Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/08/2026, 22:29
Behavioral task
behavioral1
Sample
2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 56.8MB
- Sample260828-2d67zaec76
- SHA256 a262d79c223baefa4b64d1d284113471f8e5dbdb5076de852b0df9dfe5ea739b
- MD5 0bac5808320dec08f0ecda6c5343c7d4
- SHA1 9a9d9e92bb911ca0ae575013a009c994ce7ee234
- SHA512 9604da18cc83fd151c7d160e3da4f05092d942b1c5fbf32d1c99d087dd0bdf3bb080a8e3948c824637b79b52c6ab331c8039d041f2b16d333838f978f5a4840c
- SSDEEP 1572864:AF+vWlM9ojCrD4WWJvKSc/JUNnd1XV7UUoApU7ZY:FelKbDSc/iFrtUUoxY
- TLSH T132D733489B509D9FD83F903697E45C42DA72BC2E25838DC617E4063A2E9B3D8857FE31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 11 IoCs
pid Process 1296 2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 1296 2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 1296 2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 1296 2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 1296 2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 1296 2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 1296 2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 1296 2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 1296 2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 1296 2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 1296 2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3764 wrote to memory of 1296 3764 2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
PID:1296
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\_bz2.pyd
- Size 85KB
- SHA256 082a761a280b08afecf6fb0509050ffbf7e87d1638ca49466b8b3eb4c85009b4
- MD5 b831ff0ab5f28a1f3bae6842896d45ff
- SHA1 e96c4dc15ef8f55fa47eef0f5e3d4a184eeef764
- SHA512 bdac51598e349a96aa399f8d6fc6ed46b8ff797bb70b372290a941581f4b63318df9578a557a297873b827b2de2eec8cc14e3c1241cf65f3e71f5653d7b034da
- SSDEEP 1536:jGNqB8z7DyEXkmNf0/ixk+x5dxNkP88l3ub8zMDIGQIS3VvcycA89JfIYhE:CNqB8zSEJUoZlTkUGK8zJGQIS3VLV
- TLSH T189838D86F36552B6F99FD1B846840793F734BB860750A3AFF148829A3F13BD06E5C225
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\_ctypes.pyd
- Size 139KB
- SHA256 a11d680d89f054584e6a5b2a03103d8731def86e367aff2f70cce8c6367f9025
- MD5 208e7dd066f23080da03b4ebd20fbc43
- SHA1 8b56760b26be7c98a6752cacb3e78716972089ba
- SHA512 7841d4a3d6b04d00eff9e6a7ebdffea6d5a257bc095bfdfe33ffe78f2d0ce731af5021206b8e3b2e0da5ab0a27b0a65d149c346ea6c1d95fdd75087a411de40f
- SSDEEP 3072:7Eyf/PRau5nIktyc7utl1OUIVi0I1sDdMIBU8ISGPiT:oy35aynVp0qUITGs7BUS
- TLSH T146D37E0B736440E6DAA78178C6739E57EBB1F0511A1087CF4264C9AB2F633A26E3F715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\_lzma.pyd
- Size 157KB
- SHA256 2376cd374ce8c2c5ecf573226e563a96975599533f86a5f5eba5bdb705e341bb
- MD5 d412fca808a8dd9178ccf8bd9517859b
- SHA1 6088ee0ee94f6a245bac0a0d1c0e664ca630cc07
- SHA512 35afe64a19ff6737b662b9359e591bbb00c169e83609dff1c2ab1fac829316200b8a121d1bedb28bef832e7968a95e01986d20f8cb0d511e7b0d794010484e8d
- SSDEEP 3072:M0m6DHDbBwiZfxA/VcNBznfx9mNoX3mfnbOQISI1jmT:MTCHDjfDNJpYOGfbO3+
- TLSH T1E8F35C86B394F0E6F7228C38D6614F57E7F5791A0320929A01CC976D2B1FB659A2F313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\_socket.pyd
- Size 85KB
- SHA256 42b84410269af5a5578679a3fe7b17d75d28f77a0c3c09d589adadd9d2d3e5f6
- MD5 b8732b29606a0d93be25bcd924b50239
- SHA1 e7270350e71ce191d5fac5e4a6e5e7be0d0bd1d3
- SHA512 489a3c09eb6665b6ee9b460303ac35f1228684723fabe34bb29c5de7b2b12d3fa8853e1eec8b8ba3eb3e80c517cdf1a263e6b963d4e0d2d092c52567a2ccca4d
- SSDEEP 1536:QcVunc70XTxn1egypx97XP+N6wSz9GN7WQRcSqIP4fY8ISGwyycA89gfIbHqv:FEna2Dypx97XPs6wSz9+WQyS6fY8ISG7
- TLSH T109834A00AA6040F6EB76C176C6639E63FB74F5C112D4A75F1466C65A1F33382BE3AB84
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\_zstd.pyd
- Size 491KB
- SHA256 8f04a54778d4f21202f1bb9cfd5d080c5c5022158016dcaaf5908f7e2350270c
- MD5 225e0462bf8337155e78b36e3cf9fa79
- SHA1 ae944f73defa8ac5ddb3069fbb4a9da5ecafef2c
- SHA512 815201438564f8c9d57b0b8974d4b82d10bcd313e41277d85f290c0a3a94b9be8d31b5436da8704cb342f19fe68d258ee026642eca969bbb6518acd79ddb05b5
- SSDEEP 12288:MPm5BlLPg/FcxTbwWo2iD4xjnsTrWl93W6Ct0:MPm5BNg/FcxTUWo2i0x7C0
- TLSH T1FAB49D43F29943EDE17BC4B8CF465A53FBB1780B1214564B93A5CB993F07B309A6A309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\base_library.zip
- Size 1.3MB
- SHA256 13c29a16f7b88030aad444fdccf35eb7e599a40899d071783da050878c85a3a3
- MD5 1b0bad407b631cf8d376327f7441d364
- SHA1 95252c19ea189a803a5d8b0ebf878c5f1e64cbaa
- SHA512 890b01d8f9ca79ffb9924a72fcf0105c7c102e036ace25aaf6f126638bf55561dd27a62ce528d8e15c9da0db91c340e94bd90a5e51d46da13ffb7b50535965ef
- SSDEEP 24576:xHslb9ucQeOdP2m2dfaNLkdG/uUFJRpDzg2:Guc/RdeuUFJRNs2
- TLSH T1EE552AA1B9917967FEC9F37A35775A0CA715C0109B20D303B4A88DAC6FDF260AE158DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\python3.dll
- Size 72KB
- SHA256 28a395fb2bda5e71084478abea00da9ab1c1dfeb7c4856c258518bee9cc146f1
- MD5 3740e03e444c539461fedcf191758226
- SHA1 64499ea6294ed68e616d1ec25ed4892cd3740741
- SHA512 4a6e748f1619b59a281e80231f3bf1316330fe058b3860fe5902cd7021795f18a7d716a9a3490414bf637a1edcd77e71d67fb7ccefd7935a19f64d12a0da00d1
- SSDEEP 768:hQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIw:MbTrnXngXMT8ISG03ycA891fIbHqv
- TLSH T17E734D5D6B54F8A2DAF629FC78D199CE242B12FC4F2984DFA47DD3920D1A310A22734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\python314.dll
- Size 6.4MB
- SHA256 7ffe3ab11342db03cc18b026f27485c0f74f5bf10f239f1f6573394900596394
- MD5 23b7bec4bb8cf109503029b50f5eadd5
- SHA1 a5cb46bedfe2be49ae75bf0a95ab646c3256aee7
- SHA512 d687ea3c15b7fdd08ecc29e73e5310195483bae18c7b49895b0b855b0df13b0b6955d75022f842725b17e3b2ef9e922d4eb90e8819f2c8be84890d7ee49a92a3
- SSDEEP 98304:ctcc7EmUp55MA3l5vHi+LPL4G8hvGHDMiESkYD:cWc7EmUp55MMPHi9NikYD
- TLSH T1DC669E26737501A4D8BB8035C9074687DBB1BC04AB30D34B49A4B6DA3F773635BAEB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\ucrtbase.dll
- Size 964KB
- SHA256 cd2ad4d24750f39d583dcbb9e8fde4ae3f0bd28f1775d889af8a3d23299eb366
- MD5 14e6bf8a82dc6deeb9365f754ec73b90
- SHA1 ad3801acdcc893986ef96b50cfb4ac3202073882
- SHA512 79d0b75bde924eb886e0ed167c0d0290c54e6808c95d9de18eedb19f966b4b8ed3c9891554af387b0f0f0abcad4e4a097de309b3beab1c6efc474e6a854d594f
- SSDEEP 24576:EVlncbBScMaURxDDMz2UyJaoOn8ynGo5ImxvSZX0ypniU5:ilcURaUsz2U7LGjie
- TLSH T1AE25AE79B76C06FAC17BE1BCC957160AE5B63402437086CB03A64BB97E2BBD91637311
- MD5 SHA1 SHA512 SSDEEP TLSH