Analysis
- max time kernel
149s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
19/08/2026, 23:04
General
- Target 2026-08-19_35ac24d025e19e4efa8f6d943dc271e9_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 9.0MB
- Sample260819-22rgesab43
- SHA256 9a0a2eb7a45684b6805becf380bc6efb8ae4bef21d2b16da009728422fbb7090
Malware Config
Signatures
- Detects executables manipulated with Fody 2 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 14 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_35ac24d025e19e4efa8f6d943dc271e9_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_35ac24d025e19e4efa8f6d943dc271e9_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_35ac24d025e19e4efa8f6d943dc271e9_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_35ac24d025e19e4efa8f6d943dc271e9_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\fxwcnuec.exe"C:\Users\Admin\AppData\Local\fxwcnuec.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python314.dll
ucrtbase.dll
unicodedata.pyd
fxwcnuec.exe
memory/5596-95-0x00007FF8CF0A0000-0x00007FF8CFA44000-memory.dmp
memory/5596-94-0x0000000000EE0000-0x0000000000FCA000-memory.dmp
memory/5596-93-0x00007FF8CF22F000-0x00007FF8CF230000-memory.dmp
memory/5596-96-0x00007FF8CF0A0000-0x00007FF8CFA44000-memory.dmp
memory/5596-97-0x00007FF8CF0A0000-0x00007FF8CFA44000-memory.dmp
memory/5596-98-0x000000001EA80000-0x000000001EB10000-memory.dmp
memory/5596-99-0x00007FF8CF0A0000-0x00007FF8CFA44000-memory.dmp
memory/5596-100-0x00007FF8CF0A0000-0x00007FF8CFA44000-memory.dmp
memory/5596-101-0x00007FF8CF0A0000-0x00007FF8CFA44000-memory.dmp
memory/5596-102-0x000000001F1A0000-0x000000001F2E1000-memory.dmp
memory/5596-103-0x00007FF8CF0A0000-0x00007FF8CFA44000-memory.dmp