Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
- submitted
04/07/2026, 01:22
General
- Target 2026-07-04_bed60576efe133fbe180a7c1a7fc9152_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 12.4MB
- Sample260704-brm35set5k
- SHA256 b3e619831a024d0fc48b3765a5b89665bbf1fccf6d0973d5d321b01686dec1c1
Malware Config
Signatures
- Detects executables packed with Themida 11 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL 10 IoCs
- Themida packer 11 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_bed60576efe133fbe180a7c1a7fc9152_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_bed60576efe133fbe180a7c1a7fc9152_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_bed60576efe133fbe180a7c1a7fc9152_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_bed60576efe133fbe180a7c1a7fc9152_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
pyarmor_runtime.pyd
python314.dll
memory/4480-36-0x000000005F200000-0x000000005FDEF000-memory.dmp
memory/4480-35-0x000000005F200000-0x000000005FDEF000-memory.dmp
memory/4480-34-0x000000005F200000-0x000000005FDEF000-memory.dmp
memory/4480-37-0x000000005F2A4000-0x000000005F2A6000-memory.dmp
memory/4480-42-0x000000005F200000-0x000000005FDEF000-memory.dmp
memory/4480-43-0x000000005F200000-0x000000005FDEF000-memory.dmp
memory/4480-44-0x000000005F200000-0x000000005FDEF000-memory.dmp
memory/4480-48-0x000000005F200000-0x000000005FDEF000-memory.dmp
memory/4480-51-0x000000005F200000-0x000000005FDEF000-memory.dmp
memory/4480-56-0x000000005F200000-0x000000005FDEF000-memory.dmp
memory/4480-57-0x000000005F200000-0x000000005FDEF000-memory.dmp