929a8d4e6ae5a481f3ab0345da294
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-handle-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-handle-l1-1-0.dll
          • Size 11KB
          • SHA256 2b52bf5a8c0bc2e93cebcce597c6693a118667e9f16836e65d8b166d33d33f49
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-heap-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-heap-l1-1-0.dll
          • Size 11KB
          • SHA256 c8adf90a32936eaf678ed9a091d422e091e6b80d0431ec120e60febe1f617ac3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-interlocked-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-interlocked-l1-1-0.dll
          • Size 11KB
          • SHA256 52df3c5ded71786cf0f4f7545d59f5e6e168e6a499862c59b5985f6071f201ab
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-libraryloader-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-libraryloader-l1-1-0.dll
          • Size 12KB
          • SHA256 52a11ca57d562ee1cfbb7d6c26253cbd67a39b55bf1a56cd0f9332136986e8cc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-localization-l1-2-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-localization-l1-2-0.dll
          • Size 14KB
          • SHA256 a36792281c0aaab929635bb1f40ee3627225e7e35e6a199c188f3f782c7e6c27
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-memory-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-memory-l1-1-0.dll
          • Size 11KB
          • SHA256 bbf2556eff6f0bc6a11d73821aca2c14d5c8235143ceeb16b55b47eee453f179
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-namedpipe-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-namedpipe-l1-1-0.dll
          • Size 11KB
          • SHA256 b39d21f236d903c34770d50da02c14e8d226e695138f3f6ace4eae11b6d6796d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-processenvironment-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-processenvironment-l1-1-0.dll
          • Size 12KB
          • SHA256 3fa37c4d72451e968217c20ec64a01f5d4f1a5af7b44a107607cad3d3618aee1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-processthreads-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-processthreads-l1-1-0.dll
          • Size 13KB
          • SHA256 31fd144dc063f7fac651147f0c3826fb0b33ca8028bd4f70a78d63cfb53d81a8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-processthreads-l1-1-1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-processthreads-l1-1-1.dll
          • Size 12KB
          • SHA256 f8b7122ca5e1d473818940fea4d1155af429463038ba61953908fbbbb7a8d613
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-profile-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-profile-l1-1-0.dll
          • Size 10KB
          • SHA256 8b36bce1b7a881f85529eae56e5b75e32763eb14b6683f2203a957ec31336ce1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-rtlsupport-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-rtlsupport-l1-1-0.dll
          • Size 11KB
          • SHA256 5208000a52363b1de665d5d46cd6f4da45f0c19c74876918e165e23efed26e92
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-string-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-string-l1-1-0.dll
          • Size 11KB
          • SHA256 6bf3e8a6cdb3ccaa52f05fa336bbe80e70351a3eb0c8a98ef599b596d11aaee5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-synch-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-synch-l1-1-0.dll
          • Size 13KB
          • SHA256 b48b10bfeda8c32e538b03a9db05864866f8a44d04824f63032f2dc33e39fa1b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-synch-l1-2-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-synch-l1-2-0.dll
          • Size 11KB
          • SHA256 d3e6256c2dd7150cff8ffca9c9cc6ef477c1da72c0d32972d1022381927b8295
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-sysinfo-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-sysinfo-l1-1-0.dll
          • Size 12KB
          • SHA256 85b8a6d64a66556f4501aaf120d699dba661841027d27becc6d7240dafb14138
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-timezone-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-timezone-l1-1-0.dll
          • Size 11KB
          • SHA256 9c8461929b61e0fd269ce735d699e7e3b6c0159d3e2659f60d681290abf9eac5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-util-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-core-util-l1-1-0.dll
          • Size 11KB
          • SHA256 76748b18c61fac93fe1c0587711e3ec0b306b2c92198f0b8b4f6bad8c6d9ba8f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-conio-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-crt-conio-l1-1-0.dll
          • Size 12KB
          • SHA256 25bbdabc7b8d8edf5cd05b5591edca13236724cad1011393e010df3c58fd6f7e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-convert-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-crt-convert-l1-1-0.dll
          • Size 15KB
          • SHA256 fe368e5edf476436afea571faacf80d5d12a4b064d5736ee482b972eee82a64c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-environment-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-crt-environment-l1-1-0.dll
          • Size 11KB
          • SHA256 29656b4f4f985952c5edee8e66ad7901e47c3c5619965dddc9939c5ce5ab7d58
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-filesystem-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-crt-filesystem-l1-1-0.dll
          • Size 13KB
          • SHA256 6e65f088e4ecb0cf8306766c59190ce3efbc8a190fcbb53572cc61e35d2787f1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-heap-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-crt-heap-l1-1-0.dll
          • Size 12KB
          • SHA256 1bc96d86e373fcb77e3d2e48440f0eafb7e42a88a5a82e0ace01967acf236d3b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-locale-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-crt-locale-l1-1-0.dll
          • Size 11KB
          • SHA256 69e5f222dc622555c88e3bc4cfef42f64237728bd02d00c9281203e512ca77b2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-math-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-crt-math-l1-1-0.dll
          • Size 20KB
          • SHA256 e4244f90307ab003cb5cc9bcd729ef897abcf26785df9277cbe389e328e0fe0b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-private-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-crt-private-l1-1-0.dll
          • Size 63KB
          • SHA256 fc0893026981e1a4a62f203fea4edad61ba8b385122cb68aa4d2376f9082345a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-process-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-crt-process-l1-1-0.dll
          • Size 12KB
          • SHA256 0dbe94bdfb49ba93ccd7db40323b824b4f1941cd340916d73ba2241a7d34fc1e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-runtime-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-crt-runtime-l1-1-0.dll
          • Size 15KB
          • SHA256 48655a29504bcdb1a7f5c2b316f9cd71ab35ca521d2659df105f49c40b0f92f0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-stdio-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-crt-stdio-l1-1-0.dll
          • Size 17KB
          • SHA256 550ea9556ba9197b25b7eb9d12ca9dd9ad0e820e4dba91f94dd54b57a2e6934f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-string-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-crt-string-l1-1-0.dll
          • Size 18KB
          • SHA256 341f489491f992bece2879fea3b660ff2dcd04a59bdb5f3998d58e5ac8ce3341
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-time-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-crt-time-l1-1-0.dll
          • Size 14KB
          • SHA256 2b7fed76ba52606e442d5069f42077f0cf304e49326dddcf3695a06530c4b5c1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-utility-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\api-ms-win-crt-utility-l1-1-0.dll
          • Size 11KB
          • SHA256 47aa51ad00153edd4f3dd42bf89da2325f9e0106e9772396c066666182b22d07
          • MD5 SHA1 SHA512 SSDEEP TLSH

          base_library.zip

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\base_library.zip
          • Size 1.4MB
          • SHA256 f1279898f6233cfec55965282f37500770cfc775b6c7f829256f65802118d9d6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libcrypto-3.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\libcrypto-3.dll
          • Size 5.0MB
          • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libffi-8.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libssl-3.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\libssl-3.dll
          • Size 768KB
          • SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pyexpat.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\pyexpat.pyd
          • Size 194KB
          • SHA256 c7c7564f7f874fb660a46384980a2cf28bc3e245ca83628a197ccf861eab5560
          • MD5 SHA1 SHA512 SSDEEP TLSH

          python3.DLL

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\python3.DLL
          • Size 65KB
          • SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          python311.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\python311.dll
          • Size 5.5MB
          • SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
          • MD5 SHA1 SHA512 SSDEEP TLSH

          select.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\select.pyd
          • Size 29KB
          • SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tcl86t.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\tcl86t.dll
          • Size 1.8MB
          • SHA256 4e699ff2d6d147d0586c8c77be5a18f20ca0758f432d7b0f489223f2fa4dd221
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tk86t.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\tk86t.dll
          • Size 1.5MB
          • SHA256 b6af038120f2b8644c7ce1e11917f410009848287622135d7e386f90d28a831c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ucrtbase.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI50002\ucrtbase.dll
          • Size 1011KB
          • SHA256 d67926328a72816d2944d7c88df6ff4bfccd41a9ce39af0309a0639829d0e7fb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          memory/4948-1138-0x000002374E340000-0x000002374F6C1000-memory.dmp