Overview

overview

9

Static

static

3

2026-07-19...at.exe

windows10-2004-x64

9

2026-07-19...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    151s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/07/2026, 00:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-19_b6081195e1eca4eb15ffbc2bf50e1dee_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 94.4MB
  • Sample260719-a2na8aa18s
  • SHA256 df07ec2dc15af6f786605296d76969608dcfa986cffee3720a09c829ebefa5c7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasionexecution

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
    defense_evasion
  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_b6081195e1eca4eb15ffbc2bf50e1dee_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-19_b6081195e1eca4eb15ffbc2bf50e1dee_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5984
    • C:\Users\Admin\AppData\Local\Temp\2026-07-19_b6081195e1eca4eb15ffbc2bf50e1dee_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-19_b6081195e1eca4eb15ffbc2bf50e1dee_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Enumerates VirtualBox registry keys
      • Looks for VirtualBox Guest Additions in registry
      • Looks for VMWare Tools registry key
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:256
      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalCache\LockApp.exe
        "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalCache\LockApp.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:5144
        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalCache\LockApp.exe
          "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalCache\LockApp.exe"
          4⤵
          • Enumerates VirtualBox registry keys
          • Looks for VirtualBox Guest Additions in registry
          • Looks for VMWare Tools registry key
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4476
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "$ws = New-Object -ComObject WScript.Shell; $sc = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecurityService.lnk'); $sc.TargetPath = 'C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalCache\LockApp.exe'; $sc.WorkingDirectory = 'C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalCache'; $sc.Save()"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops startup file
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2868
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName""
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:6052
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5000
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x0000000000000508
    1⤵
      PID:2764
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:3292

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            MicrosoftEdgeUpdate.log
            • Path C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.log
            • Size 2KB
            • SHA256 f0690ba9f1e7b4a27af9dcecb3c10eb602722ba66e3b714c09e1fafb5c670615
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MicrosoftEdgeUpdate.log
            • Path C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeUpdate.log
            • Size 4KB
            • SHA256 fafc1b2f38a3e779eb007ac88eeccaf1fa0d4313da6fac6124bb58d8a6e44b27
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            euc-cn.enc
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI51442\_tcl_data\encoding\euc-cn.enc
            • Size 84KB
            • SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __init__.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI51442\cryptography\hazmat\bindings\__init__.py
            • Size 180B
            • SHA256 b3da0a090db2705757a0445d4b58a669fb9e4a406c2fd92f6f27e085a6ae67d6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tcllogo.gif
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI51442\tcl\tk8.6\demos\images\tcllogo.gif
            • Size 2KB
            • SHA256 72f6b34d3c8f424ff0a290a793fcfbf34fd5630a916cd02e0a5dda0144b5957f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            license.terms
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI51442\tcl\tk8.6\demos\license.terms
            • Size 2KB
            • SHA256 0d1e4405f6273f091732764ed89b57066be63ce64869be6c71ea337dc4f2f9b5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            81d243bd2c585b0f4821__mypyc.cp312-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\81d243bd2c585b0f4821__mypyc.cp312-win_amd64.pyd
            • Size 214KB
            • SHA256 52056f4b964f1bc0419064a374a32e56ef85ccb161166971d26f46a7490bd238
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _chacha20.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\Cryptodome\Cipher\_chacha20.pyd
            • Size 13KB
            • SHA256 5736506ad6dc2f3d893b978c8727d74c2f0ae87bbc2fcfcfe8c7e982ea5e86e2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _raw_aes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\Cryptodome\Cipher\_raw_aes.pyd
            • Size 34KB
            • SHA256 889f9b558a47a4333bfd3e3814eaec2328ac8648722d912c7873fdea62fcf886
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _raw_aesni.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\Cryptodome\Cipher\_raw_aesni.pyd
            • Size 15KB
            • SHA256 6c9a2bed5c1bd9acd8bcea7f5f20f7fa63e4465b0914ae70250bd59a8028333c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _raw_ctr.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\Cryptodome\Cipher\_raw_ctr.pyd
            • Size 14KB
            • SHA256 229994e4cb838079a5711c8c0ffeb25fb4684a70ecda497ddb49c8a315594a83
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _raw_ecb.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\Cryptodome\Cipher\_raw_ecb.pyd
            • Size 10KB
            • SHA256 da4eacde396e7388ec5da5133762409757dcdaae3022590a73d9ad950844c31f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _BLAKE2s.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\Cryptodome\Hash\_BLAKE2s.pyd
            • Size 13KB
            • SHA256 88e734c772909ccc7158f54ce8d488bd0b412ebe2e932c5539e07cb6674243cc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ghash_clmul.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\Cryptodome\Hash\_ghash_clmul.pyd
            • Size 12KB
            • SHA256 c8cc9583c2d91d8ef25073e01a863a40c09fa0a89007f8bb0442df46ba26f0e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ghash_portable.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\Cryptodome\Hash\_ghash_portable.pyd
            • Size 12KB
            • SHA256 cd1d79a0d8923c39f7368c92fae0c731ae60ecd34d1c9f387d4824b2af168036
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _poly1305.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\Cryptodome\Hash\_poly1305.pyd
            • Size 13KB
            • SHA256 7f39864610a7e2275d521ee8bed6093b7fefb3256eeec3c1baa3bd800d1bf423
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _cpuid_c.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\Cryptodome\Util\_cpuid_c.pyd
            • Size 10KB
            • SHA256 e7e6f27d5203768e6454b4066847a3af02548c811146da047c4a53b1edaf32e9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _webp.pyi
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\PIL\_webp.pyi
            • Size 66B
            • SHA256 cc3f2f0283c2f1a1085637dc90bb45b24456e6c6a255e977fac254036a476867
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\VCRUNTIME140.dll
            • Size 96KB
            • SHA256 c179d8914ba8e57b2f8f4d6c101c2c550c7c6712a7f0f9920a97db340f9d9574
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _asyncio.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\_asyncio.pyd
            • Size 57KB
            • SHA256 58f76658fe61442fad72d88477b4241218c9fc222e319e74f9ea8d9117de5fd1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\_bz2.pyd
            • Size 71KB
            • SHA256 df94ae2501893150a44ce292edc5dcaa7a41a4e91dcbdf9f25c1a63d01c3cf73
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\_ctypes.pyd
            • Size 112KB
            • SHA256 9a8fbfc0520eda7981973c3799f7dd6fb1a082a35eec26f7172e6c7c0748adcc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\_hashlib.pyd
            • Size 54KB
            • SHA256 c4aa61484a9cf2387d8c5c09a9a4a65c77a297f59b734f7ee5ae22b842f55f18
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\_lzma.pyd
            • Size 145KB
            • SHA256 b191850898bb1863627b2eb9e67d861be2ee5faac9801e9c357ea105af06f56f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _overlapped.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\_overlapped.pyd
            • Size 42KB
            • SHA256 a78149e8ea6a1d0566cc71a41c7723310a20fde360447176730b24a79b87d050
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\_queue.pyd
            • Size 20KB
            • SHA256 ae9a1bb01ad52b18aa5167cc27b368be4904fd1df1a8aef0c65af2da5c4ae962
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\_socket.pyd
            • Size 70KB
            • SHA256 a7a9e7d13ec84aa7456b7cd7cc3efd333b5c24369aa39c7b8d222b663a7c2593
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\_ssl.pyd
            • Size 162KB
            • SHA256 663f8e4c5397bfc39b84d2f7662f97507e180190b4b75e8f16dd202e005c8609
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _uuid.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\_uuid.pyd
            • Size 13KB
            • SHA256 c602b9a0eaf077283ecf5a70520c72e1eb14c7be4093cabd55e1ebde46aae324
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _wmi.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\_wmi.pyd
            • Size 23KB
            • SHA256 89e1878ab2cd166af1bf3c5d14f42e2fc34b7157a5a7d5ed1de086af33a62c43
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\base_library.zip
            • Size 1.2MB
            • SHA256 2c8a79912d46ac32dc51ebd119b21641b0582bb578380ee324ecb12fef83b1e8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cd.cp312-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\charset_normalizer\cd.cp312-win_amd64.pyd
            • Size 10KB
            • SHA256 aec205186ce86077a5f8fb469e924cd5f7e183daed53f9de9362e77f3bf3637f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __init__.pyi
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\cv2\gapi\ot\cpu\__init__.pyi
            • Size 102B
            • SHA256 4e3427bacd8785129b664b26456c7c0a3119a8ba17b8a5c82c1177be2c69fd72
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            libcrypto-3-x64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\libcrypto-3-x64.dll
            • Size 5.6MB
            • SHA256 940c96a4915080b49074b45ceed7a65ed0883c4f283a728cb530dac51cc03ffa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\libffi-8.dll
            • Size 27KB
            • SHA256 18c43f149e1c37467472b5c07ffd8b83520f2cd1640db51a649e326604b0ec51
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-3-x64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\libssl-3-x64.dll
            • Size 910KB
            • SHA256 f6dbfec56213d8e77934c3b9d208c1e5a3b73ac5b0c7d1d58c97682696d5c3ee
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.DLL
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\python3.DLL
            • Size 55KB
            • SHA256 aca908cc46b154774e9f1c6ed9b313c7e15be85b3a938d761295b11d903667a2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python312.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\python312.dll
            • Size 6.5MB
            • SHA256 c62a5beee36607768b308cec6f1ea28f9748c8405cc7538ecdc55c19d7ddfaef
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\select.pyd
            • Size 18KB
            • SHA256 420482596633a22509af8c192dbdacca24bc8ad51d447aa13179e948410512a1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59842\unicodedata.pyd
            • Size 1.1MB
            • SHA256 9ff8a39048a39c5738d6512645a2024fd5aa55b66f3b874180a76fee349d206b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_hq202ugv.gv4.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hq202ugv.gv4.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/2868-9658-0x000001D5AF900000-0x000001D5AF922000-memory.dmp
            Download

            memory/5000-9680-0x0000015D46FC0000-0x0000015D47072000-memory.dmp
            Download

            memory/5000-9679-0x0000015D46FA0000-0x0000015D46FBE000-memory.dmp
            Download

            memory/5000-9682-0x0000015D47080000-0x0000015D4708A000-memory.dmp
            Download

            memory/5000-9683-0x0000015D47210000-0x0000015D4723A000-memory.dmp
            Download

            memory/5000-9684-0x0000015D47210000-0x0000015D47234000-memory.dmp
            Download