Overview

overview

7

Static

static

3

2026-08-03...at.exe

windows10-2004-x64

7

2026-08-03...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 11:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_63fc31bd687d869647818d0b735d525f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 17.0MB
  • Sample260804-nrg84sdp2z
  • SHA256 4e0f32f4a90e24c9482b89c8471a1323431c6ffad4965c2d285b4b85edb9a91f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
credential_accessexecutionspywarestealer

Malware Config

Signatures

  • Loads dropped DLL 25 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_63fc31bd687d869647818d0b735d525f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_63fc31bd687d869647818d0b735d525f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4336
    • C:\Users\Admin\AppData\Local\Temp\2026-08-03_63fc31bd687d869647818d0b735d525f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-03_63fc31bd687d869647818d0b735d525f_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3100
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:4068

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _raw_aes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\Crypto\Cipher\_raw_aes.pyd
        • Size 34KB
        • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_aesni.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\Crypto\Cipher\_raw_aesni.pyd
        • Size 15KB
        • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cpuid_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\Crypto\Util\_cpuid_c.pyd
        • Size 10KB
        • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\VCRUNTIME140.dll
        • Size 106KB
        • SHA256 69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\_asyncio.pyd
        • Size 63KB
        • SHA256 d1fb700f280e7793e9b0dca33310ef9cd08e9e0ec4f7416854dffaf6f658a394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _brotli.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\_brotli.cp311-win_amd64.pyd
        • Size 836KB
        • SHA256 06fb0d9d73fe3ba17a06293f7294d409a0d2db8228f580389039a0837b141b5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\_bz2.pyd
        • Size 82KB
        • SHA256 ec91e2b4baca31b992d016b84b70f110ce2b1b2dfd54f5e5bef6270ed7d13b85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\_cffi_backend.cp311-win_amd64.pyd
        • Size 174KB
        • SHA256 8100f667a3f64eeb37b9326d0c53a931e0ea3cea4ade5dbdc638c368355c0948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\_ctypes.pyd
        • Size 120KB
        • SHA256 f07fe92ce85f7786f96a4d59c6ee5c05fe1db63a1889ba40a67e37069639b656
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\_decimal.pyd
        • Size 247KB
        • SHA256 0f9c6cc463611a9b2c692382fe1cdd7a52fea4733ffaf645d433f716f8bbd725
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\_hashlib.pyd
        • Size 63KB
        • SHA256 6f7742dfdd371c39048d775f37df3bc2d8d4316c9008e62347b337d64ebed327
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\_lzma.pyd
        • Size 155KB
        • SHA256 7158c1290ac29169160b3ec94d9c8bcde4012d67a555f325d44b418c54e2cc28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\_multiprocessing.pyd
        • Size 33KB
        • SHA256 1d6f1e7e9f55918967a37cbd744886c2b7ee193c5fb8f948132ba40b17119a81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\_overlapped.pyd
        • Size 49KB
        • SHA256 cb68e10748e2efd86f7495d647a2774cea9f97ad5c6fe179f90dc1c467b9280f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\_queue.pyd
        • Size 31KB
        • SHA256 4e5b7c653c1b3dc3fd7519e4f39cc8a2fb2746e0ecdc4e433fe6029f5f4d9065
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\_socket.pyd
        • Size 77KB
        • SHA256 d03fa645cde89b4b01f4a2577139fbb7e1392cb91dc26213b3b76419110d8e49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\_sqlite3.pyd
        • Size 117KB
        • SHA256 b1223420e475348c0bfb90fae33fc44ce35d988270294158ec366893df221a4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\_ssl.pyd
        • Size 172KB
        • SHA256 79d861f0670828dee06c2e3523e2f9a2a90d6c6996bde38201425aa4003119f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\base_library.zip
        • Size 1.4MB
        • SHA256 4cc1848629be7870b94c0d18be8738e39ed8ca123c0b79cdfafa5528fbd1fd3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\certifi\cacert.pem
        • Size 228KB
        • SHA256 bbc7e9c01d7551bb8a159b5dedd989b8ee3ce105aff522b68eb1b01bf854cab0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\charset_normalizer\md.cp311-win_amd64.pyd
        • Size 10KB
        • SHA256 f1e26ef5d12c58d652b0b5437c355a14cd66606b2fbc00339497dd00243081e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\charset_normalizer\md__mypyc.cp311-win_amd64.pyd
        • Size 110KB
        • SHA256 a4a758eabd1b2b45f3c4699bdfebc98f196dc691c0a3d5407e17fffffafc5df7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\libcrypto-3.dll
        • Size 4.9MB
        • SHA256 8e13b53ee25825b97f191d77b51ed03966f8b435773fa3fbc36f3eb668fc569b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\libssl-3.dll
        • Size 771KB
        • SHA256 b21309abd3dbbb1bf8fb6aa3c250fc85d7b0d9984bf4c942d1d4421502f31a10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\pyexpat.pyd
        • Size 194KB
        • SHA256 91fe5b1b2de2847946e5b3f060678971d8127dfd7d2d37603fdcd31bd5c71197
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\python3.DLL
        • Size 65KB
        • SHA256 803ba8242b409080df166320c05a4402aab6dd30e31c4389871f4b68ca1ad423
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\python311.dll
        • Size 5.5MB
        • SHA256 de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\select.pyd
        • Size 29KB
        • SHA256 e24a3e7885df9a18c29ba058c49c3adcf59e4b58107847b98eca365b6d94f279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\sqlite3.dll
        • Size 1.4MB
        • SHA256 1afd7f650596ad97fcf358b0e077121111641c38ca9d53132bab4c9588cf262f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43362\unicodedata.pyd
        • Size 1.1MB
        • SHA256 b1788b81fa160e5120451f9252c7745cdde98b8ce59bf273a3dd867bb034c532
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wppassw.txt
        • Path C:\Users\Admin\AppData\Local\Temp\wppassw.txt
        • Size 28B
        • SHA256 31dadc4de321b80676690787ae1fe9be90d019c226796edf10b6236539f1fc25
        • MD5 SHA1 SHA512
        Submit Download