Analysis
- max time kernel
149s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/08/2026, 02:31
General
- Target 2026-08-11_b66024b3c17fd208cb802504fcc7a2c0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 10.6MB
- Sample260811-czs5sstdph
- SHA256 8a5abc2ae31f33bbf3290d9bf2b30ddc112edb0876cb5ece8918ab80e9ea9eb0
Malware Config
Signatures
- Loads dropped DLL 22 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- UPX packed file 60 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_b66024b3c17fd208cb802504fcc7a2c0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_b66024b3c17fd208cb802504fcc7a2c0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_b66024b3c17fd208cb802504fcc7a2c0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_b66024b3c17fd208cb802504fcc7a2c0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp313-win_amd64.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
base_library.zip
_rust.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python3.DLL
python313.dll
select.pyd
ucrtbase.dll
unicodedata.pyd
memory/3800-131-0x00007FFE4CAF0000-0x00007FFE4D3B3000-memory.dmp
memory/3800-141-0x00007FFE4D3C0000-0x00007FFE4D8F3000-memory.dmp
memory/3800-114-0x00007FFE4D3C0000-0x00007FFE4D8F3000-memory.dmp
memory/3800-112-0x00007FFE50950000-0x00007FFE50A1E000-memory.dmp
memory/3800-108-0x00007FFE59640000-0x00007FFE59673000-memory.dmp
memory/3800-118-0x00007FFE59620000-0x00007FFE59636000-memory.dmp
memory/3800-103-0x00007FFE61400000-0x00007FFE6140D000-memory.dmp
memory/3800-101-0x00007FFE5ED40000-0x00007FFE5ED59000-memory.dmp
memory/3800-97-0x00007FFE59680000-0x00007FFE596AB000-memory.dmp
memory/3800-95-0x00007FFE60760000-0x00007FFE60779000-memory.dmp
memory/3800-128-0x00007FFE60DD0000-0x00007FFE60DDD000-memory.dmp
memory/3800-91-0x00007FFE61AA0000-0x00007FFE61AAF000-memory.dmp
memory/3800-125-0x00007FFE595E0000-0x00007FFE595F4000-memory.dmp
memory/3800-122-0x00007FFE59600000-0x00007FFE59612000-memory.dmp
memory/3800-121-0x00007FFE60540000-0x00007FFE60567000-memory.dmp
memory/3800-115-0x00007FFE4D900000-0x00007FFE4DF64000-memory.dmp
memory/3800-89-0x00007FFE60540000-0x00007FFE60567000-memory.dmp
memory/3800-134-0x00007FFE56A30000-0x00007FFE56A66000-memory.dmp
memory/3800-80-0x00007FFE4D900000-0x00007FFE4DF64000-memory.dmp
memory/3800-138-0x00007FFE4F800000-0x00007FFE4F8B3000-memory.dmp
memory/3800-137-0x00007FFE59640000-0x00007FFE59673000-memory.dmp
memory/3800-140-0x0000022D84CB0000-0x0000022D851E3000-memory.dmp
memory/3800-139-0x00007FFE50950000-0x00007FFE50A1E000-memory.dmp
memory/3800-113-0x0000022D84CB0000-0x0000022D851E3000-memory.dmp
memory/3800-142-0x00007FFE59620000-0x00007FFE59636000-memory.dmp
memory/3800-143-0x00007FFE4D900000-0x00007FFE4DF64000-memory.dmp
memory/3800-159-0x00007FFE4F800000-0x00007FFE4F8B3000-memory.dmp
memory/3800-158-0x00007FFE56A30000-0x00007FFE56A66000-memory.dmp
memory/3800-150-0x00007FFE59640000-0x00007FFE59673000-memory.dmp
memory/3800-157-0x00007FFE4CAF0000-0x00007FFE4D3B3000-memory.dmp
memory/3800-160-0x00007FFE4D900000-0x00007FFE4DF64000-memory.dmp
memory/3800-170-0x00007FFE59620000-0x00007FFE59636000-memory.dmp
memory/3800-177-0x00007FFE4D900000-0x00007FFE4DF64000-memory.dmp
memory/3800-184-0x00007FFE59640000-0x00007FFE59673000-memory.dmp
memory/3800-194-0x00007FFE4D900000-0x00007FFE4DF64000-memory.dmp
memory/3800-211-0x00007FFE4D900000-0x00007FFE4DF64000-memory.dmp
memory/3800-228-0x00007FFE4D900000-0x00007FFE4DF64000-memory.dmp
memory/3800-245-0x00007FFE4D900000-0x00007FFE4DF64000-memory.dmp
memory/3800-262-0x00007FFE4D900000-0x00007FFE4DF64000-memory.dmp
memory/3800-279-0x00007FFE4D900000-0x00007FFE4DF64000-memory.dmp
memory/3800-296-0x00007FFE4D900000-0x00007FFE4DF64000-memory.dmp
memory/3800-313-0x00007FFE4D900000-0x00007FFE4DF64000-memory.dmp
memory/3800-330-0x00007FFE4D900000-0x00007FFE4DF64000-memory.dmp
memory/3800-347-0x00007FFE4D900000-0x00007FFE4DF64000-memory.dmp
memory/3800-364-0x00007FFE4D900000-0x00007FFE4DF64000-memory.dmp