Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 18:24

General

  • Target
    2026-08-03_3ebabaa9a9e0fbf2ad6b79e31a295f4b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 11.6MB
  • Sample260803-w17jcswalg
  • SHA256 5e25eaadd4fa4c628833767f9a0b6f83e0e03e2551b0271cad0b0091533a8f5f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 22 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_3ebabaa9a9e0fbf2ad6b79e31a295f4b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_3ebabaa9a9e0fbf2ad6b79e31a295f4b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:852
    • C:\Users\Admin\AppData\Local\Temp\2026-08-03_3ebabaa9a9e0fbf2ad6b79e31a295f4b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-03_3ebabaa9a9e0fbf2ad6b79e31a295f4b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5240
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:4972

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\VCRUNTIME140.dll
        • Size 95KB
        • SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VCRUNTIME140_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\VCRUNTIME140_1.dll
        • Size 36KB
        • SHA256 34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _asyncio.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\_asyncio.pyd
        • Size 63KB
        • SHA256 a9a99a2b847e46c0efce7fcfefd27f4bce58baf9207277c17bffd09ef4d274e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _bz2.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\_bz2.pyd
        • Size 81KB
        • SHA256 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _cffi_backend.cp310-win_amd64.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\_cffi_backend.cp310-win_amd64.pyd
        • Size 174KB
        • SHA256 4f1ce205c2be986c9d38b951b6bcb6045eb363e06dacc069a41941f80be9068c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _ctypes.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\_ctypes.pyd
        • Size 120KB
        • SHA256 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _lzma.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\_lzma.pyd
        • Size 154KB
        • SHA256 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-console-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-console-l1-1-0.dll
        • Size 11KB
        • SHA256 2afbfa1d77969d0f4cee4547870355498d5c1da81d241e09556d0bd1d6230f8c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-datetime-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-datetime-l1-1-0.dll
        • Size 11KB
        • SHA256 77577f35d3a61217ea70f21398e178f8749455689db52a2b35a85f9b54c79638
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-debug-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-debug-l1-1-0.dll
        • Size 11KB
        • SHA256 45e48320abe6e3c6079f3f6b84636920a367989a88f9ba6847f88c210d972cf1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-errorhandling-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 11KB
        • SHA256 accdd7455fb6d02fe298b987ad412e00d0b8e6f5fb10b52826367e7358ae1187
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-file-l1-1-0.dll
        • Size 14KB
        • SHA256 7cb0396229c3da434482a5ef929d3a2c392791712242c9693f06baa78948ef66
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-file-l1-2-0.dll
        • Size 11KB
        • SHA256 7a3c5167731238cf262f749aa46ab3bfb2ae1b22191b76e28e1d7499d28c24b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l2-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-file-l2-1-0.dll
        • Size 11KB
        • SHA256 349a79fa1572e3538dfbb942610d8c47d03e8a41b98897bc02ec7e897d05237e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-handle-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-handle-l1-1-0.dll
        • Size 11KB
        • SHA256 c78a1217f8dcb157d1a66b80348da48ebdbbedcea1d487fc393191c05aad476d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-heap-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-heap-l1-1-0.dll
        • Size 11KB
        • SHA256 2e981ee04f35c0e0b7c58282b70dcc9fc0318f20f900607dae7a0d40b36e80af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-interlocked-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 11KB
        • SHA256 b02324c49dd039fa889b4647331aa9ac65e5adc0cc06b26f9f086e2654ff9f08
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-libraryloader-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 12KB
        • SHA256 08484ed55e43584068c337281e2c577cf984bb504871b3156de11c7cc1eec38f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-localization-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-localization-l1-2-0.dll
        • Size 13KB
        • SHA256 059cb23fdcf4d80b92e3da29e9ef4c322edf6fba9a1837978fd983e9bdfc7413
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-memory-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-memory-l1-1-0.dll
        • Size 11KB
        • SHA256 dadbd2204b015e81f94c537ac7a36cd39f82d7c366c193062210c7288baa19e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-namedpipe-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 11KB
        • SHA256 b57e70798af248f91c8c46a3f3b2952effae92ca8ef9640c952467bc6726f363
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processenvironment-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 12KB
        • SHA256 aa415db99828f30a396cbd4e53c94096db89756c88a19d8564f0eed0674add43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processthreads-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 13KB
        • SHA256 c9a686030e073975009f993485d362cc31c7f79b683def713e667d13e9605a14
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processthreads-l1-1-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 11KB
        • SHA256 25a99bdf8bf4d16077dc30dd9ffef7bb5a2ceaf9afcee7cf52ad408355239d40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-profile-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-profile-l1-1-0.dll
        • Size 10KB
        • SHA256 42f4e84073cf876bbab9dd42fd87124a4ba10bb0b59d2c3031cb2b2da7140594
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-rtlsupport-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 11KB
        • SHA256 02d987eba4a65509a2df8ed5dd0b1a0578966e624fcf5806614ece88a817499f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-string-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-string-l1-1-0.dll
        • Size 11KB
        • SHA256 9447218cc4ab1a2c012629aaae8d1c8a428a99184b011bcc766792af5891e234
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-synch-l1-1-0.dll
        • Size 13KB
        • SHA256 a31a15bed26232a178ba7ecb8c8aa9487c3287bb7909952fc06ed0d2c795db26
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-synch-l1-2-0.dll
        • Size 11KB
        • SHA256 1c72ac404781a9986d8edeb0ee5dd39d2c27ce505683ca3324c0eccd6193610a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-sysinfo-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 12KB
        • SHA256 19c78ef5ba470c5b295dddee9244cbd07d0368c5743b02a16d375bfb494d3328
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-timezone-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-timezone-l1-1-0.dll
        • Size 11KB
        • SHA256 3d798b9c345a507e142e8dacd7fb6c17528cc1453abfef2ffa9710d2fa9e032c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-util-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-core-util-l1-1-0.dll
        • Size 11KB
        • SHA256 5eb724c51eecba9ac7b8a53861a1d029bf2e6c62251d00f61ac7e2a5f813aaa3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-conio-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-crt-conio-l1-1-0.dll
        • Size 12KB
        • SHA256 b119adad588ebca7f9c88628010d47d68bf6e7dc6050b7e4b787559f131f5ede
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-convert-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-crt-convert-l1-1-0.dll
        • Size 15KB
        • SHA256 6c008be766c44bf968c9e91cddc5b472110beffee3106a99532e68c605c78d44
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-environment-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-crt-environment-l1-1-0.dll
        • Size 11KB
        • SHA256 aa3e3e99964d7f9b89f288dbe30ff18cbc960ee5add533ec1b8326fe63787aa3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-filesystem-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 13KB
        • SHA256 974af1f1a38c02869073b4e7ec4b2a47a6ce8339fa62c549da6b20668de6798c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-heap-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-crt-heap-l1-1-0.dll
        • Size 12KB
        • SHA256 8166321f14d5804ce76f172f290a6f39ce81373257887d9897a6cf3925d47989
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-locale-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-crt-locale-l1-1-0.dll
        • Size 11KB
        • SHA256 edc1699e9995f98826df06d2c45beb9e02aa7817bae3e61373096ae7f6fa06e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-math-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-crt-math-l1-1-0.dll
        • Size 20KB
        • SHA256 f6a93fe6b57a54aac46229f2ed14a0a979bf60416adb2b2cfc672386ccb2b42e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-process-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-crt-process-l1-1-0.dll
        • Size 12KB
        • SHA256 191f53988c7f02dd888c4fbf7c1d3351570f3b641146fae6d60acdae544771ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-runtime-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 15KB
        • SHA256 4390c389bbbf9ec7215d12d22723efd77beb4cd83311c75ffe215725ecfd55dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-stdio-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 17KB
        • SHA256 6f6f6e857b347f70ecc669b4df73c32e42199b834fe009641d7b41a0b1c210af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-string-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-crt-string-l1-1-0.dll
        • Size 17KB
        • SHA256 45e0835b1d3b446fe2c347bd87922c53cfb6dd826499e19a1d977bf4c11b0e4a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-time-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-crt-time-l1-1-0.dll
        • Size 13KB
        • SHA256 b48310b0837027f756d62c37ea91af988baa403cbcbd01cb26b6fdae21ea96a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-utility-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\api-ms-win-crt-utility-l1-1-0.dll
        • Size 11KB
        • SHA256 c81c4bba4e5f205359ad145963f6fbd074879047c66569f52b6d66711108e1ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base_library.zip

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\base_library.zip
        • Size 859KB
        • SHA256 877bd57f39295994448953ef86bde452669617ed57ab68a15c509791213bac5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libcrypto-1_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libffi-7.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libssl-1_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\libssl-1_1.dll
        • Size 688KB
        • SHA256 d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pyexpat.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\pyexpat.pyd
        • Size 194KB
        • SHA256 4a2d59993bce76790c6d923af81bf404f8e2cb73552e320113663b14cf78748c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python3.DLL

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\python3.DLL
        • Size 64KB
        • SHA256 dc909eb798a23ba8ee9f8e3f307d97755bc0d2dc0cb342cedae81fbbad32a8a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python310.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\python310.dll
        • Size 4.3MB
        • SHA256 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        select.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\select.pyd
        • Size 29KB
        • SHA256 db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ucrtbase.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\ucrtbase.dll
        • Size 987KB
        • SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unicodedata.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\unicodedata.pyd
        • Size 1.1MB
        • SHA256 1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        INSTALLER

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI8522\werkzeug-3.1.3.dist-info\INSTALLER
        • Size 4B
        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
        • MD5 SHA1 SHA512