Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 04:46
General
- Target 2026-07-06_27f7ec2b888f4dbe44ae248a0e6e0a70_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 9.6MB
- Sample260707-fd79dah15s
- SHA256 363dc6264a6926d65303d474db595afbf7ce792a6353f60e3bdc94ac1a9b9137
Malware Config
Signatures
- Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 8 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_27f7ec2b888f4dbe44ae248a0e6e0a70_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_27f7ec2b888f4dbe44ae248a0e6e0a70_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_27f7ec2b888f4dbe44ae248a0e6e0a70_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_27f7ec2b888f4dbe44ae248a0e6e0a70_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vqtgejpl.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vqtgejpl.exeC:\Users\Admin\AppData\Local\Temp\vqtgejpl.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_zstd.pyd
base_library.zip
libffi-8.dll
python314.dll
ucrtbase.dll
vqtgejpl.exe
memory/5260-84-0x00007FFA8B050000-0x00007FFA8B9F4000-memory.dmp
memory/5260-89-0x00007FFA8B050000-0x00007FFA8B9F4000-memory.dmp
memory/5260-82-0x00000148F78D0000-0x00000148F7982000-memory.dmp
memory/5260-85-0x00007FFA8B050000-0x00007FFA8B9F4000-memory.dmp
memory/5260-86-0x00007FFA8B050000-0x00007FFA8B9F4000-memory.dmp
memory/5260-87-0x00007FFA8B050000-0x00007FFA8B9F4000-memory.dmp
memory/5260-88-0x00007FFA8B050000-0x00007FFA8B9F4000-memory.dmp
memory/5260-83-0x00007FFA8B1DF000-0x00007FFA8B1E0000-memory.dmp
memory/5260-90-0x00007FFA8B050000-0x00007FFA8B9F4000-memory.dmp
memory/5260-91-0x00007FFA8B050000-0x00007FFA8B9F4000-memory.dmp
memory/5260-92-0x00007FFA8B050000-0x00007FFA8B9F4000-memory.dmp
memory/5260-93-0x00007FFA8B050000-0x00007FFA8B9F4000-memory.dmp
memory/5260-94-0x00007FFA8B050000-0x00007FFA8B9F4000-memory.dmp
memory/5260-95-0x00007FFA8B050000-0x00007FFA8B9F4000-memory.dmp
memory/5260-96-0x00007FFA8B050000-0x00007FFA8B9F4000-memory.dmp