Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/08/2026, 22:29

General

  • Target
    2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 56.8MB
  • Sample260828-2d67zaec76
  • SHA256 a262d79c223baefa4b64d1d284113471f8e5dbdb5076de852b0df9dfe5ea739b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 11 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3764
    • C:\Users\Admin\AppData\Local\Temp\2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-28_0bac5808320dec08f0ecda6c5343c7d4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      PID:1296

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _bz2.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\_bz2.pyd
        • Size 85KB
        • SHA256 082a761a280b08afecf6fb0509050ffbf7e87d1638ca49466b8b3eb4c85009b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _ctypes.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\_ctypes.pyd
        • Size 139KB
        • SHA256 a11d680d89f054584e6a5b2a03103d8731def86e367aff2f70cce8c6367f9025
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _lzma.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\_lzma.pyd
        • Size 157KB
        • SHA256 2376cd374ce8c2c5ecf573226e563a96975599533f86a5f5eba5bdb705e341bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _socket.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\_socket.pyd
        • Size 85KB
        • SHA256 42b84410269af5a5578679a3fe7b17d75d28f77a0c3c09d589adadd9d2d3e5f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _zstd.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\_zstd.pyd
        • Size 491KB
        • SHA256 8f04a54778d4f21202f1bb9cfd5d080c5c5022158016dcaaf5908f7e2350270c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base_library.zip

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\base_library.zip
        • Size 1.3MB
        • SHA256 13c29a16f7b88030aad444fdccf35eb7e599a40899d071783da050878c85a3a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libffi-8.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\python3.dll
        • Size 72KB
        • SHA256 28a395fb2bda5e71084478abea00da9ab1c1dfeb7c4856c258518bee9cc146f1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python314.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\python314.dll
        • Size 6.4MB
        • SHA256 7ffe3ab11342db03cc18b026f27485c0f74f5bf10f239f1f6573394900596394
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ucrtbase.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI37642\ucrtbase.dll
        • Size 964KB
        • SHA256 cd2ad4d24750f39d583dcbb9e8fde4ae3f0bd28f1775d889af8a3d23299eb366
        • MD5 SHA1 SHA512 SSDEEP TLSH