Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
30/06/2026, 03:14
General
- Target 2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 81.1MB
- Sample260630-drfeead15m
- SHA256 366761394325153b2d0927a996b9ca2121a2f3194e32c8fe0cc3acb656776cd0
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 2 IoCs
- System Time Discovery 1 TTPs 2 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Enumerates system info in registry 2 TTPs 6 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /f /tn "\Microsoft\Windows\svchost" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe\" /sc onlogon /delay 0001:00 /ru "" /rl highest /it"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "\Microsoft\Windows\svchost" /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe\" /sc onlogon /delay 0001:00 /ru "" /rl highest /it6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe\""5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\""5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe --watchdog5⤵
- Executes dropped EXE
-
-
C:\Windows\System32\Wbem\wmic.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NonInteractive -WindowStyle Hidden -Command "Unblock-File -Path \"C:\Users\Admin\AppData\Local\Temp\hbd_vuqzgyx3\hack-browser-data.exe\""5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\hbd_vuqzgyx3\""5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\hbd_vuqzgyx3\hack-browser-data.exeC:\Users\Admin\AppData\Local\Temp\hbd_vuqzgyx3\hack-browser-data.exe dump -v -c cookie,password -f json5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hbd_vuqzgyx3\hack-browser-data.exeC:\Users\Admin\AppData\Local\Temp\hbd_vuqzgyx3\hack-browser-data.exe dump -v -c cookie,password -f json6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rtx_hxyy7e_8\rt.exeC:\Users\Admin\AppData\Local\Temp\rtx_hxyy7e_8\rt.exe dump -v -c cookie,password -f json7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2888462131"8⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2888462131 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2888462131\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2888462131 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff80cb4c728,0x7ff80cb4c734,0x7ff80cb4c7409⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2888462131" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,14843532392892538196,6582178034433682624,262144 --field-trial-handle=1644,i,4021741229042175183,10952753097890926921,262144 --variations-seed-version --mojo-platform-channel-handle=1612 /prefetch:29⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2888462131" --force-high-res-timeticks=disabled --metrics-shmem-handle=2148,i,9270050677229120249,3375734371561126550,524288 --field-trial-handle=1644,i,4021741229042175183,10952753097890926921,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:119⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2888462131" --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,12552759231290407112,4139042156368653015,524288 --field-trial-handle=1644,i,4021741229042175183,10952753097890926921,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:139⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2888462131" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3288,i,7066809445705790804,3362317780293240387,2097152 --field-trial-handle=1644,i,4021741229042175183,10952753097890926921,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:19⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2888462131" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3312,i,10983973410773956093,8672573500295912224,2097152 --field-trial-handle=1644,i,4021741229042175183,10952753097890926921,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:19⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2888462131" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3884,i,3813503988520194758,7065626098629793108,2097152 --field-trial-handle=1644,i,4021741229042175183,10952753097890926921,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:99⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2888462131" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=1684,i,18327803060327735244,15873147778224647171,2097152 --field-trial-handle=1644,i,4021741229042175183,10952753097890926921,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:19⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2888462131" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4640,i,9997067023728292174,7898186750751934913,2097152 --field-trial-handle=1644,i,4021741229042175183,10952753097890926921,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:99⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180"8⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7ff809c0c188,0x7ff809c0c194,0x7ff809c0c1a09⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,13214274500912182113,13537593579516217286,262144 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:29⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,6578337378149867084,2281662496211324109,524288 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:119⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2688,i,6541275848140241560,4188712346639760427,524288 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:139⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,10213078838687441712,9902550266125646634,2097152 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,14502826651709023953,11207042268530161199,2097152 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4108,i,5023622025070992290,9891894011562647183,524288 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4136,i,14200540142899409052,17331797176391366727,524288 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,10774281357753306390,16547482264824633765,524288 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4216,i,15246343399092627402,3223151217840265510,2097152 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4224,i,14889591664596112355,6925546785791654451,2097152 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:99⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4272,i,18157723851954664961,14649625659703501736,2097152 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4304,i,6999924830201230155,12310334297740085469,2097152 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:99⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4364,i,11602327401734235771,6389559578241795336,2097152 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:99⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4316,i,13934685509571280988,13408483300958678366,2097152 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4388,i,6900047287231494526,13427854680507885506,2097152 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4440,i,6342911318748545680,6469536983471449906,2097152 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:99⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4436,i,2813558548763743184,1259254919629300121,2097152 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4400,i,6999211551727693454,6350374735235603190,2097152 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:99⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hbd-inj-udd-2709244180" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,5501888087307884620,2656097915626133163,524288 --field-trial-handle=2280,i,1103713781663389463,10242388606978091591,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:149⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=116010⤵
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\2026-06-29_d0d31fe37076a92bae7b530c6c08582e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
euc-cn.enc
_imaging.cp314-win_amd64.pyd
_imagingft.cp314-win_amd64.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
cp1252.enc
_tkinter.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
__init__.py
load_config_py3.py
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
libscipy_openblas64_-63c857e738469261263c764a36be9436.dll
msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
_multiarray_umath.cp314-win_amd64.pyd
_umath_linalg.cp314-win_amd64.pyd
python3.DLL
python314.dll
select.pyd
Lorem ipsum.txt
tcl86t.dll
tk86t.dll
INSTALLER
zlib1.dll
__PSScriptPolicyTest_z2b5tdw2.5tm.ps1
settings.dat
index
67ce2356-5b07-4678-8dda-597e8ddfba83.tmp
Local State
Local State
Local State~RFe5980ee.TMP
MANIFEST-000001
CURRENT
data_0
data_2
data_3
data_1
memory/468-1669-0x00007FF835E40000-0x00007FF835E52000-memory.dmp
memory/468-1640-0x00007FF828BC0000-0x00007FF828C8E000-memory.dmp
memory/468-1285-0x00007FF838160000-0x00007FF838174000-memory.dmp
memory/468-1281-0x00007FF831900000-0x00007FF831922000-memory.dmp
memory/468-1280-0x00007FF838190000-0x00007FF83819F000-memory.dmp
memory/468-1292-0x00007FF81CC70000-0x00007FF81D1A4000-memory.dmp
memory/468-1277-0x00007FF81B280000-0x00007FF81C64C000-memory.dmp
memory/468-1274-0x00007FF81C650000-0x00007FF81CA09000-memory.dmp
memory/468-1300-0x00007FF81AC70000-0x00007FF81AEF2000-memory.dmp
memory/468-1299-0x00007FF838120000-0x00007FF838154000-memory.dmp
memory/468-1298-0x00007FF8317E0000-0x00007FF83180D000-memory.dmp
memory/468-1270-0x00007FF838100000-0x00007FF83810D000-memory.dmp
memory/468-1303-0x00007FF828BC0000-0x00007FF828C8E000-memory.dmp
memory/468-1304-0x00007FF81AA50000-0x00007FF81AC6A000-memory.dmp
memory/468-1267-0x00007FF835E40000-0x00007FF835E52000-memory.dmp
memory/468-1264-0x00007FF836120000-0x00007FF836138000-memory.dmp
memory/468-1297-0x00007FF81AF00000-0x00007FF81B0A1000-memory.dmp
memory/468-1296-0x00007FF81B0B0000-0x00007FF81B280000-memory.dmp
memory/468-1307-0x00007FF81B280000-0x00007FF81C64C000-memory.dmp
memory/468-1308-0x00007FF81C650000-0x00007FF81CA09000-memory.dmp
memory/468-1535-0x00007FF838250000-0x00007FF83827C000-memory.dmp
memory/468-1518-0x00007FF81D1B0000-0x00007FF81D8BD000-memory.dmp
memory/468-1580-0x00007FF838160000-0x00007FF838174000-memory.dmp
memory/468-1579-0x00007FF838190000-0x00007FF83819F000-memory.dmp
memory/468-1578-0x00007FF8381A0000-0x00007FF8381AD000-memory.dmp
memory/468-1577-0x00007FF8381B0000-0x00007FF8381CA000-memory.dmp
memory/468-1537-0x00007FF8381D0000-0x00007FF838250000-memory.dmp
memory/468-1259-0x00007FF828BC0000-0x00007FF828C8E000-memory.dmp
memory/468-1670-0x00007FF838100000-0x00007FF83810D000-memory.dmp
memory/468-1257-0x00007FF838120000-0x00007FF838154000-memory.dmp
memory/468-1626-0x00007FF81CC70000-0x00007FF81D1A4000-memory.dmp
memory/468-1668-0x00007FF836120000-0x00007FF836138000-memory.dmp
memory/468-1672-0x00007FF81C650000-0x00007FF81CA09000-memory.dmp
memory/468-1638-0x00007FF838120000-0x00007FF838154000-memory.dmp
memory/468-1766-0x00007FF81B0B0000-0x00007FF81B280000-memory.dmp
memory/468-1767-0x00007FF8317E0000-0x00007FF83180D000-memory.dmp
memory/468-1725-0x00007FF81B280000-0x00007FF81C64C000-memory.dmp
memory/468-1769-0x00007FF81AC70000-0x00007FF81AEF2000-memory.dmp
memory/468-1768-0x00007FF81AF00000-0x00007FF81B0A1000-memory.dmp
memory/468-1765-0x00007FF8344E0000-0x00007FF8344F6000-memory.dmp
memory/468-1764-0x00007FF831900000-0x00007FF831922000-memory.dmp
memory/468-1531-0x00007FF8382B0000-0x00007FF8382D9000-memory.dmp
memory/468-1534-0x00007FF838280000-0x00007FF83829A000-memory.dmp
memory/468-1533-0x00007FF8382A0000-0x00007FF8382AF000-memory.dmp
memory/468-1850-0x00007FF81AA50000-0x00007FF81AC6A000-memory.dmp
memory/468-1214-0x00007FF81D1B0000-0x00007FF81D8BD000-memory.dmp
memory/468-1223-0x00007FF8382B0000-0x00007FF8382D9000-memory.dmp
memory/468-1225-0x00007FF8382A0000-0x00007FF8382AF000-memory.dmp
memory/468-1229-0x00007FF838280000-0x00007FF83829A000-memory.dmp
memory/468-1232-0x00007FF838250000-0x00007FF83827C000-memory.dmp
memory/468-1234-0x00007FF8381D0000-0x00007FF838250000-memory.dmp
memory/468-1237-0x00007FF8381B0000-0x00007FF8381CA000-memory.dmp
memory/468-1241-0x00007FF8381A0000-0x00007FF8381AD000-memory.dmp
memory/468-1243-0x00007FF838190000-0x00007FF83819F000-memory.dmp
memory/468-1248-0x00007FF838160000-0x00007FF838174000-memory.dmp
memory/468-1251-0x00007FF81D1B0000-0x00007FF81D8BD000-memory.dmp
memory/468-1252-0x00007FF81CC70000-0x00007FF81D1A4000-memory.dmp
memory/468-1286-0x00007FF8344E0000-0x00007FF8344F6000-memory.dmp
memory/468-1256-0x00007FF8382B0000-0x00007FF8382D9000-memory.dmp
memory/1760-3843-0x00007FF8046F0000-0x00007FF80470A000-memory.dmp
memory/1760-3841-0x00007FF804790000-0x00007FF8047BC000-memory.dmp
memory/1760-3842-0x00007FF804710000-0x00007FF804790000-memory.dmp
memory/1760-3844-0x00007FF816B20000-0x00007FF816B2D000-memory.dmp
memory/1760-3845-0x00007FF8159E0000-0x00007FF8159EF000-memory.dmp
memory/1760-3846-0x00007FF8046D0000-0x00007FF8046E4000-memory.dmp
memory/1760-3837-0x00007FF804830000-0x00007FF804F3D000-memory.dmp
memory/1760-3850-0x00007FF80D8B0000-0x00007FF80D8C8000-memory.dmp
memory/1760-3851-0x00007FF80D890000-0x00007FF80D8A2000-memory.dmp
memory/1760-3852-0x00007FF830550000-0x00007FF83055D000-memory.dmp
memory/1760-3848-0x00007FF80D9A0000-0x00007FF80D9D4000-memory.dmp
memory/1760-3838-0x00007FF8047E0000-0x00007FF804809000-memory.dmp
memory/1760-3839-0x00007FF81DEE0000-0x00007FF81DEEF000-memory.dmp
memory/1760-3840-0x00007FF8047C0000-0x00007FF8047DA000-memory.dmp
memory/2364-2595-0x0000022DD9ED0000-0x0000022DD9EF2000-memory.dmp
memory/2364-2608-0x0000022DF2170000-0x0000022DF218E000-memory.dmp
memory/2364-2610-0x0000022DD9F50000-0x0000022DD9F5A000-memory.dmp
memory/2364-2609-0x0000022DF2190000-0x0000022DF2242000-memory.dmp
memory/2464-3932-0x000001CEBE4F0000-0x000001CEBE5A2000-memory.dmp
memory/5984-2563-0x00007FF831900000-0x00007FF831922000-memory.dmp
memory/5984-2556-0x00007FF838120000-0x00007FF838154000-memory.dmp
memory/5984-2549-0x00007FF838250000-0x00007FF83827C000-memory.dmp
memory/5984-2570-0x00007FF81D1B0000-0x00007FF81D8BD000-memory.dmp
memory/5984-2546-0x00007FF8382B0000-0x00007FF8382D9000-memory.dmp
memory/5984-2547-0x00007FF8382A0000-0x00007FF8382AF000-memory.dmp
memory/5984-2551-0x00007FF8381B0000-0x00007FF8381CA000-memory.dmp
memory/5984-2550-0x00007FF8381D0000-0x00007FF838250000-memory.dmp
memory/5984-2558-0x00007FF836120000-0x00007FF836138000-memory.dmp
memory/5984-2560-0x00007FF838100000-0x00007FF83810D000-memory.dmp
memory/5984-2559-0x00007FF835E40000-0x00007FF835E52000-memory.dmp
memory/5984-2567-0x00007FF8317E0000-0x00007FF83180D000-memory.dmp
memory/5984-2548-0x00007FF838280000-0x00007FF83829A000-memory.dmp
memory/5984-2552-0x00007FF8381A0000-0x00007FF8381AD000-memory.dmp
memory/5984-2545-0x00007FF81D1B0000-0x00007FF81D8BD000-memory.dmp
memory/5984-2564-0x00007FF8344E0000-0x00007FF8344F6000-memory.dmp
memory/5984-2555-0x00007FF81CC70000-0x00007FF81D1A4000-memory.dmp
memory/5984-2557-0x00007FF828BC0000-0x00007FF828C8E000-memory.dmp
memory/5984-2561-0x00007FF81C650000-0x00007FF81CA09000-memory.dmp
memory/5984-2565-0x00007FF81B0D0000-0x00007FF81B271000-memory.dmp
memory/5984-2566-0x00007FF81AF00000-0x00007FF81B0D0000-memory.dmp
memory/5984-2562-0x00007FF81B280000-0x00007FF81C64C000-memory.dmp
memory/5984-2568-0x00007FF81AC70000-0x00007FF81AEF2000-memory.dmp
memory/5984-2569-0x00007FF816E60000-0x00007FF816E8E000-memory.dmp
memory/5984-2553-0x00007FF838190000-0x00007FF83819F000-memory.dmp
memory/5984-2554-0x00007FF838160000-0x00007FF838174000-memory.dmp