Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/08/2026, 00:09
Behavioral task
behavioral1
Sample
2026-07-31_249769ba93f302f746f7ff327ed508ff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_249769ba93f302f746f7ff327ed508ff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-07-31_249769ba93f302f746f7ff327ed508ff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 7.0MB
- Sample260801-aflkhatdkf
- SHA256 e5a135da47f45186fccf6e6f8b36466d2f4aca0892ba9d903a66f798db29a928
- MD5 249769ba93f302f746f7ff327ed508ff
- SHA1 17e9933535f1d16c6044ab3c0c49ec1ef4f0ccbf
- SHA512 92145ecd7bebfcde8059695fa1f798256f7958b06c96010a30d30e9727383d45ad693b6f245ec6d0c9f762460bcded791ec2fa941dcd30c28a8a5fef39986a25
- SSDEEP 196608:2jaXMCHGLLc54i1wN+9PIcu9KYK39sI3PP6/MyRccx:kaXMCHWUjCcuI3/P6/H
- TLSH T17976335866E012FEEAB3403CEDE1A1A1D96878760771CACB43E49B527E532E04C3D757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 8 IoCs
pid Process 1076 2026-07-31_249769ba93f302f746f7ff327ed508ff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 1076 2026-07-31_249769ba93f302f746f7ff327ed508ff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 1076 2026-07-31_249769ba93f302f746f7ff327ed508ff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 1076 2026-07-31_249769ba93f302f746f7ff327ed508ff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 1076 2026-07-31_249769ba93f302f746f7ff327ed508ff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 1076 2026-07-31_249769ba93f302f746f7ff327ed508ff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 1076 2026-07-31_249769ba93f302f746f7ff327ed508ff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 1076 2026-07-31_249769ba93f302f746f7ff327ed508ff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3604 wrote to memory of 1076 3604 2026-07-31_249769ba93f302f746f7ff327ed508ff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_249769ba93f302f746f7ff327ed508ff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_249769ba93f302f746f7ff327ed508ff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\2026-07-31_249769ba93f302f746f7ff327ed508ff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_249769ba93f302f746f7ff327ed508ff_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
PID:1076
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\VCRUNTIME140.dll
- Size 117KB
- SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
- MD5 862f820c3251e4ca6fc0ac00e4092239
- SHA1 ef96d84b253041b090c243594f90938e9a487a9a
- SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
- SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
- TLSH T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\_bz2.pyd
- Size 82KB
- SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
- MD5 cb8c06c8fa9e61e4ac5f22eebf7f1d00
- SHA1 d8e0dfc8127749947b09f17c8848166bac659f0d
- SHA512 e6da642b7200bfb78f939f7d8148581259baa9a5edda282c621d14ba88083a9b9bd3d17b701e9cde77ad1133c39bd93fc9d955bb620546bb4fcf45c68f1ec7d6
- SSDEEP 1536:Kdrz7l1EVLsSuvX3dUK4MLgqK7YEog8y5sV8lIJLVy7SyFB:urzcuvXvrEo7y6V8lIJLVyB
- TLSH T16F838E42E3A56AF5F86B80B956C10367E771B954075093EFF348C2693F02F426DAC36A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\_decimal.pyd
- Size 271KB
- SHA256 b715d1c18e9a9c1531f21c02003b4c6726742d1a2441a1893bc3d79d7bb50e91
- MD5 f3377f3de29579140e2bbaeefd334d4f
- SHA1 b3076c564dbdfd4ca1b7cc76f36448b0088e2341
- SHA512 34d9591590bba20613691a5287ef329e5927a58127ce399088b4d68a178e3af67159a8fc55b4fcdcb08ae094753b20dec2ac3f0b3011481e4ed6f37445cecdd5
- SSDEEP 6144:x9iD78EIq4x4OA5bZZ0KDgQcI79qWM53pLW1AFR8E4wXw76TPlpV77777VMvyk:xwDGqr5b8EgQ5+w6k
- TLSH T138446A57A2490CA4EE73807889579B47E7F27C860360D38F43A48AA77F93393676E744
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\_hashlib.pyd
- Size 62KB
- SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
- MD5 32d76c9abd65a5d2671aeede189bc290
- SHA1 0d4440c9652b92b40bb92c20f3474f14e34f8d62
- SHA512 49dc391f4e63f4ff7d65d6fd837332745cc114a334fd61a7b6aa6f710b235339964b855422233fac4510ccb9a6959896efe880ab24a56261f78b2a0fd5860cd9
- SSDEEP 768:eNJI0DWiflFwY9X3Th1JnptE462TxNvdbj4dIJvI75YiSyvE62Em:2LDxflFwY9XDhPfVNv+dIJvIF7Syc6c
- TLSH T1F5536C01A68080A4C96782B8D9934F5BE6F2F5415791ABDF0318C1CD1F23BC3DAFA796
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\_lzma.pyd
- Size 154KB
- SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
- MD5 1ba022d42024a655cf289544ae461fb8
- SHA1 9772a31083223ecf66751ff3851d2e3303a0764c
- SHA512 2b888a2d7467e29968c6bb65af40d4b5e80722ffdda760ad74c912f3a2f315d402f3c099fde82f00f41de6c9faaedb23a643337eb8821e594c567506e3464c62
- SSDEEP 3072:KbbS4R/G4Z8r7NjwJTSUqCRY4By7znfB9mNowgn0lCelIJ012+j:KbR/8oWeBi5YOwflCe8o
- TLSH T1B9F34982A794F4E5F7728C78D6624F17E7F5781A032092DA01CC876D2B1FB659E2A313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\_socket.pyd
- Size 81KB
- SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
- MD5 fe896371430bd9551717ef12a3e7e818
- SHA1 e2a7716e9ce840e53e8fc79d50a77f40b353c954
- SHA512 67ecd9a07df0a07edd010f7e3732f3d829f482d67869d6bce0c9a61c24c0fdc5ff4f4e4780b9211062a6371945121d8883ba2e9e2cf8eb07b628547312dfe4c9
- SSDEEP 1536:XuV3gvWHQdMq3ORC/OypTXQlyJ+9+nzEYwsBI6tzOKuZIJywJ7Sy21:XuVQvcQTSypTXQlyJs+nzEYJI6QlZIJY
- TLSH T141836C11A69050FADFB3C0B5C5675E23FBB4F4801395979F0166C66A1F33382BE7AA81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\base_library.zip
- Size 1.3MB
- SHA256 5920a3ec37a5e4647a3aa5326accae6e73d9153fe8a58c84d6310d24c953e723
- MD5 3b908f1871985c8426aa0a52ee6d1e98
- SHA1 a3c40cadad5068a6dcb2c97fb1403d3549e9758e
- SHA512 90b9445c72cdf8a5a6b4688070dcd4c0fffacf838c74141e84ca39626a27c70eabfa9aa5b292a1d093e77aa5bd824d9a3b71a55c4c65a11de8830a259b764766
- SSDEEP 12288:cNLeGQbZi2cPudx5/p6BIZNuOBg80201jwCVRDVoioSYBWUTHS91loL+DlaY6RXl:gHaZ5cPudx5/ZRJSHuddCtR7Wpuy
- TLSH T1D7551A92B9527953FF14F37B80B7484CF32E86A2EF00C207355A42661FFEAB49D59588
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\libcrypto-3.dll
- Size 5.0MB
- SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
- MD5 123ad0908c76ccba4789c084f7a6b8d0
- SHA1 86de58289c8200ed8c1fc51d5f00e38e32c1aad5
- SHA512 80fae0533ba9a2f5fa7806e86f0db8b6aab32620dde33b70a3596938b529f3822856de75bddb1b06721f8556ec139d784bc0bb9c8da0d391df2c20a80d33cb04
- SSDEEP 98304:/V+Qs2NuR5YV0L8PQ1CPwDvt3uFlDC4SC9c:9rs2NuDYV0L841CPwDvt3uFlDC4SCa
- TLSH T11A367B6AA7A80189E4BAC13CC9534617D2B1F81A17B097CF19A1967D0F37FDA2B3D740
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\pyodbc.cp313-win_amd64.pyd
- Size 132KB
- SHA256 95c7c55808c06ab066a8d848e77ae819f53ce468869aaeb8110f79161460f0c5
- MD5 6973524f87b6098136d37a21f0424ee6
- SHA1 3335e5a1602618c50b6ca8177bc28d51d56c8fd5
- SHA512 87abf1b0a4a1e3b8ec1a8b044a44797fde7efb56ed7deb016c5349c42f166749dafcee31b0795242a299da562fad802c95fee851a27365a3e7748ca743296e26
- SSDEEP 3072:BgRSF/pZ40eIbAkS/KVm5KJOl7FjFZ9l8IDv3Oe1LvQjWMEMb:mwZ40e/keNd8IDvnVvQjWKb
- TLSH T150D34A1BF29101A3D94395B0C8B3A943E7F1B410732293DFA6A4C7552F17BE2AEBD641
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\python313.dll
- Size 5.8MB
- SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
- MD5 b9de917b925dd246b709bb4233777efd
- SHA1 775f258d8b530c6ea9f0dd3d1d0b61c1948c25d2
- SHA512 f4bf3398f50fdd3ab7e3f02c1f940b4c8b5650ed7af16c626ccd1b934053ba73a35f96da03b349c1eb614bb23e0bc6b5cc58b07b7553a5c93c6d23124f324a33
- SSDEEP 49152:fXGc3O7T4DKX+vLFMmKYxiAYNBD987KdJlI9HbeX2jrgQcw6Zc4h67mM+XDQ3bLi:Of42zJiwJl/YF7v3vaHDMiEN3Kr
- TLSH T1E9568D16729D40ADC97B8078CA038A4BF7B27C417F60534B61A6BB5E2F733624B6E705
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\select.pyd
- Size 30KB
- SHA256 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
- MD5 20831703486869b470006941b4d996f2
- SHA1 28851dfd43706542cd3ef1b88b5e2749562dfee0
- SHA512 4aaf5d66d2b73f939b9a91e7eddfeb2ce2476c625586ef227b312230414c064aa850b02a4028363aa4664408c9510594754530a6d026a0a84be0168d677c1bc4
- SSDEEP 384:7hhxm9tKLhuoNHfzzlvFy0ZZIJ9GckHQIYiSy1pCQ4HWSJIVE8E9VF0Ny6sC:tCytHf98uZIJ9Gx5YiSyvy2ES
- TLSH T1A7D28E47AF605846D923C972A8E28F26ED35B752875082CF3268C15D0F627C27B7B3E5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\unicodedata.pyd
- Size 693KB
- SHA256 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
- MD5 0902d299a2a487a7b0c2d75862b13640
- SHA1 04bcbd5a11861a03a0d323a8050a677c3a88be13
- SHA512 8cbef5a9f2d24da1014f8f1ccbddd997a084a0b04dd56bcb6ac38ddb636d05ef7e4ea7f67a085363aad3f43d45413914e55bdef14a662e80be955e6dfc2feca3
- SSDEEP 12288:FYGdLI/X77mvfldCKGihH32W3cnPSqrUgLIe:FYGW7qNxr3cnPXLIe
- TLSH T1F9E4F6D5BBCF8D26E69B363A48E3710F5171C2735F0A863BB2182361D85B3B449D582E
- MD5 SHA1 SHA512 SSDEEP TLSH