Overview

overview

10

Static

static

3

2026-08-10...at.exe

windows10-2004-x64

10

2026-08-10...at.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 07:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_c5d5801ae415bedc45516f8190295d08_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 35.0MB
  • Sample260810-h7fsbsyscx
  • SHA256 ba53dcbdc0d2ee1630a4d764a0b4adf8a856f946d0db2f9f1c96610ae9b9283b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionpersistencepyinstallertrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 27 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of WriteProcessMemory 7 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_c5d5801ae415bedc45516f8190295d08_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_c5d5801ae415bedc45516f8190295d08_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Users\Admin\AppData\Local\Temp\2026-08-10_c5d5801ae415bedc45516f8190295d08_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-10_c5d5801ae415bedc45516f8190295d08_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4636
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /Delete /TN "Desktop Service" /F
        3⤵
          PID:3104
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /Create /TN "Desktop Service" /XML C:\Users\Admin\AppData\Local\Temp\ds_task_q7m182e8.xml /F
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2216
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /Run /TN "Desktop Service"
          3⤵
            PID:5108
      • C:\Users\Public\Documents\Desktop Service.exe
        "C:\Users\Public\Documents\Desktop Service.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1984
        • C:\Users\Public\Documents\Desktop Service.exe
          "C:\Users\Public\Documents\Desktop Service.exe"
          2⤵
          • UAC bypass
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:3664
          • C:\Windows\system32\schtasks.exe
            schtasks /query /tn "RMMAgent_Desktop Service"
            3⤵
              PID:5604
            • C:\Windows\system32\schtasks.exe
              schtasks /create /tn "RMMAgent_Desktop Service" /tr "\"C:\Users\Public\Documents\Desktop Service.exe\"" /sc ONLOGON /rl HIGHEST /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:1784

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              Desktop Service.exe
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\Desktop Service.exe
              • Size 27.3MB
              • SHA256 36842ec5608bcf494d0923bae2a2482a1dca83f40ea7ef7ae37d42abbef2ff4f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCRUNTIME140.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\VCRUNTIME140.dll
              • Size 117KB
              • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _bz2.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\_bz2.pyd
              • Size 84KB
              • SHA256 b3dd7cea6d03342252834cebcc814af37d850b86d0627fa22b7f6990882f2f8b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ctypes.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\_ctypes.pyd
              • Size 130KB
              • SHA256 dfa65498c77e71f038883337d2b5ffd92508489e79e6ee5e96ddec4ecf2a7fa1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _lzma.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\_lzma.pyd
              • Size 155KB
              • SHA256 f20be6a9fee8fb5d53170c4bc24a39b48d3c0ccbe8e2000e60ff7d65b77c6ea1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              base_library.zip
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\base_library.zip
              • Size 1.3MB
              • SHA256 c4afca85ee478a176eeaa3f31b175ebf7068fd7088436b44c56dd01ba250db24
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libffi-8.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\libffi-8.dll
              • Size 38KB
              • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              python313.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\python313.dll
              • Size 5.8MB
              • SHA256 41ec4fc4e5bc8b207258590238f7f050b13fdfee84c4a7b1ecff6e945d031a10
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ucrtbase.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI13842\ucrtbase.dll
              • Size 1.1MB
              • SHA256 d93ce42cd625510b2355de086bcd19e2c11307ccade7bad62b09c7f340a866ba
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _imaging.cp313-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI19842\PIL\_imaging.cp313-win_amd64.pyd
              • Size 2.4MB
              • SHA256 11b767175caa89e296d45d3dc029c9f299db5be5dcccc815baef97534937d762
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _imagingft.cp313-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI19842\PIL\_imagingft.cp313-win_amd64.pyd
              • Size 2.0MB
              • SHA256 948c9f338409979f34d4dda544b4c178f41626daed584e448287c68de2efa3b7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCRUNTIME140_1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI19842\VCRUNTIME140_1.dll
              • Size 48KB
              • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _hashlib.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI19842\_hashlib.pyd
              • Size 67KB
              • SHA256 1a3010b06c2fcd625dece3dd0883ca060e98b94adc062b06cb1a671cfc3b5caf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _queue.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI19842\_queue.pyd
              • Size 34KB
              • SHA256 1e349a13913370369059a4ae5951157112b5eba53ed4389c18ffc5e00af1a037
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _socket.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI19842\_socket.pyd
              • Size 84KB
              • SHA256 127a39d2198f17dd9b573904fe7e4040c7c8718753e6c4edee2ff6c35f487fac
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ssl.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI19842\_ssl.pyd
              • Size 177KB
              • SHA256 faf716d309349dbd54efd7fb402bd42ed21a537614ac0da89ed92ba307ecbf15
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _wmi.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI19842\_wmi.pyd
              • Size 38KB
              • SHA256 3be5e14e9a9dc49f099209dee98b9cb5e31ade3b0deab52277026bb14df5bdb6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              base_library.zip
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI19842\base_library.zip
              • Size 1.3MB
              • SHA256 eb88211d318fd9c57238ef87e9198b1c52eef7a4b5c72f61462079033bc01563
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cacert.pem
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI19842\certifi\cacert.pem
              • Size 280KB
              • SHA256 9102e6a3644a071ba6cdbd4a53698f291c4a64b18450a08bc046548b6db5cc8b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libcrypto-3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI19842\libcrypto-3.dll
              • Size 5.0MB
              • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libssl-3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI19842\libssl-3.dll
              • Size 776KB
              • SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              select.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI19842\select.pyd
              • Size 32KB
              • SHA256 9cc1ef0264060099503592db57ee7d7c1f8d6bea689b2ed125919c7a30b7ab7f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              unicodedata.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI19842\unicodedata.pyd
              • Size 695KB
              • SHA256 1989628f16052f9123c5cf603e96490a75fde6228315457556f96a838bf9e904
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ds_task_q7m182e8.xml
              • Path C:\Users\Admin\AppData\Local\Temp\ds_task_q7m182e8.xml
              • Size 1KB
              • SHA256 ea705377c028a3d9c6662f068622baecf7ee1fd6bdaff01ee985f9d38c133e01
              • MD5 SHA1 SHA512 TLSH
              Submit Download