Overview

overview

7

Static

static

3

2026-08-07...at.exe

windows10-2004-x64

7

2026-08-07...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 01:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_2849b3cedbc327423636812bfecca657_blankgrabber_icedid_luca-stealer_njrat.exe
  • Size 65.3MB
  • Sample260808-b3922sxfnd
  • SHA256 e53932ff19c77f52a35b8673c28b6ade658019048f9c2c77064400a57b57b79f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
executionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_2849b3cedbc327423636812bfecca657_blankgrabber_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_2849b3cedbc327423636812bfecca657_blankgrabber_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4468
    • C:\Users\Admin\AppData\Local\Temp\2026-08-07_2849b3cedbc327423636812bfecca657_blankgrabber_icedid_luca-stealer_njrat.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-07_2849b3cedbc327423636812bfecca657_blankgrabber_icedid_luca-stealer_njrat.exe
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2856
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:3856
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:1544
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /Create /TN SwollStrap /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-08-07_2849b3cedbc327423636812bfecca657_blankgrabber_icedid_luca-stealer_njrat.exe\" --autostart" /SC ONCE /ST 00:00 /SD 01/01/1990 /RL HIGHEST /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2644
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_2849b3cedbc327423636812bfecca657_blankgrabber_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_2849b3cedbc327423636812bfecca657_blankgrabber_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3448
    • C:\Users\Admin\AppData\Local\Temp\2026-08-07_2849b3cedbc327423636812bfecca657_blankgrabber_icedid_luca-stealer_njrat.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-07_2849b3cedbc327423636812bfecca657_blankgrabber_icedid_luca-stealer_njrat.exe
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2360
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:804
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:1228
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /Create /TN SwollStrap /TR "\"C:\Users\Admin\AppData\Local\Temp\2026-08-07_2849b3cedbc327423636812bfecca657_blankgrabber_icedid_luca-stealer_njrat.exe\" --autostart" /SC ONCE /ST 00:00 /SD 01/01/1990 /RL HIGHEST /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3040
  • C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe
    1⤵
      PID:5900

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\VCRUNTIME140.dll
          • Size 116KB
          • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\_bz2.pyd
          • Size 82KB
          • SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cffi_backend.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\_cffi_backend.pyd
          • Size 175KB
          • SHA256 9dcbe427f86795a5dfc19d74e9b5f3d0994ff0221b1a111877ed11eccd42e026
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\_ctypes.pyd
          • Size 121KB
          • SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\_lzma.pyd
          • Size 155KB
          • SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\_socket.pyd
          • Size 77KB
          • SHA256 a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          app.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\app.dll
          • Size 22.6MB
          • SHA256 e056205c182ad2171b6fca9cfcbc580972c811aa054d4a6ee14949322c265a8c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SwollStrapHost.runtimeconfig.json
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\SwollStrapHost.runtimeconfig.json
          • Size 250B
          • SHA256 172848c07813701b2969de3b278bc53bd32ccbf310b210b546e22da131bf0223
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          hostfxr.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\host\fxr\8.0.23\hostfxr.dll
          • Size 358KB
          • SHA256 73bfba03fd339413d083dd5f04be7e8d122abc00340be81ed4c40a601a6e00d9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.NETCore.App.deps.json
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\Microsoft.NETCore.App.deps.json
          • Size 28KB
          • SHA256 e8f17e5d8304611459b236fbc32ade157246a5aa09797da79aab90afc69930a0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.NETCore.App.runtimeconfig.json
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\Microsoft.NETCore.App.runtimeconfig.json
          • Size 53B
          • SHA256 ac377253f9f7cf9d6127d684369de36da123d992cdc2e17950e3c8bf9688df76
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Microsoft.Win32.Primitives.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\Microsoft.Win32.Primitives.dll
          • Size 15KB
          • SHA256 d2ece2888e84009fa0d802b471a8a79a922cb76069a6dc083251aa258a9c3ce9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.Concurrent.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\System.Collections.Concurrent.dll
          • Size 270KB
          • SHA256 4e00a1b4696fefc0384d1060b4330ee1321f221b9fa76d84958f954da677d873
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\System.Collections.dll
          • Size 254KB
          • SHA256 574b3a1e5a3e33f0e03ba345f314b356bcb17b2e89563adbbf7551fd6dbd30c7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ComponentModel.Primitives.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\System.ComponentModel.Primitives.dll
          • Size 78KB
          • SHA256 524178733a71605b671b566e2c5512191c2f84231972c7a9323cdb334a404201
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Console.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\System.Console.dll
          • Size 170KB
          • SHA256 d83ad195add85a6c963c54b8f79afdaa30e08cf20649bc283d9500efb0268bfd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Diagnostics.Process.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\System.Diagnostics.Process.dll
          • Size 330KB
          • SHA256 05d7f7bb7b30da3dccc19e95b395ddfbd662396e3390ab6aa6a0a387d228d7a7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Linq.Expressions.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\System.Linq.Expressions.dll
          • Size 3.5MB
          • SHA256 5a7cf4403ea7eceeae34d18d5b496a024bcd05f697b7925b28d743ada6953b54
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Linq.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\System.Linq.dll
          • Size 530KB
          • SHA256 01c516324f8d062f57e6a3a32ca48503cacabc8455c304b30c4a49ecc59f20de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ObjectModel.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\System.ObjectModel.dll
          • Size 78KB
          • SHA256 ae5efe598e5507ca23e2a30c6a62971f11a5e13f4e7809d0a4deef0ed78e461b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Private.CoreLib.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\System.Private.CoreLib.dll
          • Size 12.6MB
          • SHA256 2e21e1ad264783854e394ce2afdafc330639af9387a0557025627eb0426253ab
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Reflection.Emit.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\System.Reflection.Emit.dll
          • Size 126KB
          • SHA256 b8d065aa28dd8d30f77e9acd0c85ffc22c3aadec547b14b05216755506d5aa29
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.InteropServices.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\System.Runtime.InteropServices.dll
          • Size 94KB
          • SHA256 03426065bed16593440242ff29c625824a4e81c64bccf176edca9497885d4f42
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.Serialization.Formatters.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\System.Runtime.Serialization.Formatters.dll
          • Size 302KB
          • SHA256 7b7cea8526adb0fddfd1a364b0ea40ca87f90d61aebcd2320cd67140d702290a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\System.Runtime.dll
          • Size 42KB
          • SHA256 5578c98568873d24cb60da7c8a4f45dcc9f99f9fbc67f4b22da6e2877b6b72df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Text.Encoding.Extensions.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\System.Text.Encoding.Extensions.dll
          • Size 15KB
          • SHA256 ee33c60bb5f87501c6bcdbfb68784ffc5f12d28e9860a313a9e1e95f61ef465d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Threading.Thread.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\System.Threading.Thread.dll
          • Size 15KB
          • SHA256 e6fb545d4e6cf63f4f8f1e680f77ec6e699fe41a78f271b09606affb372bf1e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Threading.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\System.Threading.dll
          • Size 82KB
          • SHA256 82c123cb14b69307bc6437e6cdb2b7d0af7df46fe843533837ba931976188c7c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          clrjit.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\clrjit.dll
          • Size 1.7MB
          • SHA256 0d93933ede5f919bcfe353ab01873ac2247ed37e15fc56098216f228394771f3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          coreclr.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\coreclr.dll
          • Size 4.8MB
          • SHA256 d9fe4b48656df2a73a1a761c5e6a8d564a6171249f9ac9e5afec79f4f76bf987
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hostpolicy.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\hostpolicy.dll
          • Size 397KB
          • SHA256 0eebe37a299bed18215511fdabcc5bcec364a30f33fd12dca0850634775f23c1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          netstandard.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.NETCore.App\8.0.23\netstandard.dll
          • Size 98KB
          • SHA256 77860a211f6948a9f558705b70321b55c5534804c165ecf9719de45c02a0a9be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.WindowsDesktop.App.deps.json
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.23\Microsoft.WindowsDesktop.App.deps.json
          • Size 30KB
          • SHA256 2384c7616f18f3fe07ece6730b1c181c0ed5e0886882c95ffd5a30798961805b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.WindowsDesktop.App.runtimeconfig.json
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\assemblies\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.23\Microsoft.WindowsDesktop.App.runtimeconfig.json
          • Size 183B
          • SHA256 efdf3b3c930272085f8851e5c9c76a6e8f82118dcf52d0455dbc08857be12501
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\python311.dll
          • Size 5.5MB
          • SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Python.Runtime.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\pythonnet\runtime\Python.Runtime.dll
          • Size 435KB
          • SHA256 648e6b415be8f45018af71f377aa3a97772799b353ac3a5e8612a99313de4907
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4468_946711_PhERDbBFgVg\select.pyd
          • Size 29KB
          • SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2360-1218-0x000001EA80000000-0x000001EA801B6000-memory.dmp
          Download