Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    06/06/2026, 05:39

General

  • Target
    2026-06-06_b8521a3e33c199ab1b4bf802c69a32ad_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 13.4MB
  • Sample260606-gcfcmsbv2r
  • SHA256 d171bb9c5cf0068056ca6717dcf2a9f0d8ce36873783c78f911f154f4452f056
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 41 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 47 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-06_b8521a3e33c199ab1b4bf802c69a32ad_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-06_b8521a3e33c199ab1b4bf802c69a32ad_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5020
    • C:\Users\Admin\AppData\Local\Temp\2026-06-06_b8521a3e33c199ab1b4bf802c69a32ad_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-06-06_b8521a3e33c199ab1b4bf802c69a32ad_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:724
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-06-06_b8521a3e33c199ab1b4bf802c69a32ad_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-06-06_b8521a3e33c199ab1b4bf802c69a32ad_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4808
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-06-06_b8521a3e33c199ab1b4bf802c69a32ad_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-06-06_b8521a3e33c199ab1b4bf802c69a32ad_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4672

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _asyncio.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\_asyncio.pyd
        • Size 69KB
        • SHA256 f8305023f6ad81ddc7124b311e500a58914b05a9b072bf9a6d079ea0f6257793
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _bz2.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\_bz2.pyd
        • Size 82KB
        • SHA256 bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _cffi_backend.cp312-win_amd64.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\_cffi_backend.cp312-win_amd64.pyd
        • Size 175KB
        • SHA256 86f136553ba301c70e7bada8416b77eb4a07f76ccb02f7d73c2999a38fa5fa5b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _ctypes.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\_ctypes.pyd
        • Size 122KB
        • SHA256 543ce9d6dc3693362271a2c6e7d7fc07ad75327e0b0322301dd29886467b0b0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _decimal.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\_decimal.pyd
        • Size 247KB
        • SHA256 d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _lzma.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\_lzma.pyd
        • Size 155KB
        • SHA256 22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-console-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-console-l1-1-0.dll
        • Size 13KB
        • SHA256 713684cf520c75ceeccfad3830cfda180e1f4554afd63342df8ef7a362be6a1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-datetime-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-datetime-l1-1-0.dll
        • Size 13KB
        • SHA256 7e259ceeabde9a18ef7670df9f85b380aa3d9df6934827555583568c248ec07f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-debug-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-debug-l1-1-0.dll
        • Size 13KB
        • SHA256 59a7a706c4de0c763755e12b467c66bbcc046df7e64c054b6ce351baa9a53799
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-errorhandling-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 13KB
        • SHA256 1d5bad32a08b472d73d09a0c072c9798432b95431536b53db702291780aebd8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-file-l1-1-0.dll
        • Size 16KB
        • SHA256 1f68c7bf6f6560dd8a71fcdb6e9d37c48955067a6193138af2054324342d0d4a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-file-l1-2-0.dll
        • Size 13KB
        • SHA256 4d0e71f78fe4050092147e5763b7f5e863be24b6347d423de1732a52c6e7885f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l2-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-file-l2-1-0.dll
        • Size 13KB
        • SHA256 20845d8c7b5195b91523a52fd62ee3424b21944976e02bedec5f70a7cc92b2a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-handle-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-handle-l1-1-0.dll
        • Size 13KB
        • SHA256 7d38481800302769c48cddf646e2544399933d8c63300da6f40f595bfcb727bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-heap-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-heap-l1-1-0.dll
        • Size 13KB
        • SHA256 22cfc8d67b15bf7bc563f27bbae312f2f5c603ab44f1f34c2705473d21bfc95d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-interlocked-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 13KB
        • SHA256 15c49eb8dee9f8324645ae49eda5d010e1b4bdacb70482a51d8977d15c2d3ce2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-libraryloader-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 14KB
        • SHA256 7ed479a59bcc07a9f41b10ce9ad2fde66f39750e441b0efd83864029a88100a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-localization-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-localization-l1-2-0.dll
        • Size 15KB
        • SHA256 9b058a5824de535a1a0efa57451dc6a01d0adf901b5641f606a31cfaf0d4ae9e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-memory-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-memory-l1-1-0.dll
        • Size 13KB
        • SHA256 67b452ffaca64206a646cd0539e5a5adebb7f8cc04e9071f96fcbf410fd09b06
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-namedpipe-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 13KB
        • SHA256 8e904085d6b9f7c4f6355faa005145a3cab4a0afaaff8c59275822f00659e251
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processenvironment-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 14KB
        • SHA256 6d905d178f76cacb59b6af469a8981026c39bc4de3bb40067b75025033866f30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processthreads-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 15KB
        • SHA256 ab02d52ad531196e38f39550559c025efc4b3346205ca519b6fc7b2e0e42fc68
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processthreads-l1-1-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 13KB
        • SHA256 39cdcdff01209b52d87cf7edda175a0f2466c54e226eb1afcfb665d25f7b8c35
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-profile-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-profile-l1-1-0.dll
        • Size 12KB
        • SHA256 bc7ff389ec8c30e8c2fc59999c2e42aee651c2e3c28e4057e9b4462fe084a123
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-rtlsupport-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 13KB
        • SHA256 035a4f4a0fbe31a66056086c3ab57e21a21b0a637ce5e5ca2e6803491945ff3f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-string-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-string-l1-1-0.dll
        • Size 13KB
        • SHA256 1c03b35b7fddc4d449702838d1bc01290fe587ebda4b4fb9f4f00b24dd2d0358
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-synch-l1-1-0.dll
        • Size 15KB
        • SHA256 546571c95daabe38717e45392dc4bbb95a6bf1863b21119965ff0ecbbe55e240
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-synch-l1-2-0.dll
        • Size 13KB
        • SHA256 b2efdb9f38dddf37a6af53e9e480b31a1ddda248c323596ee8605f38911fe44b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-sysinfo-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 14KB
        • SHA256 8c145ad8d39db0b234fa1d8f43b92395b32655a3d11bbc76b216f802ccae7c90
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-timezone-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-timezone-l1-1-0.dll
        • Size 13KB
        • SHA256 bd924bec2947870c2376cf98ffcce96321842497e9af41e76cb3b7b796569203
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-util-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-core-util-l1-1-0.dll
        • Size 13KB
        • SHA256 00662028ca5586048c30e709127148d95198e4e462dfd1e17ef714909b4308f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-conio-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-crt-conio-l1-1-0.dll
        • Size 14KB
        • SHA256 2701e57c1e9b5c757eb7952d219bcb6dd6fcc67b7dd91867a87a74cb54c4cd1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-convert-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-crt-convert-l1-1-0.dll
        • Size 17KB
        • SHA256 07619926144a84b63a3c0881054c6917c33a51291e0f62b69917ee799146bd08
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-environment-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-crt-environment-l1-1-0.dll
        • Size 13KB
        • SHA256 2cd3304249287ae833a46e69880e9410fe2eb99a6a42df59cb6b60f08c99c6f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-filesystem-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 15KB
        • SHA256 11b21352a37e1c07d657c8492e6a9a8fc52004967ebaff335df6198602fea9ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-heap-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-crt-heap-l1-1-0.dll
        • Size 14KB
        • SHA256 6ed442445d7c334c8df860e92dcf99926eda8e49f11deeb0a08387b68dc7f11f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-locale-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-crt-locale-l1-1-0.dll
        • Size 13KB
        • SHA256 f19ebc6790da83d00f61b3d0a222bab95eb7bdb8dce3a32a4032d8910913a398
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-math-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-crt-math-l1-1-0.dll
        • Size 22KB
        • SHA256 92a05c30c27adcbea2df41adc9d621af93a5c7795bb45d7072679620c011cec7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-process-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-crt-process-l1-1-0.dll
        • Size 14KB
        • SHA256 555e51a10193fe90f659be5eb1ee5272d42236d3c20d8e47a1516b87131d8c7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-runtime-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 17KB
        • SHA256 2a4eadaf5a0b836df4c1bfc3eeb9dc134ec35c1bb201fa74703b331afb2029e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-stdio-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 19KB
        • SHA256 57beb2a7a01d8b01d78bcd0aed089953e180f442734ec146368f1b983603733b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-string-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-crt-string-l1-1-0.dll
        • Size 19KB
        • SHA256 daa836f3ca0519ad34263d68db268a9db7b837878215eef906031e6a7383cabb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-time-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-crt-time-l1-1-0.dll
        • Size 15KB
        • SHA256 45c9b18d82dd3d517b9d532737c22ee5d2563dc5019aeff75f26c84c4b0497e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-utility-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\api-ms-win-crt-utility-l1-1-0.dll
        • Size 13KB
        • SHA256 24439027856b9aae1b635e2982c4744c0aef927acd89aefe44353432f26c3498
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base_library.zip

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\base_library.zip
        • Size 1.3MB
        • SHA256 8f883a4f05be55bb6377e748bafd57fd8a4614767ad12b3b3f38c26d4a5d9b96
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libcrypto-3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\libcrypto-3.dll
        • Size 4.9MB
        • SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libffi-8.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libssl-3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\libssl-3.dll
        • Size 771KB
        • SHA256 41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pyexpat.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\pyexpat.pyd
        • Size 194KB
        • SHA256 cdc09fbae2f103196215facd50d108be3eff60c8ee5795dcc80bf57a0f120cdf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\python3.dll
        • Size 66KB
        • SHA256 a5bb3eb6fdfd23e0d8b2e4bccd6016290c013389e06daae6cb83964fa69e2a4f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python312.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\python312.dll
        • Size 6.7MB
        • SHA256 0cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        select.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\select.pyd
        • Size 29KB
        • SHA256 74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ucrtbase.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\ucrtbase.dll
        • Size 987KB
        • SHA256 6de067f985f4498f5c32c0b05019bed80a28cc3ae0c5170c3f0ee028c5768d75
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unicodedata.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI50202\unicodedata.pyd
        • Size 1.1MB
        • SHA256 2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/724-214-0x0000025741710000-0x0000025741711000-memory.dmp

        memory/4672-216-0x000001DE4B300000-0x000001DE4B301000-memory.dmp

        memory/4672-215-0x000001DE4B300000-0x000001DE4B301000-memory.dmp