37c77413edee1ae24a886a85f8dc33ca78ffda4d0310798e2f730e77022209f8

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 22:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_a5e62c58e441008f9df6792790749eab_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 7.7MB
Sample260730-17gnqs1wex
SHA256 37c77413edee1ae24a886a85f8dc33ca78ffda4d0310798e2f730e77022209f8
MD5 a5e62c58e441008f9df6792790749eab
SHA1 76fb1e0a261617c691028490a314bf05886e5d66
SHA512 63d1cd438fba31afce409338e499f64d1b69bcb45cc832e6f72c7ffbf010c82f6799296ab36c6742d669d0798ba46e68fb835cb3294a499e116310b9186ca48f
SSDEEP 196608:xRRMkXMCHGLLc54i1wN+KV0cSXl74w41CT+qM881Zl16:fRtXMCHWUjyVg74wnMR6
TLSH
T12486335CA9A015B7FAF3923DDAE1D52AE330B8691F72C9D343E082972F531D4583A352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
4752	2026-07-30_a5e62c58e441008f9df6792790749eab_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4752	2026-07-30_a5e62c58e441008f9df6792790749eab_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4752	2026-07-30_a5e62c58e441008f9df6792790749eab_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4752	2026-07-30_a5e62c58e441008f9df6792790749eab_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4752	2026-07-30_a5e62c58e441008f9df6792790749eab_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4204	powershell.exe
4672	powershell.exe
3592	powershell.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1196	cmd.exe
480	cmd.exe
1072	cmd.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
4204	powershell.exe
4204	powershell.exe
4204	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	3592	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4752	4364	2026-07-30_a5e62c58e441008f9df6792790749eab_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	91
PID 4752 wrote to memory of 1196	4752	2026-07-30_a5e62c58e441008f9df6792790749eab_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 1196 wrote to memory of 4204	1196	cmd.exe	93
PID 4752 wrote to memory of 480	4752	2026-07-30_a5e62c58e441008f9df6792790749eab_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 480 wrote to memory of 4672	480	cmd.exe	95
PID 4752 wrote to memory of 1072	4752	2026-07-30_a5e62c58e441008f9df6792790749eab_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	96
PID 1072 wrote to memory of 3592	1072	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-07-30_a5e62c58e441008f9df6792790749eab_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_a5e62c58e441008f9df6792790749eab_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_a5e62c58e441008f9df6792790749eab_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a5e62c58e441008f9df6792790749eab_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -Command "start "" /min /wait "C:\path\to\your\file.exe"""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "start "" /min /wait "C:\path\to\your\file.exe""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -Command "Get-ComputerInfo | Format-List Name, Version, OS -WrapAll""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "Get-ComputerInfo | Format-List Name, Version, OS -WrapAll"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -Command "start "" /min /wait "C:\path\to\your\file.exe"""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -Command "start "" /min /wait "C:\path\to\your\file.exe""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 dd3e23a0f38b25911578eda470771eb68400755c8504293e7bb61cbabc292edb
MD5 2a7f0eccaee20513a16764423f163550
SHA1 2972523df4833d1cdc797fe524f30e99e4ddf991
SHA512 fd3d165f6261a85de8b1a35ab03027d0c7f9162e2cb60e6f2e5e2e392b02b92bb3dd013ff8751417e7127bc919d93a915c81d7a1a3048545959471419e3270ad
TLSH
T17B215733F3CC8624C89A413650CEAC1036B687DB419ECF6BBB84D154A43F599DF61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 eee9b4cfddcd92252ee49424c5ba436be577b510f290ce83797e1709a7f55a32
MD5 113f79d4fe28129d0415c818fa6d499c
SHA1 49463c25adf3e775245b24d76f3d3ae90016318d
SHA512 faf630a2e47a033226ebeff047c44fe1c2a59a75f88192dfadc9a25a5ef349058bbaee6cca6c4afbb66a2d5e03817397244808f2b43c66ab89a975d3b294c419
TLSH
T116218933B3CC8614CC8A403A10CEAC1036B6C7DB809ECFABBB84D544A42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\VCRUNTIME140.dll
Size 117KB
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
TLSH
T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\_bz2.pyd
Size 84KB
SHA256 5ba872caa7fcee0f4fb81c6e0201ceed9bd92a3624f16828dd316144d292a869
MD5 057325e89b4db46e6b18a52d1a691caa
SHA1 8eab0897d679e223aa0d753f6d3d2119f4d72230
SHA512 6bc7606869ca871b7ee5f2d43ec52ed295fa5c3a7df31dbd7e955ddb98c0748aff58d67f09d82edcde9d727e662d1550c6a9cf82f9cb7be021159d4b410e7cbc
SSDEEP 1536:IEfz7lgmVLsSIX0qku0Spf72hbktdj8Z8spLFIDLVe7yo47Q9M/fITjNO:5fz1IX8FS12itdAZvpLFIDLVekY1O
TLSH
T15D839E86F79567F2F45B81B686C103A7E771BA91031093AFF258C2552F03F816E6C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\_lzma.pyd
Size 155KB
SHA256 6f48e7eba363cb67f3465a6c91b5872454b44fc30b82710dfa4a4489270ce95c
MD5 3e73bc69efb418e76d38be5857a77027
SHA1 7bee01096669caa7bec81cdc77d6bb2f2346608c
SHA512 b6850e764c8849058488f7051dcabff096709b002d2f427a49e83455838d62a9d3fc7b65285702de2b995858ed433e35a0c4da93c2d5ae34684bf624eb59fa6a
SSDEEP 3072:rn18fe1+/ol6s/7NjQWzjaZ1/om6znfB9mNoUr8RJP4V0FID01QGp5f:r0s0Ef6gJ5YOUwrP4V0IGL
TLSH
T128F35B86A394F0E5F7728C78D6624F57E7F5781A0320928A01CC976D2B1FB659E2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\base_library.zip
Size 1.3MB
SHA256 4d28bb9bfa3f99b9dd6b7d75e29b4cd0ffd90a450607256562227a7cc0c3fd86
MD5 9d0e879d8744799b9ac531f2af8a3a39
SHA1 a4cacf5aa26207fff1a74e2dea62114eee0b5be3
SHA512 a3e0196c7c43d69f6bf8c4657724f96718b57a1e55d099daef80b5a58bb23c5389c9296109aff35a856b689209a4a63e3f73f06f974936ac64f06c80999956ee
SSDEEP 12288:FnytYzGNcT1IA+uOBa80201jwCVRDVoioSYBKW7WpG6Hi2cPPdxhY5ihJpW1djdP:FTSeT1OzT7Wpd5cPPdxhYeJMdZThB
TLSH
T149550992B9527953FF54F37B80B7484CF32E86A2EF00C207355A42661FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\python313.dll
Size 5.8MB
SHA256 bf68cf819a1e865170430c10e91c18b427aef88db1da1742020443864aa2b749
MD5 501080884bed38cb8801a307c9d7b7b4
SHA1 881b250cc8f4fa4f75111ac557a4fde8e1e217af
SHA512 63d74a4871d1c72c2a79ae8a5d380070f9d2128c16949c3ad36c9862fcc4dab738137ed3d51caf0bc46b36655f8bd8a2d425d68200123415ee8d4de0e1cbebc9
SSDEEP 98304:zS6EtadqkkJdwHSVi0gB+zmvHHDMiEVWI4SS:zt0aMdwNOizI4
TLSH
T17F568C16729D00ACD97B8078CA038A4BF7B27C017F60534BA1E6BB5D2F737624A6E745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI43642\ucrtbase.dll
Size 1.1MB
SHA256 048d4c5a51e45777ba15facdaddbf7702594a2268e8de1768ab0f5f4e4d7e733
MD5 05f2140c1a8a139f2e9866aa2c3166f1
SHA1 9170cff11f3b91f552ac09a186a3bae7ea7cda25
SHA512 bdc7daf31fa9261967cab58c928fe5146b53c96f9b7c702ae8ee761b2652702d9f34dabf4252b7b580311d6dd4d2914ea7721296bebcea3344006eaa0f99f2ed
SSDEEP 24576:kJG9DZM19A7ieC9dQ8dDtLV8+BaC6EOx/cEz5RmxvSZX0ypHNH:v/qtvdhq+BaPHxxd
TLSH
T1C7359E28B75C02AAD97BE17CC923550AF973380147709ACB03A74BB93E277E916B7311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_dy21z53t.won.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dy21z53t.won.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4204-68-0x00007FFEBE960000-0x00007FFEBF304000-memory.dmp

Download

memory/4204-67-0x00007FFEBE960000-0x00007FFEBF304000-memory.dmp

Download

memory/4204-69-0x00007FFEBE960000-0x00007FFEBF304000-memory.dmp

Download

memory/4204-70-0x00007FFEBE960000-0x00007FFEBF304000-memory.dmp

Download

memory/4204-71-0x00007FFEBE960000-0x00007FFEBF304000-memory.dmp

Download

memory/4204-72-0x00007FFEBE960000-0x00007FFEBF304000-memory.dmp

Download

memory/4204-73-0x00007FFEBE960000-0x00007FFEBF304000-memory.dmp

Download

memory/4204-74-0x00007FFEBE960000-0x00007FFEBF304000-memory.dmp

Download

memory/4204-76-0x00007FFEBE960000-0x00007FFEBF304000-memory.dmp

Download

memory/4204-77-0x00007FFEBE960000-0x00007FFEBF304000-memory.dmp

Download

memory/4204-66-0x000001CEB3E70000-0x000001CEB3E92000-memory.dmp

Download

memory/4204-63-0x00007FFEBE960000-0x00007FFEBF304000-memory.dmp

Download

memory/4204-62-0x00007FFEBEAEF000-0x00007FFEBEAF0000-memory.dmp

Download