Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 19:34
General
- Target 2026-07-30_268e7c6d0ddfae28a5e62c4275a42704_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 12.5MB
- Sample260730-yabecaee76
- SHA256 77f79d6900e919b9e76f4d0c8383cc9f54681209eb1054ce302ecd2a229735a7
Malware Config
Signatures
- Loads dropped DLL 26 IoCs
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_268e7c6d0ddfae28a5e62c4275a42704_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_268e7c6d0ddfae28a5e62c4275a42704_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_268e7c6d0ddfae28a5e62c4275a42704_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_268e7c6d0ddfae28a5e62c4275a42704_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\tasklist.exetasklist /fo csv3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c rem3⤵
- Executes a command shell one-liner
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_imaging.cp313-win_amd64.pyd
_imagingft.cp313-win_amd64.pyd
_imagingmath.cp313-win_amd64.pyd
_webp.cp313-win_amd64.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
base_library.zip
browser.html
browser2.html
cf.html
idp.html
md.html
mde.html
msg.html
rups.html
shares.html
splash.html
svcs.html
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
_speedups.cp313-win_amd64.pyd
pyexpat.pyd
python313.dll
select.pyd
sqlite3.dll
memory/1576-199-0x00007FF813520000-0x00007FF813545000-memory.dmp
memory/1576-204-0x00007FF810E90000-0x00007FF810EC9000-memory.dmp
memory/1576-170-0x00007FF811D70000-0x00007FF811DBE000-memory.dmp
memory/1576-169-0x00007FF805C10000-0x00007FF806143000-memory.dmp
memory/1576-175-0x00007FF805590000-0x00007FF8057AB000-memory.dmp
memory/1576-174-0x00007FF8186D0000-0x00007FF8186DE000-memory.dmp
memory/1576-121-0x00007FF816F70000-0x00007FF816F96000-memory.dmp
memory/1576-178-0x00007FF812C30000-0x00007FF812C3E000-memory.dmp
memory/1576-163-0x00007FF816F00000-0x00007FF816F15000-memory.dmp
memory/1576-155-0x00007FF8159C0000-0x00007FF8159CD000-memory.dmp
memory/1576-164-0x00007FF813090000-0x00007FF81309B000-memory.dmp
memory/1576-185-0x00007FF816EB0000-0x00007FF816EBB000-memory.dmp
memory/1576-186-0x00007FF810F00000-0x00007FF810F33000-memory.dmp
memory/1576-127-0x00007FF816F50000-0x00007FF816F68000-memory.dmp
memory/1576-188-0x00007FF80C4A0000-0x00007FF80C56D000-memory.dmp
memory/1576-116-0x00007FF806150000-0x00007FF8067BD000-memory.dmp
memory/1576-161-0x00007FF80A710000-0x00007FF80A899000-memory.dmp
memory/1576-200-0x00007FF810ED0000-0x00007FF810EF4000-memory.dmp
memory/1576-171-0x00007FF8057B0000-0x00007FF805A3F000-memory.dmp
memory/1576-123-0x00007FF818790000-0x00007FF81879E000-memory.dmp
memory/1576-181-0x00007FF810F40000-0x00007FF810FAE000-memory.dmp
memory/1576-158-0x00007FF813520000-0x00007FF813545000-memory.dmp
memory/1576-129-0x00007FF816F20000-0x00007FF816F4A000-memory.dmp
memory/1576-150-0x00007FF816F70000-0x00007FF816F96000-memory.dmp
memory/1576-151-0x00007FF816EB0000-0x00007FF816EBB000-memory.dmp
memory/1576-146-0x00007FF806150000-0x00007FF8067BD000-memory.dmp
memory/1576-147-0x00007FF816ED0000-0x00007FF816EDC000-memory.dmp
memory/1576-144-0x00007FF816EE0000-0x00007FF816EFA000-memory.dmp
memory/1576-133-0x00007FF816F00000-0x00007FF816F15000-memory.dmp
memory/1576-140-0x00007FF8186D0000-0x00007FF8186DE000-memory.dmp
memory/1576-135-0x00007FF805C10000-0x00007FF806143000-memory.dmp
memory/1576-226-0x00007FF8057B0000-0x00007FF805A3F000-memory.dmp
memory/1576-227-0x00007FF805590000-0x00007FF8057AB000-memory.dmp
memory/1576-228-0x00007FF806150000-0x00007FF8067BD000-memory.dmp
memory/1576-252-0x00007FF810F40000-0x00007FF810FAE000-memory.dmp
memory/1576-241-0x00007FF80A710000-0x00007FF80A899000-memory.dmp
memory/1576-248-0x00007FF810F00000-0x00007FF810F33000-memory.dmp
memory/1576-240-0x00007FF813520000-0x00007FF813545000-memory.dmp