Analysis

  • max time kernel
    150s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/07/2026, 19:30

General

  • Target
    2026-07-17_2b11af0a9d64fe06e93193f540d0b67b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 18.1MB
  • Sample260717-x7xheagt21
  • SHA256 50d460f7c61212b15d21e0c18c8c6a5f1cf8ac500281fe57eb0b22e3fc88cbe6
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Loads dropped DLL 35 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_2b11af0a9d64fe06e93193f540d0b67b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-17_2b11af0a9d64fe06e93193f540d0b67b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Users\Admin\AppData\Local\Temp\2026-07-17_2b11af0a9d64fe06e93193f540d0b67b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-17_2b11af0a9d64fe06e93193f540d0b67b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4932
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:436
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:3732

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
        • Size 211KB
        • SHA256 89b688b3848e196de02a444c72cfc25bb3efebaba84a28469ac1e7f5738e0564
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VCRUNTIME140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\VCRUNTIME140.dll
        • Size 106KB
        • SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VCRUNTIME140_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _asyncio.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\_asyncio.pyd
        • Size 62KB
        • SHA256 d667822030ba160cd8770569afec2c029b5247ceaa401d9268fe98bbea9e4c11
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _bz2.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\_bz2.pyd
        • Size 81KB
        • SHA256 8eecdcc250637652e6babc306ea6b8820e9e835ddd2434816d0e0fd0ca67fd14
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _ctypes.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\_ctypes.pyd
        • Size 120KB
        • SHA256 af598ae52ddc6869f24d36a483b77988385a5bbbf4618b2e2630d89d10a107ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _lzma.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\_lzma.pyd
        • Size 153KB
        • SHA256 33ae42f744d2688bb7d5519f32ff7b7489b96f4eea47f66d2009dba6a0023903
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-console-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-console-l1-1-0.dll
        • Size 22KB
        • SHA256 1a1d624fb64ad72889a92ae4129eeba938d7b7a936c1b38473e98a4cdf71b791
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-datetime-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-datetime-l1-1-0.dll
        • Size 22KB
        • SHA256 4e274bbba70122d4423c44e982611205df276bc40dc8ba4698de8ff55644ed3e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-debug-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-debug-l1-1-0.dll
        • Size 22KB
        • SHA256 8e6e0acb35fe3964c2fb41c8b81cc72c3520a992885fc1efa54c2d88b9a7ef96
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-errorhandling-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 22KB
        • SHA256 6632aa4d6f98324459ebdc433a91e3f0388cef249f454cf30403a0a0edf116ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-fibers-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-fibers-l1-1-0.dll
        • Size 22KB
        • SHA256 c99d226061dbcd5b32ad6a636eeb2805b8c5b66925d24ff87f3559c08d025ec5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-file-l1-1-0.dll
        • Size 26KB
        • SHA256 0e6172bd141498fea5c27c0e5e3beedcca1f0f59e1e6502bfd63abf0feb7f660
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-file-l1-2-0.dll
        • Size 22KB
        • SHA256 6f6e02eccf8e2dfd2e1eb6bf1e8c939c25d2876243158121f28d0b6d4bd90c84
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l2-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-file-l2-1-0.dll
        • Size 22KB
        • SHA256 6b6826aa152376ad00fbb4e14b1eb29ad130d15a293ab90dcd8361ab6cee4863
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-handle-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-handle-l1-1-0.dll
        • Size 22KB
        • SHA256 12fe3b38cfceea20987c23e9cf040d0e1803f185d9ff5b5ba86d6d4ebc43e4b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-heap-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-heap-l1-1-0.dll
        • Size 22KB
        • SHA256 73629b2105095d384d12e721a214237f682b40a0baeca2a01bdba1134805cd1f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-interlocked-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 22KB
        • SHA256 d46f9afcefdc420137f0df842ef7a334aff2388404a2d980933caa7e7eb2ffca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-libraryloader-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 22KB
        • SHA256 f88a81c19167a9dd261d48a4bfb7952344f7e03ba2992e6ed4cf4f21c0d0ace2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-localization-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-localization-l1-2-0.dll
        • Size 22KB
        • SHA256 35d5350c936a346be442e36b0c29b7216cae421f7b77cf3645dd1c4f8919c470
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-memory-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-memory-l1-1-0.dll
        • Size 22KB
        • SHA256 7034c20d4a0a978bf770178da072172102392d5851d59591b2b4743787a3ed4a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-namedpipe-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 22KB
        • SHA256 51e789d166dbfcfc65895e32bd59af8fcdc16eccbb5c2e88a06e28d6531f4b40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processenvironment-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 22KB
        • SHA256 050580f8c439514fd53c84e8536b7db8569fb0a09bfd0936f3facc847f01452e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processthreads-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 22KB
        • SHA256 4225b3e04f2ef317fd8c1e87a32b1641c355914043a829abc9eae619ddce3998
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processthreads-l1-1-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 22KB
        • SHA256 3551362d79b310c992156764397764f6c6096c94273fee569a99b853c66bb8d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-profile-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-profile-l1-1-0.dll
        • Size 22KB
        • SHA256 7ccc0f31ea8bb8474bd950cc074051612ed6a6de354ee3472d75a1ae48c96f43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-rtlsupport-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 22KB
        • SHA256 41dd39b4c7875a4b95259f940957d1acf0f752bbd948944b4e66b70e1898f3b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-string-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-string-l1-1-0.dll
        • Size 22KB
        • SHA256 dba1a1de9934615ee63312681a42e99a015f4b4c46b81164331269dadbd96cc9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-synch-l1-1-0.dll
        • Size 22KB
        • SHA256 4f0f784e8156be670d3ea4b59c07ad650fd8a5ec1d209e6444ad934761d90e27
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-synch-l1-2-0.dll
        • Size 22KB
        • SHA256 3cbdf5522edd1f4088159e5c84bb12f56b52b763396a0c3688bf5b051090de69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-sysinfo-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 22KB
        • SHA256 e1814729819a00545b6e5f45e3af3e169aca54ee15cf96ec3591c2f2fd45cc8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-timezone-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-timezone-l1-1-0.dll
        • Size 22KB
        • SHA256 996ba57156efc9c749c2c62af7fee2042fd32f39607bcb0b58f6b6b591a79039
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-util-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-core-util-l1-1-0.dll
        • Size 22KB
        • SHA256 459c7b802dbc6844071758cc88026b79070cb1b0be858bd2c76ac15b3a67bf7a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-conio-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-crt-conio-l1-1-0.dll
        • Size 22KB
        • SHA256 4f8c75c276e897f750059dadbd5816d5ebfe649f08b2226432f4447dd09dd7f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-convert-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-crt-convert-l1-1-0.dll
        • Size 26KB
        • SHA256 450b9c0a0968b532d131b8b8bfd69d8f9914186c0c63fd35238fd81fbf464ab8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-environment-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-crt-environment-l1-1-0.dll
        • Size 22KB
        • SHA256 9aa27707c79e9cd00626a585da678d8c5f47bf0ab3dc07f0657332be36b92a31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-filesystem-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 22KB
        • SHA256 6f72a7073d917ef32c506d217db351867f3bfa16bf871a4551fbcf1cf48eade3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-heap-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-crt-heap-l1-1-0.dll
        • Size 22KB
        • SHA256 3f2a6204194fa284e34e60569759b81439b13567611083ea2840b042464f3afe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-locale-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-crt-locale-l1-1-0.dll
        • Size 22KB
        • SHA256 bc0dbd2d15123feebf8f73335e3297c6fb9fae033ed03b138f738deb359a610b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-math-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-crt-math-l1-1-0.dll
        • Size 30KB
        • SHA256 6480e5d39a05d829cda6d0638f0284c8033331bd1d95dc059848bfa1b65aa8ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-multibyte-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-crt-multibyte-l1-1-0.dll
        • Size 30KB
        • SHA256 3b5181bcd6862eb7d822296e65424b5eb2b23d080466f9e7866e62befc1b8394
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-process-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-crt-process-l1-1-0.dll
        • Size 22KB
        • SHA256 bcc2e715d502aa15e884d3fbf82400596c4250b8aba98cea4defc1f994a25d65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-runtime-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 26KB
        • SHA256 f3d1536c3d33748b9586f425583e61a9effd9d0e00b68f8b5882d25d7448634d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-stdio-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 26KB
        • SHA256 59639147f0f7d70bdeb87f5a25220d8cdd6e14921cfd415f75c3c5fb6d91c1b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-string-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-crt-string-l1-1-0.dll
        • Size 26KB
        • SHA256 8412ed80499166c05010547faa8897d227852ab64ac346b8474c1ac10089bb32
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-time-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-crt-time-l1-1-0.dll
        • Size 22KB
        • SHA256 339c05aa8b9dea3992a0bb8b0331579c7553d12b68b88732dd0aee6183417db5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-utility-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\api-ms-win-crt-utility-l1-1-0.dll
        • Size 22KB
        • SHA256 3e08f70a0c7c065b58ffdd7256e4327760a980094d5786899a589bb981144954
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base_library.zip

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\base_library.zip
        • Size 1.4MB
        • SHA256 913caa5f95e4b53169e18218651d4900eba38419ab10b7d389803381988325da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libcrypto-1_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libffi-8.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\libffi-8.dll
        • Size 37KB
        • SHA256 68fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libssl-1_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\libssl-1_1.dll
        • Size 686KB
        • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pyexpat.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\pyexpat.pyd
        • Size 193KB
        • SHA256 867012edb8a6acd2131c4698b69bb94e6ba07607035e7c621aaa24262817e55b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python311.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\python311.dll
        • Size 5.5MB
        • SHA256 aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038
        • MD5 SHA1 SHA512 SSDEEP TLSH

        select.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\select.pyd
        • Size 28KB
        • SHA256 813eede996fc08e1c9a6d45aaa4cbae1e82e781d69885680a358b4d818cfc0d4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sqlite3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\sqlite3.dll
        • Size 1.4MB
        • SHA256 2b86d45728aa3def8ee9f3b150b1b5ee89aa26f5ed2b5509c8f9fa1c8b5c7b1b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ucrtbase.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\ucrtbase.dll
        • Size 1.1MB
        • SHA256 6049a5a91ab1c843a6f7d90a8ad492a238d538987b6d06aa20f24ac426a537e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unicodedata.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI41882\unicodedata.pyd
        • Size 1.1MB
        • SHA256 175c4cb528f1ac4e285c575cc3f5e85ec4b3ae88860210b5d795b580c7f0b5d9
        • MD5 SHA1 SHA512 SSDEEP TLSH