Analysis
- max time kernel
151s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 17:37
General
- Target 2026-08-08_89a31beaadb9ba64b4e132ed0908bf4a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 59.1MB
- Sample260808-v684psv1ez
- SHA256 ac24d9acb210e397ea14164f1c3d80bee8992212c010a46da2e6b5f1bbaf45bd
Malware Config
Signatures
- Loads dropped DLL 64 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_89a31beaadb9ba64b4e132ed0908bf4a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_89a31beaadb9ba64b4e132ed0908bf4a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_89a31beaadb9ba64b4e132ed0908bf4a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_89a31beaadb9ba64b4e132ed0908bf4a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SDL2.dll
SDL2_image.dll
SDL2_mixer.dll
SDL2_ttf.dll
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_tkinter.pyd
_uuid.pyd
base_library.zip
__init__.py
freetype.dll
libcrypto-1_1.dll
libffi-8.dll
libjpeg-9.dll
libmodplug-1.dll
libogg-0.dll
libopus-0.dll
libopusfile-0.dll
libpng16-16.dll
libssl-1_1.dll
libtiff-5.dll
libwebp-7.dll
portmidi.dll
pyexpat.pyd
python3.DLL
python311.dll
pythoncom311.dll
pywintypes311.dll
select.pyd
sqlite3.dll
tcl86t.dll
tk86t.dll
unicodedata.pyd
win32api.pyd
zlib1.dll
memory/1760-1141-0x00007FFBDE5E0000-0x00007FFBDE5ED000-memory.dmp
memory/1760-1162-0x00007FFBCAF50000-0x00007FFBCB538000-memory.dmp
memory/1760-1155-0x00007FFBDD210000-0x00007FFBDD23D000-memory.dmp
memory/1760-1154-0x00007FFBCAB20000-0x00007FFBCAF47000-memory.dmp
memory/1760-1134-0x00007FFBDD1F0000-0x00007FFBDD209000-memory.dmp
memory/1760-1136-0x00007FFBDE980000-0x00007FFBDE98D000-memory.dmp
memory/1760-1138-0x00007FFBDD1B0000-0x00007FFBDD1E5000-memory.dmp
memory/1760-1143-0x00007FFBDC860000-0x00007FFBDC88E000-memory.dmp
memory/1760-1147-0x00007FFBCAF50000-0x00007FFBCB538000-memory.dmp
memory/1760-1148-0x00007FFBD6370000-0x00007FFBD642C000-memory.dmp
memory/1760-1151-0x00007FFBDE990000-0x00007FFBDE9B4000-memory.dmp
memory/1760-1152-0x00007FFBDC830000-0x00007FFBDC85A000-memory.dmp
memory/1760-1091-0x00007FFBE03F0000-0x00007FFBE03FF000-memory.dmp
memory/1760-1096-0x00007FFBDD210000-0x00007FFBDD23D000-memory.dmp
memory/1760-1095-0x00007FFBDD240000-0x00007FFBDD259000-memory.dmp
memory/1760-1080-0x00007FFBCAF50000-0x00007FFBCB538000-memory.dmp
memory/1760-1088-0x00007FFBDE990000-0x00007FFBDE9B4000-memory.dmp
memory/1760-1157-0x00007FFBDA1C0000-0x00007FFBDA1E2000-memory.dmp
memory/1760-1158-0x00007FFBDD1F0000-0x00007FFBDD209000-memory.dmp
memory/1760-1159-0x00007FFBBC200000-0x00007FFBC0709000-memory.dmp
memory/1760-1160-0x00007FFBDC860000-0x00007FFBDC88E000-memory.dmp
memory/1760-1161-0x00007FFBD6370000-0x00007FFBD642C000-memory.dmp
memory/1760-1178-0x00007FFBD5F80000-0x00007FFBD5FAE000-memory.dmp
memory/1760-1179-0x00007FFBDC810000-0x00007FFBDC825000-memory.dmp
memory/1760-1180-0x00007FFBCAB20000-0x00007FFBCAF47000-memory.dmp
memory/1760-1156-0x00007FFBC9750000-0x00007FFBCAB16000-memory.dmp
memory/1760-1175-0x00007FFBC9750000-0x00007FFBCAB16000-memory.dmp
memory/1760-1170-0x00007FFBDE5E0000-0x00007FFBDE5ED000-memory.dmp
memory/1760-1167-0x00007FFBDD1F0000-0x00007FFBDD209000-memory.dmp
memory/1760-1163-0x00007FFBDE990000-0x00007FFBDE9B4000-memory.dmp
memory/1760-1177-0x00007FFBBC200000-0x00007FFBC0709000-memory.dmp
memory/1760-1192-0x00007FFBDC830000-0x00007FFBDC85A000-memory.dmp
memory/1760-1190-0x00007FFBDC860000-0x00007FFBDC88E000-memory.dmp
memory/1760-1193-0x00007FFBCAB20000-0x00007FFBCAF47000-memory.dmp
memory/1760-1198-0x00007FFBDC810000-0x00007FFBDC825000-memory.dmp
memory/1760-1194-0x00007FFBC9750000-0x00007FFBCAB16000-memory.dmp
memory/1760-1197-0x00007FFBD5F80000-0x00007FFBD5FAE000-memory.dmp
memory/1760-1191-0x00007FFBD6370000-0x00007FFBD642C000-memory.dmp
memory/1760-1181-0x00007FFBCAF50000-0x00007FFBCB538000-memory.dmp
memory/1760-1195-0x00007FFBDA1C0000-0x00007FFBDA1E2000-memory.dmp
memory/1760-1189-0x00007FFBDE5E0000-0x00007FFBDE5ED000-memory.dmp
memory/1760-1196-0x00007FFBBC200000-0x00007FFBC0709000-memory.dmp
memory/1760-1188-0x00007FFBDD1B0000-0x00007FFBDD1E5000-memory.dmp
memory/1760-1187-0x00007FFBDE980000-0x00007FFBDE98D000-memory.dmp
memory/1760-1186-0x00007FFBDD1F0000-0x00007FFBDD209000-memory.dmp
memory/1760-1185-0x00007FFBDD210000-0x00007FFBDD23D000-memory.dmp
memory/1760-1184-0x00007FFBDD240000-0x00007FFBDD259000-memory.dmp
memory/1760-1183-0x00007FFBE03F0000-0x00007FFBE03FF000-memory.dmp
memory/1760-1182-0x00007FFBDE990000-0x00007FFBDE9B4000-memory.dmp