Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
30/07/2026, 19:34
General
- Target 2026-07-30_268e7c6d0ddfae28a5e62c4275a42704_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 12.5MB
- Sample260730-yabecaee76
- SHA256 77f79d6900e919b9e76f4d0c8383cc9f54681209eb1054ce302ecd2a229735a7
Malware Config
Signatures
- Loads dropped DLL 26 IoCs
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_268e7c6d0ddfae28a5e62c4275a42704_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_268e7c6d0ddfae28a5e62c4275a42704_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_268e7c6d0ddfae28a5e62c4275a42704_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_268e7c6d0ddfae28a5e62c4275a42704_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\tasklist.exetasklist /fo csv3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c rem3⤵
- Executes a command shell one-liner
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_imaging.cp313-win_amd64.pyd
_imagingft.cp313-win_amd64.pyd
_imagingmath.cp313-win_amd64.pyd
_webp.cp313-win_amd64.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
_zoneinfo.pyd
base_library.zip
browser.html
browser2.html
cf.html
mini-fa.woff
idp.html
md.html
mde.html
msg.html
rups.html
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
_speedups.cp313-win_amd64.pyd
pyexpat.pyd
python313.dll
select.pyd
sqlite3.dll
unicodedata.pyd
memory/4552-169-0x00007FFBE74D0000-0x00007FFBE74DD000-memory.dmp
memory/4552-223-0x00007FFBEC970000-0x00007FFBEC97E000-memory.dmp
memory/4552-129-0x00007FFBE78D0000-0x00007FFBE78FA000-memory.dmp
memory/4552-176-0x00007FFBD8F60000-0x00007FFBD91EF000-memory.dmp
memory/4552-174-0x00007FFBEAC00000-0x00007FFBEAC18000-memory.dmp
memory/4552-126-0x00007FFBEAC00000-0x00007FFBEAC18000-memory.dmp
memory/4552-118-0x00007FFBD9CB0000-0x00007FFBDA31D000-memory.dmp
memory/4552-166-0x00007FFBE7290000-0x00007FFBE72B5000-memory.dmp
memory/4552-188-0x00007FFBD8CD0000-0x00007FFBD8D3E000-memory.dmp
memory/4552-167-0x00007FFBD91F0000-0x00007FFBD9379000-memory.dmp
memory/4552-168-0x00007FFBE74C0000-0x00007FFBE74CB000-memory.dmp
memory/4552-148-0x00007FFBE79C0000-0x00007FFBE79D5000-memory.dmp
memory/4552-152-0x00007FFBEC970000-0x00007FFBEC97E000-memory.dmp
memory/4552-155-0x00007FFBE7810000-0x00007FFBE782A000-memory.dmp
memory/4552-157-0x00007FFBEA990000-0x00007FFBEA99C000-memory.dmp
memory/4552-150-0x00007FFBD9770000-0x00007FFBD9CA3000-memory.dmp
memory/4552-123-0x00007FFBEAC20000-0x00007FFBEAC46000-memory.dmp
memory/4552-172-0x00007FFBDFA20000-0x00007FFBDFA6E000-memory.dmp
memory/4552-222-0x00007FFBD8590000-0x00007FFBD85B4000-memory.dmp
memory/4552-221-0x00007FFBD8550000-0x00007FFBD8589000-memory.dmp
memory/4552-220-0x00007FFBD8BC0000-0x00007FFBD8C8D000-memory.dmp
memory/4552-219-0x00007FFBD9770000-0x00007FFBD9CA3000-memory.dmp
memory/4552-186-0x00007FFBE79C0000-0x00007FFBE79D5000-memory.dmp
memory/4552-185-0x00007FFBD8C90000-0x00007FFBD8CC3000-memory.dmp
memory/4552-184-0x00007FFBE74B0000-0x00007FFBE74BE000-memory.dmp
memory/4552-182-0x00007FFBD8D40000-0x00007FFBD8F5B000-memory.dmp
memory/4552-122-0x00007FFBEE990000-0x00007FFBEE99E000-memory.dmp
memory/4552-165-0x00007FFBE7540000-0x00007FFBE754B000-memory.dmp
memory/4552-164-0x00007FFBD9CB0000-0x00007FFBDA31D000-memory.dmp
memory/4552-224-0x00007FFBE7290000-0x00007FFBE72B5000-memory.dmp
memory/4552-225-0x00007FFBD91F0000-0x00007FFBD9379000-memory.dmp
memory/4552-226-0x00007FFBD8F60000-0x00007FFBD91EF000-memory.dmp
memory/4552-251-0x00007FFBD8C90000-0x00007FFBD8CC3000-memory.dmp
memory/4552-227-0x00007FFBD9CB0000-0x00007FFBDA31D000-memory.dmp