Overview

overview

10

Static

static

10

2026-09-10...at.exe

windows10-2004-x64

7

2026-09-10...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 09:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-10_dca652e78617860051631339b227ff25_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 69.6MB
  • Sample260910-lvbvdsgd79
  • SHA256 12b230d9bebef48ed669b9fa843d698b937df914231a4f5ea6c34fb7512c8cea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionspywarestealer

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

    execution
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-10_dca652e78617860051631339b227ff25_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-10_dca652e78617860051631339b227ff25_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Users\Admin\AppData\Local\Temp\2026-09-10_dca652e78617860051631339b227ff25_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-10_dca652e78617860051631339b227ff25_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:5052
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:6016
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_BIOS).SerialNumber"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:6004
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_BaseBoard).SerialNumber"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5892
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_Processor).ProcessorId"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2016
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_BIOS).OEMStringArray"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5644
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_SystemEnclosure).SMBIOSAssetTag"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4972

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_asyncio.pyd
        • Size 69KB
        • SHA256 3b46fa8f966288ead65465468c8e300b9179f5d7b39aa25d7231ff3702ca7887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_bz2.pyd
        • Size 83KB
        • SHA256 cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_ctypes.pyd
        • Size 122KB
        • SHA256 6c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_hashlib.pyd
        • Size 64KB
        • SHA256 43acecdc00dd5f9a19b48ff251106c63c975c732b9a2a7b91714642f76be074d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_lzma.pyd
        • Size 156KB
        • SHA256 a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_overlapped.pyd
        • Size 54KB
        • SHA256 2187281a097025c03991cd8eb2c9ca416278b898bd640a8732421b91ada607e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_queue.pyd
        • Size 31KB
        • SHA256 0a6acfd24dfbaa777460c6d003f71af473d5415607807973a382512f77d075fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_socket.pyd
        • Size 81KB
        • SHA256 67aca001d36f2fce6d88dbf46863f60c0b291395b6777c22b642198f98184ba3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_ssl.pyd
        • Size 174KB
        • SHA256 fa5e6fe9545f83704f78316e27446a0026fbebb9c0c3c63faed73a12d89784d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\_wmi.pyd
        • Size 36KB
        • SHA256 73b7ee3156ef63d6eb7df9900ef3d200a276df61a70d08bd96f5906c39a3ac32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_parser.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\aiohttp\_http_parser.cp312-win_amd64.pyd
        • Size 257KB
        • SHA256 bdfe70430c50d1a1d9f071d02ba3d00d791de6c7c237ad566eb0b63b231c4ce8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_writer.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\aiohttp\_http_writer.cp312-win_amd64.pyd
        • Size 48KB
        • SHA256 f95a169ec5e565391943f2484d9a040d356a916b4638748fbad071ebfde2da62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mask.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\aiohttp\_websocket\mask.cp312-win_amd64.pyd
        • Size 35KB
        • SHA256 1587a6b70da9a8afdc3f0985a651e48b93ee97f27cd532cc45f1c1137c5c20d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\base_library.zip
        • Size 1.3MB
        • SHA256 3b1d348d54b89dcf30de34d9260a926a95b20749b7effdcba8f17caf51ba7c6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\certifi\cacert.pem
        • Size 290KB
        • SHA256 c55b21f907f7f86d48add093552fb5651749ff5f860508ccbb423d6c1fbd80c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\charset_normalizer\md.cp312-win_amd64.pyd
        • Size 10KB
        • SHA256 5c11b2fbe20a75aedcde205fbf0fdda2fa1ca9bd914ae72656dc6fb651bfded0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
        • Size 122KB
        • SHA256 ffe8d64a38b4060055beb2076e669b61034c045e3ec53bac74ee66bba3fc26c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multidict.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\multidict\_multidict.cp312-win_amd64.pyd
        • Size 45KB
        • SHA256 b521b7e3b6bed424a0719c36735bc4bf2bb8b0926370b31c221c604e81f8d78b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _helpers_c.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\propcache\_helpers_c.cp312-win_amd64.pyd
        • Size 72KB
        • SHA256 b922798924c80e2179e93b74d9c9bd7ba913d60fa030b6307db53d52028ac3fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\pyexpat.pyd
        • Size 197KB
        • SHA256 d32d7722d6ed2b2780c039d63af044554c0ba9cf6e6efef28ebc79cb443d2da0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\python3.DLL
        • Size 66KB
        • SHA256 25a39e721c26e53bec292395d093211bba70465280acfa2059fa52957ec975b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\python312.dll
        • Size 6.6MB
        • SHA256 c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\pywin32_system32\pywintypes312.dll
        • Size 133KB
        • SHA256 2d1d60b996d1d5c56c24313d97e0fcda41a8bd6bf0299f6ea4eb4a1e25d490b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\select.pyd
        • Size 30KB
        • SHA256 00bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\unicodedata.pyd
        • Size 1.1MB
        • SHA256 bf669344d1b1c607d10304be47d2a2fb572e043109181e2c5c1038485af0c3d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\win32\win32api.pyd
        • Size 130KB
        • SHA256 df724f6abd66a0549415abaa3fdf490680e6e0ce07584e964b8bfd01e187b487
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _quoting_c.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI30522\yarl\_quoting_c.cp312-win_amd64.pyd
        • Size 95KB
        • SHA256 8011cda4dd0e7c591c82d91243b6a8edfc4d95056e99bd123ade9cf02d76e32d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_0a3iob2r.pc2.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0a3iob2r.pc2.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2016-1165-0x000001952B210000-0x000001952B2DD000-memory.dmp
        Download

        memory/4972-1173-0x000001A34BAC0000-0x000001A34BB8D000-memory.dmp
        Download

        memory/5052-1177-0x000001DA6AB30000-0x000001DA6ACA9000-memory.dmp
        Download

        memory/5052-1174-0x000001DA6AB30000-0x000001DA6ACA9000-memory.dmp
        Download

        memory/5644-1169-0x000001E80B830000-0x000001E80B8FD000-memory.dmp
        Download

        memory/5892-1161-0x00000263E1D60000-0x00000263E1E2D000-memory.dmp
        Download

        memory/6004-1157-0x0000019BCB1F0000-0x0000019BCB2BD000-memory.dmp
        Download

        memory/6016-1145-0x00007FFF165E0000-0x00007FFF16F84000-memory.dmp
        Download

        memory/6016-1152-0x000001963B7E0000-0x000001963B8AD000-memory.dmp
        Download

        memory/6016-1153-0x00007FFF165E0000-0x00007FFF16F84000-memory.dmp
        Download

        memory/6016-1150-0x00007FFF165E0000-0x00007FFF16F84000-memory.dmp
        Download

        memory/6016-1149-0x00007FFF165E0000-0x00007FFF16F84000-memory.dmp
        Download

        memory/6016-1148-0x00007FFF165E0000-0x00007FFF16F84000-memory.dmp
        Download

        memory/6016-1147-0x00007FFF165E0000-0x00007FFF16F84000-memory.dmp
        Download

        memory/6016-1146-0x00007FFF165E0000-0x00007FFF16F84000-memory.dmp
        Download

        memory/6016-1144-0x00007FFF165E0000-0x00007FFF16F84000-memory.dmp
        Download

        memory/6016-1143-0x00007FFF165E0000-0x00007FFF16F84000-memory.dmp
        Download

        memory/6016-1142-0x0000019654030000-0x0000019654052000-memory.dmp
        Download

        memory/6016-1139-0x00007FFF1676F000-0x00007FFF16770000-memory.dmp
        Download