Overview

overview

10

Static

static

3

2026-08-09...at.exe

windows10-2004-x64

10

2026-08-09...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 21:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 44.5MB
  • Sample260809-1pbprsej6x
  • SHA256 be8005cc85dd1df7d18dbe4138530dcf8ea1e2256045f968d0a622012f306657
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
darksiderattrojan

Malware Config

Signatures

  • Family: DarkSideRAT

    DarkSideRAT is a remote access trojan.

    trojandarksiderat
  • Detects DarkSideRAT 3 IoCs
  • Loads dropped DLL 32 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5456
    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
        PID:2888
      • C:\Users\Admin\AppData\Local\Temp\2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2616
        • C:\Users\Admin\AppData\Local\Temp\2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-08-09_5858504f209b5192f01338236e7b41e4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
          3⤵
            PID:3524

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            MSVCP140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\PySide6\MSVCP140_1.dll
            • Size 27KB
            • SHA256 d1a0601e781cab04c8dfd46a488ee8dcf3245092532852e2036f1195845c4c4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSVCP140_2.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\PySide6\MSVCP140_2.dll
            • Size 266KB
            • SHA256 2a0208e4a14e87042469efa481d1f32220bf2a7b7b501173db83c3668fff6669
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Core.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\PySide6\Qt6Core.dll
            • Size 9.6MB
            • SHA256 c7f6a8b9f2f4e67e50f37662102be9e987a7a061f882112a4982a2446d83662f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Gui.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\PySide6\Qt6Gui.dll
            • Size 9.1MB
            • SHA256 7b8f64dda29a859755d04622f0dae11282b1598bf027e0b6f4c722e72fc312df
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt6Widgets.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\PySide6\Qt6Widgets.dll
            • Size 6.3MB
            • SHA256 1ada9f5b3ca6828f1301ce56cf7fc95eb240b53bfdea15a9cef0cfa6b2077389
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QtCore.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\PySide6\QtCore.pyd
            • Size 3.1MB
            • SHA256 d2bd091416eb60b1fd051cc65a42f3efd4db5521b1f1479bba11d44c4d537125
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QtGui.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\PySide6\QtGui.pyd
            • Size 3.7MB
            • SHA256 c2767ba411264cade8698b7fbc089943b5ddbb141ec6a4bbeab56af51320c88e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QtWidgets.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\PySide6\QtWidgets.pyd
            • Size 4.6MB
            • SHA256 e09a727f70d027c5dcef08e4bb1c2016d47550104e3ebf3cc1fb36787b1403e7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pyside6.abi3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\PySide6\pyside6.abi3.dll
            • Size 254KB
            • SHA256 668d2e42c5afbf9c9a2caec299694ad51ff4d67e962f18cd745382a8b6e3dfb2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\VCRUNTIME140.dll
            • Size 116KB
            • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\VCRUNTIME140_1.dll
            • Size 48KB
            • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _asyncio.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\_asyncio.pyd
            • Size 63KB
            • SHA256 746bc8fa88282afe19dc60e426cc0a75bea3bd137cca06a0b57a30bd31459403
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\_bz2.pyd
            • Size 82KB
            • SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\_ctypes.pyd
            • Size 121KB
            • SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _decimal.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\_decimal.pyd
            • Size 249KB
            • SHA256 980a63f2b39cf16910f44384398e25f24482346a482addb00de42555b17d4278
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\_hashlib.pyd
            • Size 63KB
            • SHA256 87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\_lzma.pyd
            • Size 155KB
            • SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _multiprocessing.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\_multiprocessing.pyd
            • Size 33KB
            • SHA256 975c1947798e3c39898c86675ca1eb68249f77361f41f172f9800275227213b9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _overlapped.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\_overlapped.pyd
            • Size 50KB
            • SHA256 ca106e4dfdeafeabf9e98956d3d8d0cb73e109f1a96f1a7e35bc47dbd7c7e164
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\_queue.pyd
            • Size 31KB
            • SHA256 3f8e7e6aa13b417acc78b63434fb1144e6319a010a9fc376c54d6e69b638fe4c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\_socket.pyd
            • Size 77KB
            • SHA256 a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\_ssl.pyd
            • Size 174KB
            • SHA256 ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\base_library.zip
            • Size 1.4MB
            • SHA256 e5ca1a72ce37833db017073141676f7dc2b448d229d1b2673cd35e7447b2d335
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\libcrypto-3.dll
            • Size 5.0MB
            • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\libssl-3.dll
            • Size 768KB
            • SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pyexpat.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\pyexpat.pyd
            • Size 194KB
            • SHA256 c7c7564f7f874fb660a46384980a2cf28bc3e245ca83628a197ccf861eab5560
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.DLL
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\python3.DLL
            • Size 65KB
            • SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python311.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\python311.dll
            • Size 5.5MB
            • SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\select.pyd
            • Size 29KB
            • SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSVCP140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\shiboken6\MSVCP140.dll
            • Size 537KB
            • SHA256 4abc2a13083744510b1f0a169fe5620ad71f5ad3292546d331486f1a42b86fde
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Shiboken.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\shiboken6\Shiboken.pyd
            • Size 33KB
            • SHA256 1bbb27747949b24bc0f6176be73188ef77a83e9db0ac2f933da1b0b7b5e6cb33
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\shiboken6\VCRUNTIME140_1.dll
            • Size 41KB
            • SHA256 e68c48dc03f45b4a434fc00d324288923f53d85e986fb63934cf387b11c82e8d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            shiboken6.abi3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\shiboken6\shiboken6.abi3.dll
            • Size 373KB
            • SHA256 0fe96e805a6001efde58818a1ce6cb425227f74be72f3b10d7c06c7435fefa5a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI54562\unicodedata.pyd
            • Size 1.1MB
            • SHA256 37c68617fa02a2cadced17ef724e2d450ef12a8a37215da789a4679fde1c5c02
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/2616-238-0x00007FFF9E120000-0x00007FFF9E5CD000-memory.dmp
            Download

            memory/2616-245-0x0000000140000000-0x0000000142C91000-memory.dmp
            Download

            memory/2616-208-0x0000000140000000-0x0000000142C91000-memory.dmp
            Download

            memory/2616-227-0x00007FFFA10B0000-0x00007FFFA13D5000-memory.dmp
            Download

            memory/2616-241-0x00007FFF9CDE0000-0x00007FFF9D195000-memory.dmp
            Download

            memory/2616-206-0x0000000140000000-0x0000000142C91000-memory.dmp
            Download

            memory/2616-234-0x00007FFF9DAD0000-0x00007FFF9E116000-memory.dmp
            Download

            memory/2888-4-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/2888-5-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/3524-178-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/5456-207-0x0000000140000000-0x0000000142C91000-memory.dmp
            Download

            memory/5456-3-0x0000000140000000-0x0000000142C91000-memory.dmp
            Download

            memory/5456-246-0x0000000140000000-0x0000000142C91000-memory.dmp
            Download