Overview

overview

10

Static

static

3

2026-07-09...at.exe

windows10-2004-x64

10

2026-07-09...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 03:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-09_58757e68ecb77b4635d980fa82ed7df1_blankgrabber_icedid_luca-stealer_njrat.exe
  • Size 22.1MB
  • Sample260709-ednpasct9j
  • SHA256 afcc2fb388536942295a5ba209de5dabb4b29eda2208af105258bcc12ccc1a03
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionevasiontrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Loads dropped DLL 58 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    defense_evasion
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_58757e68ecb77b4635d980fa82ed7df1_blankgrabber_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_58757e68ecb77b4635d980fa82ed7df1_blankgrabber_icedid_luca-stealer_njrat.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3900
    • C:\Users\Admin\AppData\Local\Temp\2026-07-09_58757e68ecb77b4635d980fa82ed7df1_blankgrabber_icedid_luca-stealer_njrat.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-09_58757e68ecb77b4635d980fa82ed7df1_blankgrabber_icedid_luca-stealer_njrat.exe
      2⤵
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5684
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3736
        • C:\Windows\system32\reg.exe
          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
          4⤵
          • Modifies Windows Defender DisableAntiSpyware settings
          PID:3288
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1620
        • C:\Windows\system32\reg.exe
          reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
          4⤵
            PID:5148
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f 2>nul
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1276
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
            4⤵
              PID:2480
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f 2>nul
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1832
            • C:\Windows\system32\reg.exe
              reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f
              4⤵
                PID:2820
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f 2>nul
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2380
              • C:\Windows\system32\reg.exe
                reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableIOAVProtection /t REG_DWORD /d 1 /f
                4⤵
                  PID:2588
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f 2>nul
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3312
                • C:\Windows\system32\reg.exe
                  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
                  4⤵
                    PID:5636
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f 2>nul
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2176
                  • C:\Windows\system32\reg.exe
                    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 0 /f
                    4⤵
                      PID:264
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c taskkill /f /im taskmgr.exe 2>nul
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:256
                    • C:\Windows\system32\taskkill.exe
                      taskkill /f /im taskmgr.exe
                      4⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:252
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c taskkill /f /im cmd.exe 2>nul
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2716
                    • C:\Windows\system32\taskkill.exe
                      taskkill /f /im cmd.exe
                      4⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3796
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c taskkill /f /im powershell.exe 2>nul
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:2140
                    • C:\Windows\system32\taskkill.exe
                      taskkill /f /im powershell.exe
                      4⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5104
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c taskkill /f /im regedit.exe 2>nul
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3600
                    • C:\Windows\system32\taskkill.exe
                      taskkill /f /im regedit.exe
                      4⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1260
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe 2>nul
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3120
                    • C:\Windows\system32\taskkill.exe
                      taskkill /f /im explorer.exe
                      4⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5412

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    SDL2.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\SDL2.dll
                    • Size 2.4MB
                    • SHA256 520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SDL2_ttf.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\SDL2_ttf.dll
                    • Size 1.5MB
                    • SHA256 fcdfabdfce868eb33f7514025ff59c1bb6c418f1bcd6ace2300a9cd4053e1d63
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    base.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\base.pyd
                    • Size 30KB
                    • SHA256 59fd2c87c8261f8de69fb70f881b41a13e522119503ae18fc068d607b4754bfe
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    bufferproxy.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\bufferproxy.pyd
                    • Size 18KB
                    • SHA256 7b1de4a711ac3b8c870a70d1b5db3a3684efd5ab258c4e1c42e715bd6e0a500c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    color.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\color.pyd
                    • Size 35KB
                    • SHA256 f1532048d8d89e0aff5a79f0dd96edaf7e75665c0292032c2b69a90374b4582a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    constants.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\constants.pyd
                    • Size 49KB
                    • SHA256 99ef70bf473e1241a433f33dc7ec89dff64c831999de68612f2e642fd4a1d5dd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    display.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\display.pyd
                    • Size 44KB
                    • SHA256 6ce7e1f477c4aa614b1231b1a2ce345662bb36ed590157d48e219219f7459970
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    draw.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\draw.pyd
                    • Size 49KB
                    • SHA256 18e7ec3c61c272318b08adb7c5466c334abf6f75becc5824f5ab8fdc5f6e9a31
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    event.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\event.pyd
                    • Size 43KB
                    • SHA256 b9a3dabaa705c50d3d78505195eb609e7883c01ec080db2f21e7251025b3309c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    imageext.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\imageext.pyd
                    • Size 17KB
                    • SHA256 7ff15e58ae5f0de963508bf002d99363b7e9594a09beabdd99f5d9fb1edce0e3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    key.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\key.pyd
                    • Size 20KB
                    • SHA256 ce4815ce82bef66100d83b3244a5a0db2ec62a342d80b03e3e560d6aa5d7c583
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    mask.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\mask.pyd
                    • Size 54KB
                    • SHA256 c506e7421bcc10b9d0b45ce44152c8fec242d310fd9fd9aff94d001e3893fa90
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    math.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\math.pyd
                    • Size 75KB
                    • SHA256 515e2cf7344b6daedd464f567ca99978a47da14719b7f5a092c69a252b16c5f3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pixelcopy.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\pixelcopy.pyd
                    • Size 26KB
                    • SHA256 d430b7bab200bba63a8b4f74081cf409c9fb42dc3e4f2097cc77988b7f9fbb82
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    rect.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\rect.pyd
                    • Size 44KB
                    • SHA256 38d709cb73a98dd54d666689212bfdddc2a68fcc4541c3b59a741815e4688b7c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    rwobject.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\rwobject.pyd
                    • Size 19KB
                    • SHA256 b658da9b9b207f73325b9e9b84029258e64e324b8935671ce79b49f28a26b87e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    surflock.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\surflock.pyd
                    • Size 13KB
                    • SHA256 6c0c944037dc7a23e4ca6683d58085752453faf3be1e776a0ebd33f3d0fda8d5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    313.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3900_134280425868803598\313.dll
                    • Size 22.7MB
                    • SHA256 4d5e2f386c0116c8d3b02490e778027ea394cc0e99d25182a9507f22cb52ecca
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    VCRUNTIME140.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3900_134280425868803598\VCRUNTIME140.dll
                    • Size 117KB
                    • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _queue.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3900_134280425868803598\_queue.pyd
                    • Size 32KB
                    • SHA256 37622ca591fb8e45a894db9c0da99bfcb18a820a48f028e4949d9256b69247e3
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SDL2_image.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3900_134280425868803598\pygame\SDL2_image.dll
                    • Size 122KB
                    • SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    font.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3900_134280425868803598\pygame\font.pyd
                    • Size 24KB
                    • SHA256 413c4e8f918cb654dcd5788c5717142eb42af9ba1b07bc2ae94d1cb856783090
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    image.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3900_134280425868803598\pygame\image.pyd
                    • Size 29KB
                    • SHA256 a6100714b22ceb504bc5a303f86ac28ceb1ac47796175f101e23e869eba4480c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    joystick.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3900_134280425868803598\pygame\joystick.pyd
                    • Size 20KB
                    • SHA256 cf5c43e5dbe986dfadf17e9fa6583ba0932540f31d359024abfc69bcc2cb6f8c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libpng16-16.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3900_134280425868803598\pygame\libpng16-16.dll
                    • Size 206KB
                    • SHA256 e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    mouse.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3900_134280425868803598\pygame\mouse.pyd
                    • Size 19KB
                    • SHA256 d0609d148cfc8337ed87ac92fba3e226efaea2405cdf488b9cdea540d3f05881
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pixelarray.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3900_134280425868803598\pygame\pixelarray.pyd
                    • Size 47KB
                    • SHA256 99ac7eab08cb2ff078ea515ca51ba8c86819d47b8820d41cb65d645f0fafddc0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    surface.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3900_134280425868803598\pygame\surface.pyd
                    • Size 234KB
                    • SHA256 bc64469279ac571f08173b2a09da78f1c0af3276e531fdf12ec3f9e9eca8fdde
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    time.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3900_134280425868803598\pygame\time.pyd
                    • Size 18KB
                    • SHA256 20025c990cc49ca1d58b84d0e3b9b84932a2ce98ae192d0415b7061369837d91
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    transform.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3900_134280425868803598\pygame\transform.pyd
                    • Size 57KB
                    • SHA256 e746b718c52de41492139a5152c842b0bfd8faaca4b992e8df562aa3c4ca97fd
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    zlib1.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3900_134280425868803598\pygame\zlib1.dll
                    • Size 106KB
                    • SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    python312.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_3900_134280425868803598\python312.dll
                    • Size 6.6MB
                    • SHA256 3b56fa10d3797c231468cee42caeaaaff40dbede7bc0d142ec4878493f48e07d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/5684-194-0x00007FFC1AD60000-0x00007FFC1AFCC000-memory.dmp
                    Download

                    memory/5684-199-0x00007FFC1BA70000-0x00007FFC1BAC1000-memory.dmp
                    Download

                    memory/5684-198-0x00007FFC12330000-0x00007FFC124B2000-memory.dmp
                    Download

                    memory/5684-200-0x00007FFC0CCC0000-0x00007FFC0E03E000-memory.dmp
                    Download

                    memory/5684-197-0x0000000062E80000-0x0000000062EA4000-memory.dmp
                    Download

                    memory/5684-196-0x0000000068B40000-0x0000000068B7C000-memory.dmp
                    Download

                    memory/5684-195-0x000000006A880000-0x000000006A8A7000-memory.dmp
                    Download

                    memory/5684-204-0x0000000062E80000-0x0000000062EA4000-memory.dmp
                    Download

                    memory/5684-206-0x00007FFC1BA70000-0x00007FFC1BAC1000-memory.dmp
                    Download

                    memory/5684-203-0x0000000068B40000-0x0000000068B7C000-memory.dmp
                    Download

                    memory/5684-202-0x000000006A880000-0x000000006A8A7000-memory.dmp
                    Download

                    memory/5684-205-0x00007FFC12330000-0x00007FFC124B2000-memory.dmp
                    Download

                    memory/5684-201-0x00007FFC1AD60000-0x00007FFC1AFCC000-memory.dmp
                    Download

                    memory/5684-207-0x00007FFC0CCC0000-0x00007FFC0E03E000-memory.dmp
                    Download