Analysis
- max time kernel
150s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
15/08/2026, 00:30
General
- Target 2026-08-14_02a61e5e1a0e3d30e9173d4fbc33948e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 10.5MB
- Sample260815-atts2acl8v
- SHA256 04b8edb7b32037b4c35c5d71a9b71c1f16bade5660286bb991d90b69fae38c87
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Loads dropped DLL 21 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_02a61e5e1a0e3d30e9173d4fbc33948e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_02a61e5e1a0e3d30e9173d4fbc33948e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_02a61e5e1a0e3d30e9173d4fbc33948e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_02a61e5e1a0e3d30e9173d4fbc33948e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "$ws = New-Object -ComObject WScript.Shell $s = $ws.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TokenTool.lnk') $s.TargetPath = 'C:\Users\Admin\AppData\Local\Temp\2026-08-14_02a61e5e1a0e3d30e9173d4fbc33948e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe' $s.WorkingDirectory = 'C:\Users\Admin\AppData\Local\Temp' $s.WindowStyle = 7 $s.Save()"3⤵
- Creates a file in the Startup directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\whoami.exewhoami /upn3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-ChildItem 'HKCU:\Software\Microsoft\IdentityCRL\StoredIdentities' -ErrorAction SilentlyContinue | ForEach-Object { (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).IdentityAlias } | Where-Object { $_ -match '@' } | Select-Object -Unique"3⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "$p = Get-CimInstance Win32_Processor | Select-Object -First 1; if ($p) { \"$($p.Name)|$($p.NumberOfCores)|$($p.NumberOfLogicalProcessors)\" }"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "Get-CimInstance Win32_VideoController | Where-Object { $_.Name -and $_.Name -notmatch 'Microsoft Basic' } | Select-Object -ExpandProperty Name | Select-Object -Unique"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
_raw_aes.pyd
_raw_aesni.pyd
_cpuid_c.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_wmi.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python312.dll
select.pyd
sqlite3.dll
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_s0o4cw3o.2te.ps1
memory/4228-160-0x000001DBCF8E0000-0x000001DBCF8FE000-memory.dmp
memory/4228-161-0x000001DBCFBC0000-0x000001DBCFC72000-memory.dmp
memory/4228-162-0x000001DBCF8C0000-0x000001DBCF8CA000-memory.dmp
memory/4228-163-0x000001DBCF930000-0x000001DBCF95A000-memory.dmp
memory/4228-164-0x000001DBCF930000-0x000001DBCF954000-memory.dmp
memory/4372-148-0x00007FFC008C0000-0x00007FFC00963000-memory.dmp
memory/4372-145-0x0000019EECED0000-0x0000019EECEF2000-memory.dmp
memory/4372-142-0x00007FFC008C0000-0x00007FFC00963000-memory.dmp