Overview

overview

7

Static

static

3

2026-08-15...at.exe

windows10-2004-x64

7

2026-08-15...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 18:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-15_170996a03a66ac438bb887b53f9c5c77_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 18.1MB
  • Sample260815-w63glafm6s
  • SHA256 fdaab45d6cce16c6a74579df3cb423cc7d5009782780031cc2fbf61b78069ba8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
persistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Loads dropped DLL 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_170996a03a66ac438bb887b53f9c5c77_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-15_170996a03a66ac438bb887b53f9c5c77_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5568
    • C:\Users\Admin\AppData\Local\Temp\2026-08-15_170996a03a66ac438bb887b53f9c5c77_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-15_170996a03a66ac438bb887b53f9c5c77_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      PID:3536

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_bz2.pyd
        • Size 85KB
        • SHA256 f0643f805a011efc704df472bb431ba231e6ae31fb7ba71328df1b6f1a9e1aa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_ctypes.pyd
        • Size 138KB
        • SHA256 f761aad10818806531aa431143b30f0d90a0a402b60f6f1c6e406fcc08f4e6b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_hashlib.pyd
        • Size 67KB
        • SHA256 052f824d5e3a046aa401efef86307c0c7746a0d8ff85c855d4225d6fe565bb07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_lzma.pyd
        • Size 157KB
        • SHA256 3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_queue.pyd
        • Size 35KB
        • SHA256 4fd91087253a1507a5e5068eb366e77826efc27a568707ed4796d638df1fcf1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_socket.pyd
        • Size 85KB
        • SHA256 6a016011e78e2476eb19dbe7330b373b9e2c66ff6c0be9bd64ff008ee53647ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_ssl.pyd
        • Size 179KB
        • SHA256 1edd9575243ae8322f6a21e9eecc933701c5820f05e7b0ebc0b51cb80592da77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        auto.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_tcl_data\auto.tcl
        • Size 21KB
        • SHA256 08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_tcl_data\encoding\cp1252.enc
        • Size 1KB
        • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        pkgIndex.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_tcl_data\http1.0\pkgIndex.tcl
        • Size 746B
        • SHA256 77265723959c092897c2449c5b7768ca72d0efcd8c505bddbb7a84f6aa401339
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        init.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_tcl_data\init.tcl
        • Size 25KB
        • SHA256 acacce15658dd7ce8f69b1e3d3a94770a22972a8e906eb3b61cd06f0ecd5db59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        package.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_tcl_data\package.tcl
        • Size 23KB
        • SHA256 b471cec9056b62d562020b14d69d4bd1f92dfe158afc8ba81c6341836211ca46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tclIndex
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_tcl_data\tclIndex
        • Size 7KB
        • SHA256 577f042bbe640e2739606a1f76098abdb8bd1d1f31526402fb82b21091644f65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tm.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_tcl_data\tm.tcl
        • Size 11KB
        • SHA256 f0cc13daca21fee538cca757aa09e88a969a85174eda26e61e573dda6c7ba413
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pkgIndex.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_tk_data\pkgIndex.tcl
        • Size 376B
        • SHA256 6127926b94db2992ab450fc6cc2ec3d071f7bbc856656d0ae20cc3fd4036f547
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tk.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_tk_data\tk.tcl
        • Size 23KB
        • SHA256 b7fd24177b17f67da2ca671f711309c65cf246be1fd0cf4f1ab8f3ea9ca2c3f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_tkinter.pyd
        • Size 67KB
        • SHA256 4795b085668e6c37f4ffa281a89aeacff871288b1a2a88365d633b37576722c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_wmi.pyd
        • Size 39KB
        • SHA256 2aec82cd41bfc201fd04143023c7493f117436041f66120ddcd4a24b131ca9db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\_zstd.pyd
        • Size 491KB
        • SHA256 74f64a5d724cad1c10ca9ba579b6af198178406b0a4f061685326e79cffa3eea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        all_data.json
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\all_data.json
        • Size 49KB
        • SHA256 2a8e74600b9d84b02e1bb6d02ab67eecc85032429248f6f073fb4dee5bdb656b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\base_library.zip
        • Size 1.3MB
        • SHA256 79fda090b1ef025945178494b1094899004c49bdea2e1553b13778571658a3b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        blue.json
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\customtkinter\assets\themes\blue.json
        • Size 4KB
        • SHA256 c9417470c16ced7a43d6c4a8e027afa6edc62c24d5aee7c4c2dcd11385964d3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\libssl-3.dll
        • Size 776KB
        • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\python314.dll
        • Size 6.4MB
        • SHA256 f1722bd369d79fecbc85f3ed2790c30c330b9413fd74332f95b086e60dfacc2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pythoncom314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\pywin32_system32\pythoncom314.dll
        • Size 678KB
        • SHA256 4f56f39e866d4e9c67c1bae3cbbe92a1fe70391799c1cfcb13b0d94e56c14941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\pywin32_system32\pywintypes314.dll
        • Size 133KB
        • SHA256 74f036548f3321d312205085662b2b92c0654354a718a41c44e02fd4e01fedb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\tcl86t.dll
        • Size 1.8MB
        • SHA256 e2b9614c7053410f294945d823e614a76cccd608d5cc3cb9c7a10c0335f24ebd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msgcat-1.6.1.tm
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\tcl8\8.5\msgcat-1.6.1.tm
        • Size 34KB
        • SHA256 adca186be560f2236265f538d4cb6df1171bed91192118796988bb9c08a4bc7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\tk86t.dll
        • Size 1.5MB
        • SHA256 e6c7815d9c873ab4d5fa132589fd3c35365858d8ce8853109144880484553e97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\win32\win32api.pyd
        • Size 132KB
        • SHA256 903feb110c86dffa957259f3d2a33a1c0b3c8a635d9a44a642b9ab5852d59a61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32event.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\win32\win32event.pyd
        • Size 28KB
        • SHA256 c9620ca49afe8797c46b38f161381e601dae08c391946c66b408d48cce5bb398
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32gui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\win32\win32gui.pyd
        • Size 217KB
        • SHA256 7aa66fcce2e873d5c48f3956d0398d27fb6420c8a68a2a8bc74f0622edf93571
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32process.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\win32\win32process.pyd
        • Size 52KB
        • SHA256 7d5d31073267dc0f4a770f732f2146945519fdf026a70dd86c3d3e988bacd933
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI55682\zlib1.dll
        • Size 144KB
        • SHA256 51968ab5f53a0032a250380b7725e5a1a49d1e369473a8ce1619131774fb3902
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3536-1061-0x00007FF8F8200000-0x00007FF8F8229000-memory.dmp
        Download