06f809fa0703109f2e34862b5614aa607ed8e654498fc31058dc9e4737785f34

Reason

Machine shutdown

General

Target
2026-07-31_25ce8f243b117430fb6379e22d2b6dac_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 8.2MB
Sample260801-afa4rstdje
SHA256 06f809fa0703109f2e34862b5614aa607ed8e654498fc31058dc9e4737785f34
MD5 25ce8f243b117430fb6379e22d2b6dac
SHA1 82dc303860fab155f5ca3f8b338617c3fe7b2155
SHA512 7ed2575477cd6d79cd5d2ee290824398b9ebde51c0651327ca17de437205eef53077274d550bdf3a3a10bb6129d85a735940df0efa64fb70f5e7ade03e0fc72d
SSDEEP 196608:OCNTwhL/76urH3Q3qemdUSCtmk0ax8UoMi6o8M9qgqmz:OPL/2u76mdUSC4axKzw2
TLSH
T14C9623259365745BC15162BA8323DC3960AB3E11FB90D0F28390B5AF1F37B91DFAB291
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 5 IoCs

pid	Process
4792	2026-07-31_25ce8f243b117430fb6379e22d2b6dac_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4792	2026-07-31_25ce8f243b117430fb6379e22d2b6dac_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4792	2026-07-31_25ce8f243b117430fb6379e22d2b6dac_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4792	2026-07-31_25ce8f243b117430fb6379e22d2b6dac_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4792	2026-07-31_25ce8f243b117430fb6379e22d2b6dac_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4300	cmd.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4728	shutdown.exe
Token: SeRemoteShutdownPrivilege	4728	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6104	LogonUI.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 4792	2032	2026-07-31_25ce8f243b117430fb6379e22d2b6dac_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 4792 wrote to memory of 4300	4792	2026-07-31_25ce8f243b117430fb6379e22d2b6dac_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4300 wrote to memory of 4728	4300	cmd.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-07-31_25ce8f243b117430fb6379e22d2b6dac_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_25ce8f243b117430fb6379e22d2b6dac_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\2026-07-31_25ce8f243b117430fb6379e22d2b6dac_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-31_25ce8f243b117430fb6379e22d2b6dac_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c shutdown /s /f /t 0
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\system32\shutdown.exe
      shutdown /s /f /t 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4728

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a21055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20322\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20322\_bz2.pyd
Size 84KB
SHA256 b3dd7cea6d03342252834cebcc814af37d850b86d0627fa22b7f6990882f2f8b
MD5 77294e590d14a22d98862c141e7ea4ae
SHA1 88a64817b0699025fcb1dda533355a0b30bd92bf
SHA512 3dac79115a510fd09d384829ff1b45864c2bd20db34459c5ac84ccb65f2befe5d59e13cc232fa23c77232421886a8eefa8d6b5986199e32d2953fee92dad0abd
SSDEEP 1536:HdsvXm8z7+Cnqncm4WlTtdKSzBdIM8vOBs8iMdIsLVuyEJ7Q9bfIgHX:9svXm8zaYqRptX7IvvOC8hdIsLVyY
TLSH
T1B6837D86F36542B6F99BD1F886800793FB30BB950750A3AFF148C2992F13B916E5C219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20322\_lzma.pyd
Size 155KB
SHA256 f20be6a9fee8fb5d53170c4bc24a39b48d3c0ccbe8e2000e60ff7d65b77c6ea1
MD5 a0e27c2f376dc80dfc3f884963a0f416
SHA1 f2738a7e6dc65cd9b915a33af354d2f04b768712
SHA512 6e0c50e52e48b29098fa3b7614f190ecc84ab12ed3b376e7e7148f84eceb3101b9ea6972f100b5478059f62d90aded0dff8522440728d0c0904d8c70457f734e
SSDEEP 3072:xqZ/boPLmhrKifqGDRJUs0znfB9mNoTvm28fgS+dIs01xMW4Iiy:xeTgLhyvUsq5YOTCfd+E9
TLSH
T178F35C86B794F0D5F7728C38D6628F57E7F5781A0320929A01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI20322\base_library.zip
Size 1.3MB
SHA256 50e6751da684827f3cc38ab4b22be3286a04493040bba8b8e3a51c3cd627e73c
MD5 b103ad7a344984ff8daff8c95d4b78d7
SHA1 ba5bc34eb31ab936e89375ad13bafe5e7657ec34
SHA512 90b6a90149637de2c6993ef07a9737f9a8a0eaebc002f2aae97b9df58f43cd6cba12e19fdf0d9fde406d6d26416f4c8a1b1f716a0b12571ec9e9f46c5d60cde4
SSDEEP 12288:vRJWi3BL+DnuIva80201jwCVRDVoioSYB2tYzGNcT12yCMWfhy66wt7W7WpKcdjq:f2l/SeT1x/7WpNdZcqd5cPPdxhYS1
TLSH
T1F4551992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20322\python313.dll
Size 5.8MB
SHA256 41ec4fc4e5bc8b207258590238f7f050b13fdfee84c4a7b1ecff6e945d031a10
MD5 cfbfd5ca1d563466687e53a638eed93c
SHA1 63bffe9d62dcc870b1601ae7a04b042df88fa219
SHA512 0eb973271a12ff17dc443ee3289695bb2134d66120690d067b3f67b4b52a5ac2831f326fe85635ef43799b43574e4e1809e20db6ae1d32b5e5f4711cfa12df36
SSDEEP 98304:efqPAKrV+hOhkH0pwgJYt5FO8vUHDMiEJV0KL:DPAC+hOhZaic0A
TLSH
T11F568D12729D50ACD97B8078CA178A4BF7B27C113F60434B61E6BB5D2FB33624A6E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20322\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads