Analysis
- max time kernel
148s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 04:02
Behavioral task
behavioral1
Sample
2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 9.8MB
- Sample260715-el5msabs2k
- SHA256 97c2ae0aa82a4cc5adcb4cd4f0a07262ca10692438eb99a8deb859adf109bb97
- MD5 fa20d5fb78514d204817adf7bd51bc68
- SHA1 765c7cba521b3bc960b4d2d156b72d8cce681cab
- SHA512 3bcadef396bb1c6bf04e62f541c7f7fd7ecfd71892e0c44864cddccb4a919c4dd6fd65fd6f19e7dc7ec441e75bff605db3724fee65bfc571c0e1041e35ea5b13
- SSDEEP 196608:lmEsRtbW897Gftr1LDsBTG9Wd/75IvwkV2ZTR6:/sR1q3sB1BFIvwtc
- TLSH T12DA6339472B414ECF9E7953E9A12D092A3A274215731CADF4BB847DA3E0B1F16C3E748
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 15 IoCs
pid Process 6036 2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 6036 2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 6036 2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 6036 2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 6036 2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 6036 2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 6036 2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 6036 2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 6036 2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 6036 2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 6036 2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 6036 2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 6036 2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 6036 2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 6036 2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2752 wrote to memory of 6036 2752 2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_fa20d5fb78514d204817adf7bd51bc68_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
PID:6036
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI27522\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI27522\_bz2.pyd
- Size 85KB
- SHA256 f0643f805a011efc704df472bb431ba231e6ae31fb7ba71328df1b6f1a9e1aa2
- MD5 94fd94a3194ef83be4437755a14cb810
- SHA1 7cef55c1ff01f359963cceebcbf6baa6cc8c7a5d
- SHA512 2cac920cb3b101dade078fb96b8438db7bf0ab17f009c9df64b443e1e0aa13a155d695270679cc35cfcc57adef4bb2a81e4446d0f04804b127ca8668c02110be
- SSDEEP 1536:4GNqB8z7qyEXkmNf0/ixk+x5dxNjP8AloDb8zMDIGwIM3V38y+kR9LfIgHL1:FNqB8zFEJUoZlTjUJ38zJGwIM3VUYB
- TLSH T18F838DC6F3A552B6F59F91B846840793F734BB960750A3AFF14882893F13BE06E5C225
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI27522\_ctypes.pyd
- Size 138KB
- SHA256 f761aad10818806531aa431143b30f0d90a0a402b60f6f1c6e406fcc08f4e6b8
- MD5 5860d45269a360d830807497fda7dd50
- SHA1 e8088b3fa01d32a246129ac08ce75c53e6664e4e
- SHA512 878bc79a6e6105038912dfa83be203239b438b53d739be502f7848193271de0a015e6bcde3acdbe5595356320a7756d4a0f8b83b8fcb4fbc5e9f4073c632214c
- SSDEEP 3072:yLji9Bvmib0DLGru4h1O/IFsDzPsLdzUsIMGPsW4Ihn:ejibvuh4G/IGjsaJ
- TLSH T146D37F4B336844A6D6A78578C6739E47EBB1F4511A1083CF4268C99B1F633A2AF3F315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI27522\_hashlib.pyd
- Size 67KB
- SHA256 052f824d5e3a046aa401efef86307c0c7746a0d8ff85c855d4225d6fe565bb07
- MD5 d60cc3d94442491b3f8657d54225198f
- SHA1 c5b75c895f593081308e82038ea0d23e8da9ee7a
- SHA512 ae60189fdc30500952fd52f64d593c51444e7706e9ea44e15ee5fdf362792d80deeafe5a0d319caa31d0f75287bedc89d0ae4d90c248bc56310897d3cac4e804
- SSDEEP 1536:WMRoOWZsPkJWvCGt6RUoIMDIf8y+kR9WfIU6H:7mYcJWvCGt6ioIMDIn/
- TLSH T1ED635B86A6984062DA1382B4C9E34F43FA75F652271197DF6339C18D2F233C3973A766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI27522\_lzma.pyd
- Size 157KB
- SHA256 3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723
- MD5 47bfbdcb4b88b6d9e6fb7ca72f7929ca
- SHA1 f4ac4210b1f5a290956e55d7ddf665dca95157ba
- SHA512 a3e3c1edbbea4b2335dcd5adb79460fc8a2108e323b2c8ca84eb070cb0e8f54df2e82f17a3ba23c5b080ee108d595587b1237025cb41229758af0733f384fb59
- SSDEEP 3072:O0m6DHDbBwiZfxA/VcNdznfx9mNooN4fnbOwIMI1dsZGK:OTCHDjfDNlpYOJfbOLaR
- TLSH T10EF34C86B794F0E6F7228C38D6614F57E7F5781A0320939A01CC976D2B1FB659A2B313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI27522\_socket.pyd
- Size 85KB
- SHA256 6a016011e78e2476eb19dbe7330b373b9e2c66ff6c0be9bd64ff008ee53647ef
- MD5 b042a4ce17bb4174ee2a927746f13f97
- SHA1 24c32e42af77a808921f0d6e87a8b88c279c39fa
- SHA512 33ce7df647c57529b365bc8633b4c168fe4d194e66e666dc2e545ccc43d1a08570bfcd91aaadb109a6174a90477db6951d279dbc7c145ce08770f77522de406d
- SSDEEP 1536:HCzH6HTMXx87Rfypx97XP+N6wSzPeVFSeJScNsIMGwR8y+kR94NfIW44DFr6pr:KH6HTOoypx97XPs6wSzPeFSWScNsIMGI
- TLSH T161836B01A66040FAEB62C076C2679E63FB74B5C113D4975F1466C69A1F333C2BF3AA85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI27522\_ssl.pyd
- Size 179KB
- SHA256 1edd9575243ae8322f6a21e9eecc933701c5820f05e7b0ebc0b51cb80592da77
- MD5 0e79667c70090d09216d6a84f9c81273
- SHA1 cfb45075d214a28dba7fa42ce421307975a92ee9
- SHA512 df7a003ecba4e141ed2a23cf4fd4d604bb10ed7cfaf152a52dbbf67e3d647730ad07b19ae88ea642d3a47a6a9e2b2d1277578875e0d2b6d9a0a0a1ac41d0985f
- SSDEEP 3072:HHqb8RUZrARopfh6CwdqMUUuGyU1y9MK9og5MFe82Iu5tyFjUdNcwPHIgqADwIMx:qkU5Xph6CwcRGyEYlI
- TLSH T1FE048C47B14429F7D913E8B9C6234543EBB4F145732297DE48C6DA860F0334AAE6AB73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI27522\_zstd.pyd
- Size 491KB
- SHA256 74f64a5d724cad1c10ca9ba579b6af198178406b0a4f061685326e79cffa3eea
- MD5 11e408a51564f9626db73bb282aeeefb
- SHA1 890db1462cde82ab16ff6c0e6bb3b70d35cc5869
- SHA512 65a5302758daebb2a59ed982d1a62cb1fabcfd0203f45baf900369bca11e3d70263db77dfb305e597e9846a9aa9cd92d3749e7a7f2f699d86a4b5ce8dc7c7af5
- SSDEEP 12288:/Pm5BlLPg/FcxTbwWo2iD4xjnBTrWl93S9Ct:/Pm5BNg/FcxTUWo2i0x7e
- TLSH T135B49D43F29943EDE17BC4B8CF465A53FBB1780B1214564B93A5CB993F07B309A6A309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI27522\base_library.zip
- Size 1.3MB
- SHA256 5c99aa2ce0dea90837e341b8d2cb070174d65f4be8ad8127efc8fd369e588d21
- MD5 22c4fdafe44eb7085f3a847ab5153c82
- SHA1 737c97bfd6170faf77ca3989136487d5d3fbed22
- SHA512 35d9e58cc0b3e599d20c07b02ddc0b45b5994bce603c5ab53ab1a9094ca35836ccf50e11d96e13f4bf49ba8e20615a6f60a098738af6568bbb4c719de1c87cd0
- SSDEEP 24576:388wuUFVdwuSRajo+lbQoLiQeOdP2m2dfoa:sLuUFVdwuSRN/b
- TLSH T1B5552AA1B9917967FEC9F37A35775A0CA715C0109B20D303B4A88DAC6FDF260AE158DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI27522\libcrypto-3.dll
- Size 5.0MB
- SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
- MD5 8e8f32ae40518478e44269cf22cf4399
- SHA1 3bd9ea6294eebd45c867178bac0f4f77a49525a9
- SHA512 d2d6bf1aac274fbbecafe2344242dd8edf9894c996d5e7c484cff828971287070de20abee1d2d706492063ffed64223020c9859df7596bd4d16c6d738efca6be
- SSDEEP 98304:D03+0YMHT8tCl1r2qxPJ1W1CPwDvt3uFlDC1:DyPYMz8tK1r2qxR1W1CPwDvt3uFlDC
- TLSH T1BE367B6AA7A80149E4BAC13CC9534617D2B1F85A57B097CF18A196BD0F33FDA2B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI27522\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI27522\libssl-3.dll
- Size 776KB
- SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
- MD5 f31ed8154564b75e48f2525a7e9f5742
- SHA1 d2ff57bdca2030379da6d256892350ca85a0411f
- SHA512 dc313916fce80ba99461dd758f424987344d5fdecc4ea28d01764440282b5bcde569eaf8a895fd966ee281aaad94d1b937f0e2164a45ddb18d3698e22b0f6ebb
- SSDEEP 12288:gwgpFEKP7Mn162zCpbbICGxsQ7caA0V/jcrldFe9XbE:X6P7Mn16sCpbbI1iecoVGFe9Xb
- TLSH T16FF44CADB3B805DDD8B6C17986934623E3B6F4552330EBEF065186790F277D42B3A248
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI27522\python314.dll
- Size 6.4MB
- SHA256 f1722bd369d79fecbc85f3ed2790c30c330b9413fd74332f95b086e60dfacc2a
- MD5 6c86b5a9512f313fc0ff2ebad8f6d47c
- SHA1 4e4f7ee84898d274b399670aa5368ad65dda6e9c
- SHA512 0d34c93842872992a4b15dae1837dcf2d428634f95875da8a112673365d1ec439f82caa10b0145a09e3de2cce8e1d15a7c385c0af6162ce8d7e56fba6d711a1e
- SSDEEP 98304:UIuAsiTMRBKQ19BtjDm5lERFQYtNX2jivPHDMiE2GZ:FuAsYMRBKQ9Bdi5lERFLkiK
- TLSH T1E0669D26737501A4D8BB8035C9074687DBB1BC00AB30D34B49A47ADA3F773635BAEB95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI27522\select.pyd
- Size 32KB
- SHA256 5c4103eef14aebd195425d42196895ffb87bf6a25ab4651242bebf0a6b25cf1d
- MD5 b6021321b7fd33c8c8a4079131625fab
- SHA1 b8a812e37647eff1f0dc0689ab0fc7c6dfdb70f1
- SHA512 4f31fe858655e82575216e55bf940cff6606b2869db1e567e7966e96f1b09391fe4beea0d6c00225093ad8b7248ae63ba8652365e0b9f396c00f703b73ab8e20
- SSDEEP 768:yB7Y4HfJeHrFsIMRGno8y++RYT2Ip46htTxf1mltPRVgg9:yB7R/JeHrFsIMRGo8y+kR96ZfIZR+c
- TLSH T1AEE26DCAAF645043EAA3C63186E2DE83F539B7E35611829F31B981990E173C1A337359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI27522\unicodedata.pyd
- Size 740KB
- SHA256 552317719cb70d92b73d9cd0d54c314ebab2f4dd1c468221e49c3190f24a4e7e
- MD5 62a8f384eff5516c5941261b8b8c9fd5
- SHA1 a497464bcac193b07216ae9c87b8a1c6db83560b
- SHA512 00827618788c4cc77b32622c9fd97ae6297c82ab34a686dc4c0898759bffa1bf78a50a467e42d9aa8f1077ef1e02cace55f772b2bdeb729ccb098a40229c91b6
- SSDEEP 12288:GYJAPtrZmDtBPcH+dEYJ5EAub+z70lDJPT36mwtWQNm:GYq5ZmDPqO5ElDJPTMW8m
- TLSH T13DF4E4F5BB838C16E69B767A48D3610F4E50C2B35F0A8637B2582355D8EB3B44DD182E
- MD5 SHA1 SHA512 SSDEEP TLSH