Overview

overview

7

Static

static

3

2026-08-01...at.exe

windows10-2004-x64

7

2026-08-01...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    87s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 01:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_2ceb9818f841a08cc98e8d0f79eb3fe4_blankgrabber_icedid_luca-stealer_njrat.exe
  • Size 55.4MB
  • Sample260802-bfnwasbj51
  • SHA256 19ce3fa050a0ca5fcae961e1e1bd31d93f12c6ab7e1ac987258256648ccfaade
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 42 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_2ceb9818f841a08cc98e8d0f79eb3fe4_blankgrabber_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_2ceb9818f841a08cc98e8d0f79eb3fe4_blankgrabber_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4316
    • C:\Users\Admin\AppData\Local\Temp\2026-08-01_2ceb9818f841a08cc98e8d0f79eb3fe4_blankgrabber_icedid_luca-stealer_njrat.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-01_2ceb9818f841a08cc98e8d0f79eb3fe4_blankgrabber_icedid_luca-stealer_njrat.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      PID:6016

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\MSVCP140.dll
        • Size 544KB
        • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\MSVCP140_2.dll
        • Size 273KB
        • SHA256 3ea06f0ee098b4823cb79599df3780e7f23cce52c19aac31d2a0d47efe33a5e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imaging.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\PIL\_imaging.pyd
        • Size 2.2MB
        • SHA256 b0a0bc66a68ac7dfa2343d904563e644de76d0ac14aff0ca87804351977b0c43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\PyQt6\QtCore.pyd
        • Size 2.5MB
        • SHA256 91dd5166110b88a4f4d3acda6fe6c10ed699882dd3602328a59e9f656cc766b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\PyQt6\QtGui.pyd
        • Size 2.2MB
        • SHA256 cf5ae37fd119fb29a53f1f2cea1362fdf036d940191be45d83da0f98ce8752b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\PyQt6\QtWidgets.pyd
        • Size 4.8MB
        • SHA256 4f81361816e94e1ae05f178085b22d5b9b19e417713b1966dd481a4017aa3b21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\PyQt6\sip.pyd
        • Size 110KB
        • SHA256 b3712a5326b899ba794082ad173f9b0cd0fce3a14de53f524b8c94c86d2d431d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\Qt6Core.dll
        • Size 10.0MB
        • SHA256 37fde8ebd11b474b806a1cf8d4564780dc51afdad3ac3611cd0aa92982f73687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 96b445dd611f30a3e3b938d981c2b13009d65294f48a8ac5f53dde8037132b53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\Qt6Widgets.dll
        • Size 6.3MB
        • SHA256 48deb69896f3185c8fe21221262670591ddc0ce9e7f2182be682e9f28208f7a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TirsosOVERLAY2_1_0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\TirsosOVERLAY2_1_0.dll
        • Size 38.4MB
        • SHA256 67fcae2ff0106e2ab6b21034be3dfea7312fb12b3063cde3ac60c0404016fcb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\VCRUNTIME140.dll
        • Size 96KB
        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\_asyncio.pyd
        • Size 62KB
        • SHA256 aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _brotli.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\_brotli.pyd
        • Size 836KB
        • SHA256 06fb0d9d73fe3ba17a06293f7294d409a0d2db8228f580389039a0837b141b5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\_bz2.pyd
        • Size 81KB
        • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\_hashlib.pyd
        • Size 62KB
        • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\_lzma.pyd
        • Size 154KB
        • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\_queue.pyd
        • Size 30KB
        • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\_socket.pyd
        • Size 76KB
        • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\_ssl.pyd
        • Size 155KB
        • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\certifi\cacert.pem
        • Size 274KB
        • SHA256 b1cdd2d665758ef49d08f40ea13e1a826e5f0412e9e0940c921ed1021464cdc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\libssl-1_1.dll
        • Size 686KB
        • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\msvcp140_1.dll
        • Size 35KB
        • SHA256 bfad5aef4c63a669e3c140655cdfdf395b6c979b400a447bd5dcb65ed8826c3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\python3.dll
        • Size 64KB
        • SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\python311.dll
        • Size 5.5MB
        • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UNR.png
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\rank_icons\UNR.png
        • Size 4KB
        • SHA256 aa1993073895d9ef7644131c439a1e9200fec8df601bc20198d7e9831cfb7d92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rl_hud_debug.log
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\rl_hud_debug.log
        • Size 996B
        • SHA256 9a64cf0427117ce42b6acfbbab749cbe78a72210caeb74ed121eae17e0a8d514
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\select.pyd
        • Size 28KB
        • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\unicodedata.pyd
        • Size 1.1MB
        • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\vcruntime140_1.dll
        • Size 37KB
        • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        backend_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4316_554064_VirQg9-Zbo4\zstandard\backend_c.pyd
        • Size 507KB
        • SHA256 6ab611c4a24406d9d97f09d49d50142ab2734b69a2b0d9ea6489e4af90c4a2a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/6016-542-0x00007FFB14BC0000-0x00007FFB14DF9000-memory.dmp
        Download

        memory/6016-539-0x00007FFB14E00000-0x00007FFB1508F000-memory.dmp
        Download

        memory/6016-534-0x00007FFB163D0000-0x00007FFB16A1A000-memory.dmp
        Download

        memory/6016-533-0x00007FFB16A20000-0x00007FFB16EFB000-memory.dmp
        Download