Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 02:25
General
- Target 2026-07-20_ee5a8f944620b253ca723b85f0997ae0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 22.5MB
- Sample260720-cwp9qscv8k
- SHA256 878a83eefd32b60c83e0339cf9ac5a3fc341ddaee001429f623d2798249dc440
Malware Config
Signatures
- Loads dropped DLL 61 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_ee5a8f944620b253ca723b85f0997ae0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_ee5a8f944620b253ca723b85f0997ae0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_ee5a8f944620b253ca723b85f0997ae0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_ee5a8f944620b253ca723b85f0997ae0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\ipconfig.exeipconfig3⤵
- Gathers network information
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\SYSTEM32\ipconfig.exeipconfig3⤵
- Gathers network information
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_compression.pyc
_ctypes.pyd
_lzma.pyd
_weakrefset.pyc
ast.pyc
bz2.pyc
__init__.pyc
abc.pyc
contextlib.pyc
copyreg.pyc
__init__.pyc
_endian.pyc
util.pyc
dis.pyc
__init__.pyc
aliases.pyc
cp1252.pyc
utf_8.pyc
enum.pyc
fnmatch.pyc
functools.pyc
__init__.pyc
_abc.pyc
inspect.pyc
ipaddress.pyc
keyword.pyc
libffi-8.dll
linecache.pyc
lzma.pyc
INSTALLER
opcode.pyc
operator.pyc
pathlib.pyc
pkgutil.pyc
python3.DLL
python312.dll
__init__.pyc
_casefix.pyc
_compiler.pyc
_constants.pyc
_parser.pyc
reprlib.pyc
shutil.pyc
subprocess.pyc
threading.pyc
token.pyc
tokenize.pyc
types.pyc
__init__.pyc
parse.pyc
warnings.pyc
weakref.pyc
__init__.pyc
__init__.pyc
glob.pyc
api_requests.json
warworm_run.log
warworm_run.log
memory/2316-1420-0x00007FFEF0AA0000-0x00007FFEF0ADB000-memory.dmp
memory/2316-1453-0x00007FFEF11C0000-0x00007FFEF11CC000-memory.dmp
memory/2316-1409-0x00007FFEFC230000-0x00007FFEFC23F000-memory.dmp
memory/2316-1408-0x00007FFEFC240000-0x00007FFEFC24D000-memory.dmp
memory/2316-1406-0x00007FFEFC260000-0x00007FFEFC279000-memory.dmp
memory/2316-1407-0x00007FFEFC250000-0x00007FFEFC25D000-memory.dmp
memory/2316-1410-0x00007FFEFC1D0000-0x00007FFEFC1E4000-memory.dmp
memory/2316-1411-0x00007FFEE53F0000-0x00007FFEE5AB2000-memory.dmp
memory/2316-1412-0x00007FFEE4EB0000-0x00007FFEE53E3000-memory.dmp
memory/2316-1413-0x00007FFEFC2E0000-0x00007FFEFC305000-memory.dmp
memory/2316-1414-0x00007FFEF76D0000-0x00007FFEF7703000-memory.dmp
memory/2316-1415-0x00007FFEF0630000-0x00007FFEF06FE000-memory.dmp
memory/2316-1418-0x00007FFEF93A0000-0x00007FFEF93B8000-memory.dmp
memory/2316-1419-0x00007FFEF9390000-0x00007FFEF939B000-memory.dmp
memory/2316-1404-0x00007FFEFC280000-0x00007FFEFC2AC000-memory.dmp
memory/2316-1421-0x00007FFEF88A0000-0x00007FFEF88AB000-memory.dmp
memory/2316-1422-0x00007FFEE7CA0000-0x00007FFEE7DBA000-memory.dmp
memory/2316-1424-0x00007FFEF76A0000-0x00007FFEF76CE000-memory.dmp
memory/2316-1423-0x00007FFEFC230000-0x00007FFEFC23F000-memory.dmp
memory/2316-1425-0x00007FFEFC1D0000-0x00007FFEFC1E4000-memory.dmp
memory/2316-1426-0x00007FFEE78B0000-0x00007FFEE796C000-memory.dmp
memory/2316-1428-0x00007FFEF05A0000-0x00007FFEF05CB000-memory.dmp
memory/2316-1427-0x00007FFEE4EB0000-0x00007FFEE53E3000-memory.dmp
memory/2316-1431-0x00007FFEF76D0000-0x00007FFEF7703000-memory.dmp
memory/2316-1432-0x00007FFEE49C0000-0x00007FFEE4C43000-memory.dmp
memory/2316-1434-0x00007FFEEDFE0000-0x00007FFEEE009000-memory.dmp
memory/2316-1433-0x00007FFEF0630000-0x00007FFEF06FE000-memory.dmp
memory/2316-1435-0x00007FFEF93A0000-0x00007FFEF93B8000-memory.dmp
memory/2316-1436-0x00007FFEF7B20000-0x00007FFEF7B2B000-memory.dmp
memory/2316-1437-0x00007FFEF75F0000-0x00007FFEF7602000-memory.dmp
memory/2316-1439-0x00007FFEF7B10000-0x00007FFEF7B1C000-memory.dmp
memory/2316-1438-0x00007FFEF0AA0000-0x00007FFEF0ADB000-memory.dmp
memory/2316-1440-0x00007FFEEDFB0000-0x00007FFEEDFD4000-memory.dmp
memory/2316-1442-0x00007FFEE7050000-0x00007FFEE71CF000-memory.dmp
memory/2316-1441-0x00007FFEE7CA0000-0x00007FFEE7DBA000-memory.dmp
memory/2316-1444-0x00007FFEEDF80000-0x00007FFEEDFAB000-memory.dmp
memory/2316-1443-0x00007FFEF76A0000-0x00007FFEF76CE000-memory.dmp
memory/2316-1446-0x00007FFEF74D0000-0x00007FFEF74DB000-memory.dmp
memory/2316-1445-0x00007FFEE78B0000-0x00007FFEE796C000-memory.dmp
memory/2316-1448-0x00007FFEF6EF0000-0x00007FFEF6EFB000-memory.dmp
memory/2316-1447-0x00007FFEF05A0000-0x00007FFEF05CB000-memory.dmp
memory/2316-1449-0x00007FFEE49C0000-0x00007FFEE4C43000-memory.dmp
memory/2316-1450-0x00007FFEF6EE0000-0x00007FFEF6EEC000-memory.dmp
memory/2316-1452-0x00007FFEF3980000-0x00007FFEF398B000-memory.dmp
memory/2316-1451-0x00007FFEEDFE0000-0x00007FFEEE009000-memory.dmp
memory/2316-1380-0x00007FFEFC2B0000-0x00007FFEFC2C9000-memory.dmp
memory/2316-1454-0x00007FFEF0A90000-0x00007FFEF0A9B000-memory.dmp
memory/2316-1455-0x00007FFEF0590000-0x00007FFEF059C000-memory.dmp
memory/2316-1457-0x00007FFEF0580000-0x00007FFEF058D000-memory.dmp
memory/2316-1456-0x00007FFEEDFB0000-0x00007FFEEDFD4000-memory.dmp
memory/2316-1459-0x00007FFEEFEA0000-0x00007FFEEFEAE000-memory.dmp
memory/2316-1458-0x00007FFEE7050000-0x00007FFEE71CF000-memory.dmp
memory/2316-1461-0x00007FFEEFAD0000-0x00007FFEEFADC000-memory.dmp
memory/2316-1462-0x00007FFEEFAC0000-0x00007FFEEFACC000-memory.dmp
memory/2316-1460-0x00007FFEEDF80000-0x00007FFEEDFAB000-memory.dmp
memory/2316-1464-0x00007FFEEE9B0000-0x00007FFEEE9BB000-memory.dmp
memory/2316-1465-0x00007FFEEE760000-0x00007FFEEE76C000-memory.dmp
memory/2316-1466-0x00007FFEEE4E0000-0x00007FFEEE4EC000-memory.dmp
memory/2316-1468-0x00007FFEEDEF0000-0x00007FFEEDF02000-memory.dmp
memory/2316-1467-0x00007FFEEE440000-0x00007FFEEE44D000-memory.dmp
memory/2316-1469-0x00007FFEEE270000-0x00007FFEEE27C000-memory.dmp
memory/2316-1463-0x00007FFEEEAF0000-0x00007FFEEEAFB000-memory.dmp
memory/2316-1470-0x00007FFEE40F0000-0x00007FFEE49B3000-memory.dmp
memory/2316-1471-0x00007FFEEC2C0000-0x00007FFEEC2F6000-memory.dmp
memory/2316-1472-0x00007FFEEDD30000-0x00007FFEEDD46000-memory.dmp
memory/2316-1473-0x00007FFEEBFE0000-0x00007FFEEBFF2000-memory.dmp
memory/2316-1474-0x00007FFEE7C70000-0x00007FFEE7C9C000-memory.dmp
memory/2316-1475-0x00007FFEE7850000-0x00007FFEE78A2000-memory.dmp
memory/2316-1476-0x00007FFEE77E0000-0x00007FFEE784B000-memory.dmp
memory/2316-1477-0x00007FFEEE1D0000-0x00007FFEEE1DC000-memory.dmp
memory/2316-1478-0x00007FFEE7000000-0x00007FFEE7044000-memory.dmp
memory/2316-1376-0x00007FFEFC2D0000-0x00007FFEFC2DF000-memory.dmp
memory/2316-1354-0x00007FFEFC2E0000-0x00007FFEFC305000-memory.dmp
memory/2316-1341-0x00007FFEE53F0000-0x00007FFEE5AB2000-memory.dmp
memory/2316-1827-0x00007FFEE40F0000-0x00007FFEE49B3000-memory.dmp
memory/2316-1865-0x00007FFEEC2C0000-0x00007FFEEC2F6000-memory.dmp
memory/2316-1875-0x00007FFEFC240000-0x00007FFEFC24D000-memory.dmp
memory/2316-1881-0x00007FFEF93A0000-0x00007FFEF93B8000-memory.dmp
memory/2316-1880-0x00007FFEF0630000-0x00007FFEF06FE000-memory.dmp
memory/2316-1868-0x00007FFEE53F0000-0x00007FFEE5AB2000-memory.dmp
memory/2316-1878-0x00007FFEE4EB0000-0x00007FFEE53E3000-memory.dmp
memory/2316-1879-0x00007FFEF76D0000-0x00007FFEF7703000-memory.dmp
memory/2316-1869-0x00007FFEFC2E0000-0x00007FFEFC305000-memory.dmp
memory/2316-1889-0x00007FFEE7850000-0x00007FFEE78A2000-memory.dmp
memory/2316-1890-0x00007FFEE77E0000-0x00007FFEE784B000-memory.dmp
memory/2316-1891-0x00007FFEE7000000-0x00007FFEE7044000-memory.dmp
memory/2316-1892-0x00007FFEE53F0000-0x00007FFEE5AB2000-memory.dmp
memory/2316-1913-0x00007FFEE53F0000-0x00007FFEE5AB2000-memory.dmp
memory/2316-1939-0x00007FFEE53F0000-0x00007FFEE5AB2000-memory.dmp
memory/2316-1984-0x00007FFEE53F0000-0x00007FFEE5AB2000-memory.dmp