Overview

overview

7

Static

static

3

2026-08-09...at.exe

windows10-2004-x64

7

2026-08-09...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 16:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_9721cd4040ac576f2364ae6ad6c89ea2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 18.2MB
  • Sample260809-ts4fma1gmg
  • SHA256 e8ca3e138cbeb2820bc5feaf545a7c8334d90e34fd19fca95e5682237ac6581e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Loads dropped DLL 30 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_9721cd4040ac576f2364ae6ad6c89ea2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_9721cd4040ac576f2364ae6ad6c89ea2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3808
    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_9721cd4040ac576f2364ae6ad6c89ea2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-09_9721cd4040ac576f2364ae6ad6c89ea2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Maps connected drives based on registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1976
      • C:\Windows\System32\Wbem\wmic.exe
        wmic csproduct get uuid
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5348
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nul
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4832
        • C:\Windows\system32\reg.exe
          REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc
          4⤵
            PID:4444
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nul
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:6916
          • C:\Windows\system32\reg.exe
            REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName
            4⤵
              PID:6592
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:6924
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:6784
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:7068
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:260

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            2
            T1059

            PowerShell

            1
            T1059.001

            Windows Command Shell

            1
            T1059.003

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Defense Evasion

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Peripheral Device Discovery

            1
            T1120

            Query Registry

            1
            T1012

            System Information Discovery

            1
            T1082

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 1644a8734b1a870853c20608b2c652c71a46e3cce6318ad116a4f9159a76d282
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            _raw_aes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\Crypto\Cipher\_raw_aes.pyd
            • Size 34KB
            • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _raw_aesni.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\Crypto\Cipher\_raw_aesni.pyd
            • Size 15KB
            • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _cpuid_c.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\Crypto\Util\_cpuid_c.pyd
            • Size 10KB
            • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _imaging.cp312-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\PIL\_imaging.cp312-win_amd64.pyd
            • Size 2.5MB
            • SHA256 6dfd10a98bc81a1999e2b5ddb8be8c1cfb9a2c8e10258c56a52ee0d8930d3d7f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\VCRUNTIME140.dll
            • Size 106KB
            • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\VCRUNTIME140_1.dll
            • Size 48KB
            • SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _asyncio.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\_asyncio.pyd
            • Size 69KB
            • SHA256 0d4fbd46f922e548060ea74c95e99dc5f19b1df69be17706806760515c1c64fe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\_bz2.pyd
            • Size 82KB
            • SHA256 02d772c03704fe243c8de2672c210a5804d075c1f75e738d6130a173d08dfcde
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\_ctypes.pyd
            • Size 121KB
            • SHA256 bc3b83d2dc9e2f0e6386ed952384c6cf48f6eed51129a50dfd5ef6cbbc0a8fb3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _decimal.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\_decimal.pyd
            • Size 247KB
            • SHA256 a28c543976aa4b6d37da6f94a280d72124b429f458d0d57b7dbcf71b4bea8f73
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\_hashlib.pyd
            • Size 63KB
            • SHA256 e47e76d70d508b62924fe480f30e615b12fdd7745c0aac68a2cddabd07b692ae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\_lzma.pyd
            • Size 155KB
            • SHA256 34130d8abe27586ee315262d69af4e27429b7eab1f3131ea375c2bb62cf094be
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _overlapped.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\_overlapped.pyd
            • Size 54KB
            • SHA256 5d298bb811037b583cff6c88531f1742fae5eee47c290adb47ddbd0d6126b9cc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\_socket.pyd
            • Size 81KB
            • SHA256 b38e66e6ee413e5955ef03d619cadd40fca8be035b43093d2342b6f3739e883e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _sqlite3.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\_sqlite3.pyd
            • Size 121KB
            • SHA256 ff25bdbeef34d2aa420a79d3666c2660e7e3e96259d1f450f1af5268553380ec
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\_ssl.pyd
            • Size 173KB
            • SHA256 a4ce52a9e0daddbbe7a539d1a7eda787494f2173ddcc92a3faf43b7cf597452b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _wmi.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\_wmi.pyd
            • Size 35KB
            • SHA256 79adca5037d9145309d3bd19f7a26f7bb7da716ee86e01073c6f2a9681e33dad
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\base_library.zip
            • Size 1.3MB
            • SHA256 0222d0f6fef3c0b3243d5f4037dfdee95f777cf985a800378a163fadb8604cae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cacert.pem
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\certifi\cacert.pem
            • Size 230KB
            • SHA256 7cef540c6af3bf0a3c7d0070bd3fd7aae34f8aa805b408d1c27a01c8aeb305df
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\libcrypto-3.dll
            • Size 4.9MB
            • SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\libssl-3.dll
            • Size 771KB
            • SHA256 41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _psutil_windows.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\psutil\_psutil_windows.pyd
            • Size 69KB
            • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\python3.dll
            • Size 66KB
            • SHA256 1e9224ba7190b6301ef47befa8e383d0c55700255d04a36f7dac88ea9573f2fb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python312.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\python312.dll
            • Size 6.6MB
            • SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pywintypes312.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\pywin32_system32\pywintypes312.dll
            • Size 133KB
            • SHA256 b29e4098f9f53f05e3281636d079de58b05a26c03669cea4ec1673e51750fa31
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\select.pyd
            • Size 30KB
            • SHA256 bc71fbdfd1441d62dd86d33ff41b35dc3cc34875f625d885c58c8dc000064dab
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sqlite3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\sqlite3.dll
            • Size 1.4MB
            • SHA256 8aa8b909a39fcc33d1ec2ad51eac6714a318c6efd04f963d21b75d8f64809ad6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ucrtbase.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\ucrtbase.dll
            • Size 1.3MB
            • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\unicodedata.pyd
            • Size 1.1MB
            • SHA256 2480a78815f619a631210e577e733c9bafecb7f608042e979423c5850ee390ff
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            win32crypt.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI38082\win32\win32crypt.pyd
            • Size 122KB
            • SHA256 6d625fbac4e15b0310f19fffc656357eab024132fc514bd587d811d106bc704e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            __PSScriptPolicyTest_n1b1wej3.ve0.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n1b1wej3.ve0.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/6924-185-0x000002D7D6190000-0x000002D7D61B2000-memory.dmp
            Download