Overview

overview

10

Static

static

3

2026-08-09...at.exe

windows10-2004-x64

10

2026-08-09...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 21:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 44.5MB
  • Sample260809-1pbprsej6x
  • SHA256 be8005cc85dd1df7d18dbe4138530dcf8ea1e2256045f968d0a622012f306657
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
darksiderattrojan

Malware Config

Signatures

  • Family: DarkSideRAT

    DarkSideRAT is a remote access trojan.

    trojandarksiderat
  • Detects DarkSideRAT 7 IoCs
  • Loads dropped DLL 31 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3156
    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
        PID:3808
      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4792
        • C:\Users\Admin\AppData\Local\Temp\2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
          3⤵
          • Loads dropped DLL
          PID:1364

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          MSVCP140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\PySide6\MSVCP140_1.dll
          • Size 27KB
          • SHA256 d1a0601e781cab04c8dfd46a488ee8dcf3245092532852e2036f1195845c4c4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSVCP140_2.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\PySide6\MSVCP140_2.dll
          • Size 266KB
          • SHA256 2a0208e4a14e87042469efa481d1f32220bf2a7b7b501173db83c3668fff6669
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt6Core.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\PySide6\Qt6Core.dll
          • Size 9.6MB
          • SHA256 c7f6a8b9f2f4e67e50f37662102be9e987a7a061f882112a4982a2446d83662f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt6Gui.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\PySide6\Qt6Gui.dll
          • Size 9.1MB
          • SHA256 7b8f64dda29a859755d04622f0dae11282b1598bf027e0b6f4c722e72fc312df
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Qt6Widgets.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\PySide6\Qt6Widgets.dll
          • Size 6.3MB
          • SHA256 1ada9f5b3ca6828f1301ce56cf7fc95eb240b53bfdea15a9cef0cfa6b2077389
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          QtCore.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\PySide6\QtCore.pyd
          • Size 3.1MB
          • SHA256 d2bd091416eb60b1fd051cc65a42f3efd4db5521b1f1479bba11d44c4d537125
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          QtGui.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\PySide6\QtGui.pyd
          • Size 3.7MB
          • SHA256 c2767ba411264cade8698b7fbc089943b5ddbb141ec6a4bbeab56af51320c88e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          QtWidgets.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\PySide6\QtWidgets.pyd
          • Size 4.6MB
          • SHA256 e09a727f70d027c5dcef08e4bb1c2016d47550104e3ebf3cc1fb36787b1403e7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyside6.abi3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\PySide6\pyside6.abi3.dll
          • Size 254KB
          • SHA256 668d2e42c5afbf9c9a2caec299694ad51ff4d67e962f18cd745382a8b6e3dfb2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\VCRUNTIME140.dll
          • Size 116KB
          • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_asyncio.pyd
          • Size 63KB
          • SHA256 746bc8fa88282afe19dc60e426cc0a75bea3bd137cca06a0b57a30bd31459403
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_bz2.pyd
          • Size 82KB
          • SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_ctypes.pyd
          • Size 121KB
          • SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_decimal.pyd
          • Size 249KB
          • SHA256 980a63f2b39cf16910f44384398e25f24482346a482addb00de42555b17d4278
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_hashlib.pyd
          • Size 63KB
          • SHA256 87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_lzma.pyd
          • Size 155KB
          • SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multiprocessing.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_multiprocessing.pyd
          • Size 33KB
          • SHA256 975c1947798e3c39898c86675ca1eb68249f77361f41f172f9800275227213b9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_overlapped.pyd
          • Size 50KB
          • SHA256 ca106e4dfdeafeabf9e98956d3d8d0cb73e109f1a96f1a7e35bc47dbd7c7e164
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_queue.pyd
          • Size 31KB
          • SHA256 3f8e7e6aa13b417acc78b63434fb1144e6319a010a9fc376c54d6e69b638fe4c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_socket.pyd
          • Size 77KB
          • SHA256 a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\_ssl.pyd
          • Size 174KB
          • SHA256 ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\base_library.zip
          • Size 1.4MB
          • SHA256 e5ca1a72ce37833db017073141676f7dc2b448d229d1b2673cd35e7447b2d335
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\libcrypto-3.dll
          • Size 5.0MB
          • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\libssl-3.dll
          • Size 768KB
          • SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\pyexpat.pyd
          • Size 194KB
          • SHA256 c7c7564f7f874fb660a46384980a2cf28bc3e245ca83628a197ccf861eab5560
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\python3.dll
          • Size 65KB
          • SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\python311.dll
          • Size 5.5MB
          • SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\select.pyd
          • Size 29KB
          • SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSVCP140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\shiboken6\MSVCP140.dll
          • Size 537KB
          • SHA256 4abc2a13083744510b1f0a169fe5620ad71f5ad3292546d331486f1a42b86fde
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Shiboken.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\shiboken6\Shiboken.pyd
          • Size 33KB
          • SHA256 1bbb27747949b24bc0f6176be73188ef77a83e9db0ac2f933da1b0b7b5e6cb33
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\shiboken6\VCRUNTIME140_1.dll
          • Size 41KB
          • SHA256 e68c48dc03f45b4a434fc00d324288923f53d85e986fb63934cf387b11c82e8d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          shiboken6.abi3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\shiboken6\shiboken6.abi3.dll
          • Size 373KB
          • SHA256 0fe96e805a6001efde58818a1ce6cb425227f74be72f3b10d7c06c7435fefa5a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI31562\unicodedata.pyd
          • Size 1.1MB
          • SHA256 37c68617fa02a2cadced17ef724e2d450ef12a8a37215da789a4679fde1c5c02
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1364-185-0x0000000140000000-0x0000000140015000-memory.dmp
          Download

          memory/1364-187-0x0000000140000000-0x0000000140015000-memory.dmp
          Download

          memory/1364-181-0x0000000140000000-0x0000000140015000-memory.dmp
          Download

          memory/3156-15-0x0000000140000000-0x0000000142C91000-memory.dmp
          Download

          memory/3156-250-0x0000000140000000-0x0000000142C91000-memory.dmp
          Download

          memory/3808-5-0x0000000140000000-0x0000000140015000-memory.dmp
          Download

          memory/3808-4-0x0000000140000000-0x0000000140015000-memory.dmp
          Download

          memory/3808-19-0x0000000140000000-0x0000000140015000-memory.dmp
          Download

          memory/3808-3-0x0000000140000000-0x0000000140015000-memory.dmp
          Download

          memory/4792-249-0x0000000140000000-0x0000000142C91000-memory.dmp
          Download

          memory/4792-245-0x00007FF9A31A0000-0x00007FF9A3555000-memory.dmp
          Download

          memory/4792-242-0x00007FF9A3E90000-0x00007FF9A44D6000-memory.dmp
          Download

          memory/4792-238-0x00007FF9A44E0000-0x00007FF9A498D000-memory.dmp
          Download

          memory/4792-227-0x00007FF9A5340000-0x00007FF9A5665000-memory.dmp
          Download

          memory/4792-186-0x0000000140000000-0x0000000142C91000-memory.dmp
          Download