Overview

overview

7

Static

static

3

2026-08-09...at.exe

windows10-2004-x64

7

2026-08-09...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 04:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_67bcaaea6612a6fd7f65117d2213caa2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 62.8MB
  • Sample260809-eqmmrshk2w
  • SHA256 51a275b8e5138f229f6a4aedcaca48b914370de9c8274713eddf914cc694e531
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 39 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_67bcaaea6612a6fd7f65117d2213caa2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_67bcaaea6612a6fd7f65117d2213caa2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5708
    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_67bcaaea6612a6fd7f65117d2213caa2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-09_67bcaaea6612a6fd7f65117d2213caa2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3920
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:4496

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\PyQt5\Qt5\bin\MSVCP140.dll
        • Size 576KB
        • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\PyQt5\Qt5\bin\MSVCP140_1.dll
        • Size 30KB
        • SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\PyQt5\Qt5\bin\Qt5Core.dll
        • Size 5.7MB
        • SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\PyQt5\Qt5\bin\VCRUNTIME140_1.dll
        • Size 43KB
        • SHA256 1f0f5f2ce671e0f68cf96176721df0e5e6f527c8ca9cfa98aa875b5a3816d460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\PyQt5\QtCore.pyd
        • Size 2.4MB
        • SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\PyQt5\sip.cp311-win_amd64.pyd
        • Size 120KB
        • SHA256 8962fbcd0f87e97b4d6f84adba26c0a6d3b0b7921f921c8997e008b355b0f5d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\VCRUNTIME140.dll
        • Size 96KB
        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\VCRUNTIME140_1.dll
        • Size 37KB
        • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_asyncio.pyd
        • Size 62KB
        • SHA256 aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_bz2.pyd
        • Size 81KB
        • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_cffi_backend.cp311-win_amd64.pyd
        • Size 174KB
        • SHA256 8100f667a3f64eeb37b9326d0c53a931e0ea3cea4ade5dbdc638c368355c0948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_ctypes.pyd
        • Size 120KB
        • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_decimal.pyd
        • Size 245KB
        • SHA256 d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_elementtree.pyd
        • Size 123KB
        • SHA256 df71d64818cfecd61ad0122bea23b685d01bd241f1b06879a2999917818b0787
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_hashlib.pyd
        • Size 62KB
        • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_lzma.pyd
        • Size 154KB
        • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_multiprocessing.pyd
        • Size 32KB
        • SHA256 0ae3bf383ff998886f97576c55d6bf0a076c24395cf6fcd2265316e9a6e8c007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_overlapped.pyd
        • Size 48KB
        • SHA256 a083e83f609ed7a2fc18a95d44d8f91c9dc74842f33e19e91988e84db94c3b5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_queue.pyd
        • Size 30KB
        • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_socket.pyd
        • Size 76KB
        • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_ssl.pyd
        • Size 155KB
        • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\_uuid.pyd
        • Size 23KB
        • SHA256 f7f57807c15c21c5aa9818edf3993d0b94aef8af5808e1ad86a98637fc499d44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\base_library.zip
        • Size 1.4MB
        • SHA256 cc4cd095a2c2a2b378c9491dc650006a88f45bfb742e9b3031f61934a6b0fa34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\libffi-8.dll
        • Size 34KB
        • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\libssl-1_1.dll
        • Size 686KB
        • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        INSTALLER
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\py_cord-2.6.1.dist-info\INSTALLER
        • Size 4B
        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
        • MD5 SHA1 SHA512
        Submit Download

        METADATA
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\py_cord-2.6.1.dist-info\METADATA
        • Size 6KB
        • SHA256 ea17cd32fd16cd2059789c807b0a9a788affb767e46a8429f14f0bdc7e8d3903
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\pyexpat.pyd
        • Size 193KB
        • SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\python3.dll
        • Size 64KB
        • SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\python311.dll
        • Size 5.5MB
        • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pythoncom311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\pywin32_system32\pythoncom311.dll
        • Size 675KB
        • SHA256 9111856645f779f137c46d78a68374292fc512a2a4038466476bb9c6024097b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\pywin32_system32\pywintypes311.dll
        • Size 134KB
        • SHA256 6583c15de0f5a1b20c8750b0599e5cf162f91f239f8341bda842485d8bbc9887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\select.pyd
        • Size 28KB
        • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\unicodedata.pyd
        • Size 1.1MB
        • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57082\win32\win32api.pyd
        • Size 136KB
        • SHA256 bf5147f4fffbffa77d9169b65af13d983e2fcccdbca8151d72814c55939bb2c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3920-316-0x00007FF916AE0000-0x00007FF916D43000-memory.dmp
        Download