Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 08:23
Behavioral task
behavioral1
Sample
2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 8.2MB
- Sample260910-j951nstscs
- SHA256 a150572fb4f8dfd0cfc3cf9ee7bbd45e71249c3dba7001a8585075f8a260205b
- MD5 fee0b2b613ac31ffedd3ad87c0e865b5
- SHA1 ac5a2cefa9c5b27b8e368902792494c2ca2aab9c
- SHA512 996e2da938a542c54ef8c06062ec2c261120612159b4f6a4656546c1a2987494fb4515d3160093be3497b1c9def83d7660e8bcab1da00d58ad176d1c4b799696
- SSDEEP 196608:3tXLKCW9LrsW4gXyTntTFqq8N3tuHsGXqr3pXFBFE7E:RLK99LrGtZq5XuHsGXqD7BN
- TLSH T1F386335893D418ABE897627C8AB3D565D291FC121B21CDEF27E1473E3F63290483A79C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
pid Process 3704 2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3704 2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3704 2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3704 2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3704 2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3704 2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3704 2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3704 2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3704 2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 3704 2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 4760 cscript.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5864 wmic.exe 5864 wmic.exe 5864 wmic.exe 5864 wmic.exe 6084 wmic.exe 6084 wmic.exe 6084 wmic.exe 6084 wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5864 wmic.exe Token: SeSecurityPrivilege 5864 wmic.exe Token: SeTakeOwnershipPrivilege 5864 wmic.exe Token: SeLoadDriverPrivilege 5864 wmic.exe Token: SeSystemProfilePrivilege 5864 wmic.exe Token: SeSystemtimePrivilege 5864 wmic.exe Token: SeProfSingleProcessPrivilege 5864 wmic.exe Token: SeIncBasePriorityPrivilege 5864 wmic.exe Token: SeCreatePagefilePrivilege 5864 wmic.exe Token: SeBackupPrivilege 5864 wmic.exe Token: SeRestorePrivilege 5864 wmic.exe Token: SeShutdownPrivilege 5864 wmic.exe Token: SeDebugPrivilege 5864 wmic.exe Token: SeSystemEnvironmentPrivilege 5864 wmic.exe Token: SeRemoteShutdownPrivilege 5864 wmic.exe Token: SeUndockPrivilege 5864 wmic.exe Token: SeManageVolumePrivilege 5864 wmic.exe Token: 33 5864 wmic.exe Token: 34 5864 wmic.exe Token: 35 5864 wmic.exe Token: 36 5864 wmic.exe Token: SeIncreaseQuotaPrivilege 5864 wmic.exe Token: SeSecurityPrivilege 5864 wmic.exe Token: SeTakeOwnershipPrivilege 5864 wmic.exe Token: SeLoadDriverPrivilege 5864 wmic.exe Token: SeSystemProfilePrivilege 5864 wmic.exe Token: SeSystemtimePrivilege 5864 wmic.exe Token: SeProfSingleProcessPrivilege 5864 wmic.exe Token: SeIncBasePriorityPrivilege 5864 wmic.exe Token: SeCreatePagefilePrivilege 5864 wmic.exe Token: SeBackupPrivilege 5864 wmic.exe Token: SeRestorePrivilege 5864 wmic.exe Token: SeShutdownPrivilege 5864 wmic.exe Token: SeDebugPrivilege 5864 wmic.exe Token: SeSystemEnvironmentPrivilege 5864 wmic.exe Token: SeRemoteShutdownPrivilege 5864 wmic.exe Token: SeUndockPrivilege 5864 wmic.exe Token: SeManageVolumePrivilege 5864 wmic.exe Token: 33 5864 wmic.exe Token: 34 5864 wmic.exe Token: 35 5864 wmic.exe Token: 36 5864 wmic.exe Token: SeIncreaseQuotaPrivilege 6084 wmic.exe Token: SeSecurityPrivilege 6084 wmic.exe Token: SeTakeOwnershipPrivilege 6084 wmic.exe Token: SeLoadDriverPrivilege 6084 wmic.exe Token: SeSystemProfilePrivilege 6084 wmic.exe Token: SeSystemtimePrivilege 6084 wmic.exe Token: SeProfSingleProcessPrivilege 6084 wmic.exe Token: SeIncBasePriorityPrivilege 6084 wmic.exe Token: SeCreatePagefilePrivilege 6084 wmic.exe Token: SeBackupPrivilege 6084 wmic.exe Token: SeRestorePrivilege 6084 wmic.exe Token: SeShutdownPrivilege 6084 wmic.exe Token: SeDebugPrivilege 6084 wmic.exe Token: SeSystemEnvironmentPrivilege 6084 wmic.exe Token: SeRemoteShutdownPrivilege 6084 wmic.exe Token: SeUndockPrivilege 6084 wmic.exe Token: SeManageVolumePrivilege 6084 wmic.exe Token: 33 6084 wmic.exe Token: 34 6084 wmic.exe Token: 35 6084 wmic.exe Token: 36 6084 wmic.exe Token: SeIncreaseQuotaPrivilege 6084 wmic.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1240 wrote to memory of 3704 1240 2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 90 PID 3704 wrote to memory of 5864 3704 2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 92 PID 3704 wrote to memory of 6084 3704 2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 93 PID 3704 wrote to memory of 4760 3704 2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_fee0b2b613ac31ffedd3ad87c0e865b5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\System32\Wbem\wmic.exewmic bios get serialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5864
-
-
C:\Windows\System32\Wbem\wmic.exewmic path SoftwareLicensingProduct where "LicenseStatus=1 and GracePeriodRemaining=0 and PartialProductKey is not NULL" get Name3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6084
-
-
C:\Windows\SYSTEM32\cscript.execscript //nologo C:\Windows\System32\slmgr.vbs /xpr3⤵
- Executes a VBScript file via the Windows Script Host.
PID:4760
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\VCRUNTIME140_1.dll
- Size 48KB
- SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
- MD5 c0c0b4c611561f94798b62eb43097722
- SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
- SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
- SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
- TLSH T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_bz2.pyd
- Size 86KB
- SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
- MD5 28cea50945ec6972c8ec096bf562fb9e
- SHA1 52c0e93d37e30503351c7878f0e041f5a207b103
- SHA512 28f46b34cb59ab5b8f3791138e3d05216c7eef2b38dce035180546b22b7f0c8fab9c1ec8a6a82b219de327d752cfc89ddc289996c2135273bd3106b7a5eceb19
- SSDEEP 1536:kcCxPVz7WtNyDJo7it8PWRgT6vu9zJ4iaOkx99gV8G2RbNGWC4Ij3V6yYiS9HZfC:uxPVz7D/CaOkH9gallEWC4Ij3VHTJ
- TLSH T127838E82F364A3F6F59F90B4D6850793F730BB460750A36FB24482853F12F91AE69366
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_ctypes.pyd
- Size 139KB
- SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
- MD5 fdda26bd63d43178c9aca5003f6a7e42
- SHA1 48037f1f68aad29e1002573337d2357f8972d045
- SHA512 f15b3b0a14c9975995d3d340c347c17b13c178c270bdebf9b153bf0df3d5eda2df8676ccc9efccc299a260fcab64afcd7b5e44809b6265f98f995003b59b05de
- SSDEEP 3072:j/n1qQ8/2wN56EBZ+mwrWozIsswKRHk+HrwEIjGPfF:zn1JDm6fr5zIsfURLws
- TLSH T193D38F4B336841E6D6678138C6739E47FBB1F4521A10878F4264C99B2F637A2AE3F315
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_lzma.pyd
- Size 157KB
- SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
- MD5 1f2c927c6f1773093e6939e0f0075997
- SHA1 36b5cccb9e64405fbf460b65a2da5b18241b7087
- SHA512 eeaedf6685684699202dc7c48f2a70ea4c6ed41dbd7824607eee3b1e5e7b5b90e4c7f7efc808a5d0e54534135e450d9fb7602c00e0f213da80d8563b7909f0bd
- SSDEEP 3072:sJ66g4T5QW7JfyjEqkSkA51b4oznfx9mNo/Updb4IjI10CS:sUR4Tp4QPZ8N4epYOKbvv
- TLSH T1DFF34C86B794F0E6F7228C78D2624F57E6F578190320939A01CC976D2B1FB759A2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_socket.pyd
- Size 85KB
- SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
- MD5 893ee6bcfa6b5a527b61eceb80257871
- SHA1 9a15db53180c3a9004e119dfe9c8858b4bdca994
- SHA512 b0a885c9d72468ccffd0ab0ec5a720f511a288f5117cbb6df8822ef8df4fb5f602aef112dda9f726b4ca53328964a890afd2a3becdebf8c3447e1684ae1cc34c
- SSDEEP 1536:6cVuncT0XH3XAJtZypxC7XP+66wSzM/jAjI/Lb6NsQ3cs8PgMrEIjGwnyYiS9zfG:jEny2+jypxC7XPz6wSzM/jAjQOsQssV7
- TLSH T1F7835B41AA6041F6EB73C072C2679E63FB74B5C01294A35F1466C65A1F333C2BE3AB85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_wmi.pyd
- Size 39KB
- SHA256 6fb2c6316628664319b2abcf961f0cbbac809966a65b653c86e7864ad8701496
- MD5 bca71458b37ab9784290593636006405
- SHA1 4a7effcc12a283b9c65a06b6af62c1cc44820861
- SHA512 fd7e5e40a9cde0253684cf0ff6f343c60c597087eda27cfa3726ec2d870b4dea1e7140c55e0de7eca0f5ee36eae32fa0092cd88be4e9969c91cdb94ac923ab7c
- SSDEEP 768:y2/EEqrVmjsJuMOQMV4Ij3iYyYTegc2Ip4K4Txf1ml9dHx7Lsc:XE9BE3MOQMV4Ij3iYyYiS9JfIbHxnsc
- TLSH T14B037D85E6644052FA67C571C0A6CE93F971BB935B11878F32A582990F333D1E73A329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_zstd.pyd
- Size 491KB
- SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
- MD5 256a79eff7505cc58fbf59d863c5c543
- SHA1 343939f8652fc56fb338bf1ec4c4de3c697070fc
- SHA512 993459b4b1f289be955940d6914873d190a9c3c8e646073e7603cd73fbd1d984d760f0e683ac11694b609de11a4084e6b9aa1cb755b1f63451255617f38e4605
- SSDEEP 12288:JccWmYLKvveelCu30rz+Q2sTrWl939ruf:JccWJKvveelCu30rzc+f
- TLSH T1B1B48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\base_library.zip
- Size 1.3MB
- SHA256 f590a6b6ecf7d311bcccada3298dbbebfb3e964038220816ac86d8ca7419e1d2
- MD5 557f7095a4f87c055cc12883ed368555
- SHA1 0edfeab0bc24e824ed809fb4af5b2c43d354e70c
- SHA512 8e537a1f24f08aa1135b0f8a66327ab11276780dfa9edd4035b568e4e82131b75b7ba12177c89022fe12e515a077f4bc71d8b8cd2b4743a6b3729cd91b656a87
- SSDEEP 24576:w3Ealb63oIuUFFRpzQeOdP2m2dfvdWiLV9:w+33uUFFRV/HdL
- TLSH T14A552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\python314.dll
- Size 6.5MB
- SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
- MD5 49232f3b18bf5e2c2bd8ae0c9ad99913
- SHA1 7d69e9b82972a41e69d3558868229b8b004ce534
- SHA512 72a98bfd6771d0136848f4ba3f639b81a4b6d48b6d820b1495167819e5ec86fe763029c3e8e1c74d68310e08ba1dab4a0a11b3cf6acd72912740144a1ad64af4
- SSDEEP 98304:vnKFXcgNEs5c00S048PePvOh0evvlHDMiEiV9:vnKFXcgNw00S0487Ei/
- TLSH T13B668D26737501A5D9BB8035C9034687DBB1BC00AB30D34B49A47ADA3F733635BAEB95
- MD5 SHA1 SHA512 SSDEEP TLSH