Overview

overview

10

Static

static

3

2026-08-02...at.exe

windows10-2004-x64

10

2026-08-02...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 14:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_04d1182444dd47e2a3df613f093ad6d9_blankgrabber_icedid_luca-stealer_njrat.exe
  • Size 6.4MB
  • Sample260802-sbmacabf79
  • SHA256 a7c328a4652be5963ec28a4ade76e3406a8930a865ea97c13e3df724bf94fabe
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
  • Disables RegEdit via registry modification 2 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
    persistence
  • Loads dropped DLL 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
    stealer
  • Modifies registry class 12 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_04d1182444dd47e2a3df613f093ad6d9_blankgrabber_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_04d1182444dd47e2a3df613f093ad6d9_blankgrabber_icedid_luca-stealer_njrat.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4320
    • C:\Users\Admin\AppData\Local\Temp\2026-08-02_04d1182444dd47e2a3df613f093ad6d9_blankgrabber_icedid_luca-stealer_njrat.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-02_04d1182444dd47e2a3df613f093ad6d9_blankgrabber_icedid_luca-stealer_njrat.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visibility of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Event Triggered Execution: Image File Execution Options Injection
      • Loads dropped DLL
      • Adds Run key to start application
      • Modifies Internet Explorer start page
      • Suspicious use of WriteProcessMemory
      PID:8
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "MicrosoftEdgeUpdateTaskwTuI" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-02_04d1182444dd47e2a3df613f093ad6d9_blankgrabber_icedid_luca-stealer_njrat.exe" /sc onlogon /delay 0001:00 /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1868
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "MicrosoftEdgeUpdateTaskwTuI" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-02_04d1182444dd47e2a3df613f093ad6d9_blankgrabber_icedid_luca-stealer_njrat.exe" /sc onlogon /delay 0001:00 /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4392
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_04d1182444dd47e2a3df613f093ad6d9_blankgrabber_icedid_luca-stealer_njrat.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-02_04d1182444dd47e2a3df613f093ad6d9_blankgrabber_icedid_luca-stealer_njrat.exe
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1920
    • C:\Users\Admin\AppData\Local\Temp\2026-08-02_04d1182444dd47e2a3df613f093ad6d9_blankgrabber_icedid_luca-stealer_njrat.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-02_04d1182444dd47e2a3df613f093ad6d9_blankgrabber_icedid_luca-stealer_njrat.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visibility of hidden/system files in Explorer
      • Disables RegEdit via registry modification
      • Event Triggered Execution: Image File Execution Options Injection
      • Loads dropped DLL
      • Adds Run key to start application
      • Modifies Internet Explorer start page
      • Suspicious use of WriteProcessMemory
      PID:4548
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "MicrosoftEdgeUpdateTaskhFjZ" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-02_04d1182444dd47e2a3df613f093ad6d9_blankgrabber_icedid_luca-stealer_njrat.exe" /sc onlogon /delay 0001:00 /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3908
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "MicrosoftEdgeUpdateTaskhFjZ" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-02_04d1182444dd47e2a3df613f093ad6d9_blankgrabber_icedid_luca-stealer_njrat.exe" /sc onlogon /delay 0001:00 /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:3808

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Command Shell

        1
        T1059.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Image File Execution Options Injection

        1
        T1546.012

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Image File Execution Options Injection

        1
        T1546.012

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Hide Artifacts

        2
        T1564

        Hidden Files and Directories

        2
        T1564.001

        Modify Registry

        4
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        2
        T1012

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4320_020925_W5M_X-S8xLo\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4320_020925_W5M_X-S8xLo\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4320_020925_W5M_X-S8xLo\_bz2.pyd
        • Size 84KB
        • SHA256 76a33e2baa3880aa46290cc7d5810b3155c5e2f5a1cc7d3f7b751f6434144ada
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4320_020925_W5M_X-S8xLo\_ctypes.pyd
        • Size 131KB
        • SHA256 75687620596877b0dde462e74ae12140d695b3c78df3c6c099d55717768dde42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4320_020925_W5M_X-S8xLo\_lzma.pyd
        • Size 155KB
        • SHA256 f221ed5f1c2789aa357f3c2dc4cd22af134b4b91acb3fb78f9fa5f7f9a7b62e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        huibh87h.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4320_020925_W5M_X-S8xLo\huibh87h.dll
        • Size 6.4MB
        • SHA256 404e56ce3afaa24a59525451aea2076a9ab49e0cda4de9a12e1a6d52c1af176b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4320_020925_W5M_X-S8xLo\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4320_020925_W5M_X-S8xLo\python313.dll
        • Size 5.8MB
        • SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4320_020925_W5M_X-S8xLo\pywintypes313.dll
        • Size 133KB
        • SHA256 ea82e185e0bed58485a8df23712b62224f5e486dbb84d946115cad17512065cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4320_020925_W5M_X-S8xLo\win32api.pyd
        • Size 135KB
        • SHA256 040d6a9ce12555d2585f89dce2aa4e25265c27dfa827eb9cae4c922e12ec731c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32evtlog.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4320_020925_W5M_X-S8xLo\win32evtlog.pyd
        • Size 75KB
        • SHA256 842db19e698bfef74cb030025dff516cee8848339ca89eae9bdc15a15172219c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Login Data
        • Path C:\Users\Admin\AppData\Roaming\Google\Chrome\User Data\Default\Login Data
        • Size 83B
        • SHA256 afa038db9372923aadf784d48dd86b596a3e1e03f7637eb2a51fa220f8d87313
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Local State
        • Path C:\Users\Admin\AppData\Roaming\Google\Chrome\User Data\Local State
        • Size 75B
        • SHA256 35e7dbd11ec1d0b51b18cc7b9c8bc71efe49d1be2d6c1988a48c48a0900d74fe
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        svchost.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Caches\svchost.exe
        • Size 160B
        • SHA256 5317189a339400617caa7c6b8b6c7e0ebb23a029360d103e40d754a140d442a6
        • MD5 SHA1 SHA512 TLSH
        Submit Download