Analysis
- max time kernel
150s - max time network
102s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 21:54
Behavioral task
behavioral1
Sample
2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260710-en
2 signatures
150 seconds
General
- Target 2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 8.2MB
- Sample260718-1saa4sgx21
- SHA256 12c6f22dad90f785fcaa3b3251a485c8385a367a8802903235612afae2a12f91
- MD5 24f4c45b276d3aeb99684e4dd428a761
- SHA1 adbc3d434d018fd736d2106c57d91f366534a290
- SHA512 7d9b5329095083d9eb2294373ca79a418dcd3f106139ae55ce2c10a63009a2cad4b9a4aa9bd2b4f6a7c20765b352caeda552c29aa9f08a0ccba75450c89f86eb
- SSDEEP 196608:yXnVWTeXMCHGLLc54i1wN+wV0cSXl74w41CT+qHP8PZlnmnA6:snkyXMCHWUjYVg74wnHkJ6
- TLSH T19786334CA6A026B6F5F3917DC9A2D52AE734B8691F72C9D353E042A33E231D46C3D352
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 14 IoCs
pid Process 3468 2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3468 2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3468 2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3468 2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3468 2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3468 2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3468 2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3468 2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3468 2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3468 2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3468 2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3468 2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3468 2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3468 2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 6048 wrote to memory of 3468 6048 2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:6048 -
C:\Users\Admin\AppData\Local\Temp\2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_24f4c45b276d3aeb99684e4dd428a761_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
PID:3468
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI60482\VCRUNTIME140.dll
- Size 117KB
- SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
- MD5 862f820c3251e4ca6fc0ac00e4092239
- SHA1 ef96d84b253041b090c243594f90938e9a487a9a
- SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
- SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
- TLSH T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI60482\_bz2.pyd
- Size 84KB
- SHA256 5ba872caa7fcee0f4fb81c6e0201ceed9bd92a3624f16828dd316144d292a869
- MD5 057325e89b4db46e6b18a52d1a691caa
- SHA1 8eab0897d679e223aa0d753f6d3d2119f4d72230
- SHA512 6bc7606869ca871b7ee5f2d43ec52ed295fa5c3a7df31dbd7e955ddb98c0748aff58d67f09d82edcde9d727e662d1550c6a9cf82f9cb7be021159d4b410e7cbc
- SSDEEP 1536:IEfz7lgmVLsSIX0qku0Spf72hbktdj8Z8spLFIDLVe7yo47Q9M/fITjNO:5fz1IX8FS12itdAZvpLFIDLVekY1O
- TLSH T15D839E86F79567F2F45B81B686C103A7E771BA91031093AFF258C2552F03F816E6C36A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI60482\_ctypes.pyd
- Size 131KB
- SHA256 199cd8d7db743c316771ef7bbf414ba9a9cdae1f974e90da6103563b2023538d
- MD5 2185849bc0423f6641ee30804f475478
- SHA1 d37ca3e68f4b2111fc0c0cead9695d598795c780
- SHA512 ba89db9f265a546b331482d779ab30131814e42ad3711a837a3450f375d2910bd41b3b3258db90b29cd5afccdc695318fc8ad8cd921a57ce25f69aea539b26ee
- SSDEEP 3072:gt2Y/2//P+H9SUNn8LBBhc5Nvf/FH3ofTvaZIDyPn3f2:gst/GH9SUCBIf/FH3ITire
- TLSH T1BDD36C0B775840AADAA78174C533AF47EBB1B453165053CF02A8C69A2F637D7AE3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI60482\_hashlib.pyd
- Size 63KB
- SHA256 14765e83996fe6d50aedc11bb41d7c427a3e846a6a6293a4a46f7ea7e3f14148
- MD5 cf4120bad9a7f77993dd7a95568d83d7
- SHA1 ac477c046d14c5306aa09bb65015330701ef0f89
- SHA512 f905f9d203f86a7b1fc81be3aba51a82174411878c53fd7a62d17f8e26f5010d195f9371fa7400e2e2dc35fda0db0cbe68367fcaf834dd157542e9ee7a9742b6
- SSDEEP 1536:jLDxflFwY9XDhWjLTNwjg40nEdIDvI/7yo47Q9LfIi7K:jJ92AT63Nag40nEdIDvI/EF
- TLSH T1BE538C44A29480A6CA6742B4CAE39F87F6B1F2425740ABDF0354C1CD1F237C3D6BA75A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI60482\_lzma.pyd
- Size 155KB
- SHA256 6f48e7eba363cb67f3465a6c91b5872454b44fc30b82710dfa4a4489270ce95c
- MD5 3e73bc69efb418e76d38be5857a77027
- SHA1 7bee01096669caa7bec81cdc77d6bb2f2346608c
- SHA512 b6850e764c8849058488f7051dcabff096709b002d2f427a49e83455838d62a9d3fc7b65285702de2b995858ed433e35a0c4da93c2d5ae34684bf624eb59fa6a
- SSDEEP 3072:rn18fe1+/ol6s/7NjQWzjaZ1/om6znfB9mNoUr8RJP4V0FID01QGp5f:r0s0Ef6gJ5YOUwrP4V0IGL
- TLSH T128F35B86A394F0E5F7728C78D6624F57E7F5781A0320928A01CC976D2B1FB659E2B313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI60482\_socket.pyd
- Size 82KB
- SHA256 8daefaff53e6956f5aea5279a7c71f17d8c63e2b0d54031c3b9e82fcb0fb84db
- MD5 69c4a9a654cf6d1684b73a431949b333
- SHA1 3c8886dac45bb21a6b11d25893c83a273ff19e0b
- SHA512 cadcec9a6688b54b36dbd125210d1a742047167dad308907a3c4e976b68483a8c6144e02d5cf26f887744dc41af63b7731551287bb3ef8bd947c38c277783c16
- SSDEEP 1536:quV3gvWHQdMq3ORCnOypTAQlyJ+9+nztYwsFF6t7lCuZIDywN7yo47Q9EfIb5:quVQvcQTqypTAQlyJs+nztYtF6ntZIDv
- TLSH T17F836B01A69041FAEBA3C1B5C2679E23FB74F5C11395975F00A6C55A1F333C2AF3AA81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI60482\_ssl.pyd
- Size 178KB
- SHA256 21ca71b2c1766fc68734cb3d1e7c2c0439b86bcfb95e00b367c5fd48c59e617c
- MD5 ce19076f6b62292ed66fd06e5ba67bba
- SHA1 231f6236bdbbe95c662e860d46e56e42c4e3fe28
- SHA512 7357598bc63195c2fd2ddde0376b3ecf5bd0211a286f4a5c1e72e8c68b6e881e7e617f561e7a859c800fe67bec8f4c376e7a6943cab8dacfeda0056b8e864143
- SSDEEP 3072:A20jYjQ80NV96LE2fU6CosjLEmMPi1ba+VRJNI7IM/H9o/PCrXuII4oFIDL7Riz:500rklqU6CoJ9PijTT4o8W
- TLSH T134047C47B5805AF7D913E4F9C2234903EBB0F155331157DE48D6EA890F03B4AAE6AB63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI60482\base_library.zip
- Size 1.3MB
- SHA256 f1877ae0d3c315ef505eeba6c0f2fcdfb5f9d00e9d3b8e7906857fad0fe8b668
- MD5 15a6c40f84db56fdb19a26fb33be3af1
- SHA1 b2a3705c0dd950c1353a77d7e0fc857fc3a566e3
- SHA512 e7080085da8dc25135294ef80eb196bfab34950ee26803c3826e2909bb61d10995f98821a0d56735c20c416cf30fdb33ef6c7f9e3b4353b0ed99a461fd5df0c6
- SSDEEP 12288:Si4Rn6iuOBa80201jwCVRDVoioSYBc2HQtYzGNcT1Gn4i2cPPdxhYhdjdT3am6Rg:UzVxSeT1G45cPPdxhYhdZAJ17WpOK
- TLSH T1C7550992B9527953FF54F37B80B7484CF32E86A2EF00C207355A42661FFE6B09E59588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI60482\libcrypto-3.dll
- Size 5.0MB
- SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
- MD5 123ad0908c76ccba4789c084f7a6b8d0
- SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
- SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
- SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
- TLSH T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI60482\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI60482\libssl-3.dll
- Size 774KB
- SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
- MD5 4ff168aaa6a1d68e7957175c8513f3a2
- SHA1 782f886709febc8c7cebcec4d92c66c4d5dbcf57
- SHA512 c372b759b8c7817f2cbb78eccc5a42fa80bdd8d549965bd925a97c3eebdce0335fbfec3995430064dead0f4db68ebb0134eb686a0be195630c49f84b468113e3
- SSDEEP 12288:7LN1sdyIzHHZp5c3nlUa6lxzAG11rbmFe9Xbv:7LgfzH5I3nlUa2AU2Fe9Xbv
- TLSH T108F44BADB3B8059CD8B6C17D86934623E3B6F4553330EBEB06518A790F277D51B3A248
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI60482\python313.dll
- Size 5.8MB
- SHA256 bf68cf819a1e865170430c10e91c18b427aef88db1da1742020443864aa2b749
- MD5 501080884bed38cb8801a307c9d7b7b4
- SHA1 881b250cc8f4fa4f75111ac557a4fde8e1e217af
- SHA512 63d74a4871d1c72c2a79ae8a5d380070f9d2128c16949c3ad36c9862fcc4dab738137ed3d51caf0bc46b36655f8bd8a2d425d68200123415ee8d4de0e1cbebc9
- SSDEEP 98304:zS6EtadqkkJdwHSVi0gB+zmvHHDMiEVWI4SS:zt0aMdwNOizI4
- TLSH T17F568C16729D00ACD97B8078CA038A4BF7B27C017F60534BA1E6BB5D2F737624A6E745
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI60482\select.pyd
- Size 31KB
- SHA256 baee284995b22d495fd12fa8378077e470978db1522c61bfb9af37fb827f33d1
- MD5 2663e22900ab5791c6687a264473ae1e
- SHA1 d8db587b6c632200ae13be880cc824cdc8390df9
- SHA512 5f29ff4288b9db33976f5f79b9fd07c4900a560bb41fe98c93a33da7a36c0981ffd71f460e81e13e4f6a2debafa6d9284bc1a728734752ba5ad5fbd766659e80
- SSDEEP 768:yCyfHfPpZZID9GaQ+Eyobo+Y7N2Ip4S66Cxf1mlY6Cr:yCyf/PpZZID9Gj7yo47Q9S+fIir
- TLSH T1CBE27C8F6A785087EA93C6B181A2DE43FC39B793861182CF30A5D59D0E537C1B73A359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI60482\ucrtbase.dll
- Size 1.1MB
- SHA256 048d4c5a51e45777ba15facdaddbf7702594a2268e8de1768ab0f5f4e4d7e733
- MD5 05f2140c1a8a139f2e9866aa2c3166f1
- SHA1 9170cff11f3b91f552ac09a186a3bae7ea7cda25
- SHA512 bdc7daf31fa9261967cab58c928fe5146b53c96f9b7c702ae8ee761b2652702d9f34dabf4252b7b580311d6dd4d2914ea7721296bebcea3344006eaa0f99f2ed
- SSDEEP 24576:kJG9DZM19A7ieC9dQ8dDtLV8+BaC6EOx/cEz5RmxvSZX0ypHNH:v/qtvdhq+BaPHxxd
- TLSH T1C7359E28B75C02AAD97BE17CC923550AF973380147709ACB03A74BB93E277E916B7311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI60482\unicodedata.pyd
- Size 694KB
- SHA256 a67eec238162fde20ac24ca7df931792734aad0611be22d1b3a71bc15acf72f3
- MD5 c0b4c55ce3711af914b2015f707e4452
- SHA1 f1c1e9f8a461cfee1199d2100f5c0796733518b6
- SHA512 fa6bd9223898ef0c54ca9a67b10207bfce152eadbaec4c91d4e951d0790f455066f5095ed739fa2452aea1420d154beb00bfa9e6e10b46bed687c5d0d7484900
- SSDEEP 12288:6YidLI/X77mvfldCKGihH32W3cnPSqrUgLiE:6YiW7qNxr3cnPXLiE
- TLSH T185E4F5D9BBCF8D26E69B363948E3710F5171C3735F0A863AB2182361D85B3B449D582E
- MD5 SHA1 SHA512 SSDEEP TLSH