Analysis
- max time kernel
150s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/08/2026, 15:23
General
- Target 2026-08-16_0cc2f665211625f19e632392d46e3e15_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 11.0MB
- Sample260816-ssydyaec28
- SHA256 8fa08179f0c2894e7f1cbbb46c470465fc5c128bde3bd051f1d5d400edf6c296
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 8 IoCs
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 8 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 8 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 8 IoCs
- UPX dump on OEP (original entry point) 10 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 5 IoCs
- UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_0cc2f665211625f19e632392d46e3e15_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_0cc2f665211625f19e632392d46e3e15_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_0cc2f665211625f19e632392d46e3e15_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_0cc2f665211625f19e632392d46e3e15_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_Jcu1lFdL5dPlYwZSpqKiVdQl.exeC:\Users\Admin\AppData\Local\Temp\_Jcu1lFdL5dPlYwZSpqKiVdQl.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_Jcu1lFdL5dPlYwZSpqKiVdQl.exe
VCRUNTIME140.dll
_bz2.pyd
_lzma.pyd
base_library.zip
python313.dll
ucrtbase.dll
memory/2532-69-0x0000000000990000-0x00000000015E6000-memory.dmp
memory/2532-74-0x0000000000990000-0x00000000015E6000-memory.dmp
memory/2532-78-0x0000000000990000-0x00000000015E6000-memory.dmp
memory/2532-82-0x0000000000990000-0x00000000015E6000-memory.dmp
memory/2532-90-0x0000000000990000-0x00000000015E6000-memory.dmp
memory/2532-102-0x0000000000990000-0x00000000015E6000-memory.dmp
memory/2532-110-0x0000000000990000-0x00000000015E6000-memory.dmp
memory/2532-118-0x0000000000990000-0x00000000015E6000-memory.dmp
memory/2532-122-0x0000000000990000-0x00000000015E6000-memory.dmp
memory/5760-64-0x00007FFAAE810000-0x00007FFAAE83B000-memory.dmp
memory/5760-62-0x00007FFAAE840000-0x00007FFAAE85A000-memory.dmp
memory/5760-56-0x00007FFA95CB0000-0x00007FFA96319000-memory.dmp
memory/5760-70-0x00007FFA95CB0000-0x00007FFA96319000-memory.dmp