Overview

overview

10

Static

static

3

2026-07-19...at.exe

windows10-2004-x64

10

2026-07-19...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 01:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-19_87950cd5820bf5e778ce8e86d0a7143f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 97.0MB
  • Sample260720-bfkhwadv6v
  • SHA256 53d52d184f5fc53ef915e747d927a93be523d0adcf2ce905057fc4ad03638ac7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 47 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_87950cd5820bf5e778ce8e86d0a7143f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-19_87950cd5820bf5e778ce8e86d0a7143f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2772
    • C:\Users\Admin\AppData\Local\Temp\2026-07-19_87950cd5820bf5e778ce8e86d0a7143f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-19_87950cd5820bf5e778ce8e86d0a7143f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:1400

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\PyQt5\Qt5\bin\MSVCP140.dll
        • Size 576KB
        • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\PyQt5\Qt5\bin\MSVCP140_1.dll
        • Size 30KB
        • SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\PyQt5\Qt5\bin\Qt5Core.dll
        • Size 5.7MB
        • SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\PyQt5\Qt5\bin\VCRUNTIME140_1.dll
        • Size 43KB
        • SHA256 1f0f5f2ce671e0f68cf96176721df0e5e6f527c8ca9cfa98aa875b5a3816d460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\PyQt5\QtCore.pyd
        • Size 2.4MB
        • SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\PyQt5\sip.cp314-win_amd64.pyd
        • Size 119KB
        • SHA256 0ee0860feae243b7cb46a86d0ab577ac353ec5bab2d0c5ab1125a72e39fcd144
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\_bz2.pyd
        • Size 84KB
        • SHA256 5453a58bbb460be785a298830c64e11b1334a9c26f1b9b0af2b491ff5da8ac4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\_ctypes.pyd
        • Size 137KB
        • SHA256 16e834e926e08bc184f929240436f74d9adad701247d72d5e8a32297aa4030eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\_hashlib.pyd
        • Size 66KB
        • SHA256 3e53e3fbd2d853b6fa642436385415be27fd0f9ff2f59bce0b6b08309104e661
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\_lzma.pyd
        • Size 156KB
        • SHA256 63ef6ee710321cf8492f9f225d3d18c99794b7e40851785649ae5e17e2461720
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\_queue.pyd
        • Size 34KB
        • SHA256 242f53d3b9b98de0a161f153238346b1a099618828b626181a16abf6fdd2025f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\_socket.pyd
        • Size 85KB
        • SHA256 a18ab26c7b36b7e1e905ccf66e64998ec97cf8d10b9b3b0ee4e7a9f216e4f703
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\_sqlite3.pyd
        • Size 129KB
        • SHA256 a48f6d5161f277c451546e4a45ba58e53f63c58736491ae6c9a8fb8cafadd118
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\_ssl.pyd
        • Size 179KB
        • SHA256 1830bc614fd2aaddf6014d03c9cbfd2b899c1b8148a9ff5c58ce5d669c01bb6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\_uuid.pyd
        • Size 27KB
        • SHA256 d43e4804909b84466d6e7c0f673e2f0d9465521678d38e5dd535c3a5046a793f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\_wmi.pyd
        • Size 39KB
        • SHA256 b71747109d88ba22d99d08a1dd2ee006620b4b38f61cfa92dbaa6814c18e70dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\_zstd.pyd
        • Size 490KB
        • SHA256 5aa97046006c1a3ea2164ed373074a02399826481b13cd4286ac9bc3d01df092
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\base_library.zip
        • Size 1.3MB
        • SHA256 29735ba36fe6dd5572ad901f0e7dd08dbd649a913466e932e65200088dac07a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\charset_normalizer\md.cp314-win_amd64.pyd
        • Size 10KB
        • SHA256 084309ccfe0cc72d881d57aa8520da89c9e69ea219bfe80de2036b16d977d03a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\charset_normalizer\md__mypyc.cp314-win_amd64.pyd
        • Size 122KB
        • SHA256 4a1e2cfe2647f5564ab0040f4d899b1dbb1edaa6bc98b85341230e5f8aa160c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\libssl-3.dll
        • Size 776KB
        • SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\python3.DLL
        • Size 71KB
        • SHA256 156c5aca2d43320f6c4fa501becfa3d4b1251983881783c1ce29645a9a8b445f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\python314.dll
        • Size 6.4MB
        • SHA256 fa173b946772926fbece65f0761da70410bffc1a75dc6a2086fcdc8ec6551f31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\select.pyd
        • Size 31KB
        • SHA256 629d56f251138fec4c43b0ddd87b85656dbbb6eceb933cc593f4654683f21ca6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\sqlite3.dll
        • Size 1.5MB
        • SHA256 73ed10f1fc96f793c52f7f78e4c5dd9ec9365305df0b1a4241824b1e201af8dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\ucrtbase.dll
        • Size 1.1MB
        • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\unicodedata.pyd
        • Size 739KB
        • SHA256 b4e3cb48e6a979e69f200351871c001bec6429eb7d044b5a69ce22f314b15dcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32crypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI27722\win32\win32crypt.pyd
        • Size 122KB
        • SHA256 61cc3cdd8a543b7cbbcab2ba0f5d1202008711786f713a9f5c49789d738f3dc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gmail_accounts.json
        • Path C:\Users\Admin\AppData\Local\Temp\tmp8p4noa3g\gmail_accounts.json
        • Size 2B
        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
        • MD5 SHA1 SHA512
        Submit Download

        memory/1400-1245-0x00007FFA4C080000-0x00007FFA4C2E3000-memory.dmp
        Download