Analysis
- max time kernel
150s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
13/07/2026, 04:25
General
- Target 2026-07-13_932cce5de5d09d965b55ce1ed21408d0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 67.6MB
- Sample260713-e14n2ady2x
- SHA256 912f746eb61ed8efeece1d9ed8c410ff844328dfb61366d7e5c60f582bbe2d45
Malware Config
Signatures
- Detects executables packed with Themida 3 IoCs
- Detects executables referencing many IR and analysis tools 3 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL 3 IoCs
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-13_932cce5de5d09d965b55ce1ed21408d0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-13_932cce5de5d09d965b55ce1ed21408d0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
57faf29f.dll
57faf2a0.dll
57faf2a1.dll
memory/5052-16-0x0000025111370000-0x000002511441D000-memory.dmp
memory/5052-13-0x00007FFC00030000-0x00007FFC00031000-memory.dmp
memory/5052-14-0x00007FFC00000000-0x00007FFC00002000-memory.dmp
memory/5052-0-0x0000000180000000-0x000000018003E000-memory.dmp
memory/5052-9-0x00007FF6C3310000-0x00007FF6C76BC000-memory.dmp
memory/5052-26-0x000002510DAC0000-0x000002510DB33000-memory.dmp
memory/5052-27-0x000002510DAC0000-0x000002510DB33000-memory.dmp
memory/5052-1-0x000002510E0F0000-0x000002510E330000-memory.dmp
memory/5052-37-0x0000000180000000-0x000000018003E000-memory.dmp
memory/5052-43-0x00007FF6C3310000-0x00007FF6C76BC000-memory.dmp
memory/5052-44-0x00007FF6C3310000-0x00007FF6C76BC000-memory.dmp