Overview

overview

7

Static

static

3

2026-09-10...at.exe

windows10-2004-x64

7

2026-09-10...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    159s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 11:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-10_bf756530a79bd2d8d1493efe2f470aa6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 65.8MB
  • Sample260910-na349abm3z
  • SHA256 2f8611230e1e5a9519c95fc55014d7dd1db9bb33aa40341ff77454260ebde988
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
persistenceprivilege_escalation

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Loads dropped DLL 30 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-10_bf756530a79bd2d8d1493efe2f470aa6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-10_bf756530a79bd2d8d1493efe2f470aa6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5616
    • C:\Users\Admin\AppData\Local\Temp\2026-09-10_bf756530a79bd2d8d1493efe2f470aa6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-10_bf756530a79bd2d8d1493efe2f470aa6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      PID:4472

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\_bz2.pyd
        • Size 83KB
        • SHA256 965f199679afa9b31d537d98c3ca8403afd6b9e58e1a463ae47697ae4bf12771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\_cffi_backend.cp313-win_amd64.pyd
        • Size 176KB
        • SHA256 d5b09da2e726b4e90cf0edad5d2a0ec52f369dfd060e14d3807a32b2205031fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\_ctypes.pyd
        • Size 129KB
        • SHA256 697d05cac7c167c00ccf22ea4fdbc7a8db93ab9c6421061191558e42478068c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\_hashlib.pyd
        • Size 68KB
        • SHA256 1430e4a2ed19eda840668a292c39ff44488b598f53e903a61739a86b779ecbfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\_lzma.pyd
        • Size 156KB
        • SHA256 b78f5a8476139ff04731046459efd047bb8f52dc92c5b2082eabf2929c0ca02d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\_queue.pyd
        • Size 33KB
        • SHA256 08050f94efe7bdd9d7cbe85b1196de391cac1b30f4a4918610cb174ae529a5db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\_socket.pyd
        • Size 84KB
        • SHA256 c63e8e6a369cbe86e57c9823fb48bc5d4e7bb18455b9b001986b4768c49007da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\_ssl.pyd
        • Size 177KB
        • SHA256 11572f6eb63e43cdc2908812506ffcdab21be2be5931f1e38d856c15f5a79e6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\_uuid.pyd
        • Size 27KB
        • SHA256 6a3e6d89e71a803609e6e765a592011427a5b6e7a4766bbca7790b601bb66dbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\_wmi.pyd
        • Size 39KB
        • SHA256 a7cc096244a497219269a3ee1cf2526a2b613d73fa566749f8f2408f5f4117d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\base_library.zip
        • Size 1.3MB
        • SHA256 d07858759797c2fd831be223187ae1fc2f39925814e04bf05f43ee40b3f5eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\certifi\cacert.pem
        • Size 277KB
        • SHA256 2b7b1026f18a297e2148189ca0cbe7d3e7f9efc36f7231ccc2820a404feb5596
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\charset_normalizer\md.cp313-win_amd64.pyd
        • Size 10KB
        • SHA256 76c8700ffc983bbec07468e354039b21e25e49e7c19f43d7343994c90d4bb7bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
        • Size 122KB
        • SHA256 e9c308245fe01d33ef92c7026115a0a930fd865fbe1bfcefa91e76c6aa32a0b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _rust.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\cryptography\hazmat\bindings\_rust.pyd
        • Size 8.8MB
        • SHA256 92f58bb4f01a75a0ef4dd9425dc2a96ddfe25fc93fd9dc11ea8f0d05b7a4f085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __init__.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\cv2\__init__.py
        • Size 6KB
        • SHA256 957a91bfd98ffb07a10cd789b7c5c46806568476b61e34c7ad56a00092b981a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        config-3.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\cv2\config-3.py
        • Size 748B
        • SHA256 de28c7b5213cca148f09469916584611b3d66c1c8c432880259d6a3a92380213
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        config.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\cv2\config.py
        • Size 123B
        • SHA256 6c6367abce55995ae4a8d3c199420ec53afab287cb17dfc2f430378af75dd301
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        load_config_py3.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\cv2\load_config_py3.py
        • Size 271B
        • SHA256 ff583a5874be8f848e73c2f61b3a71680995926479c9bc436e6565c5cce7ca07
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        version.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\cv2\version.py
        • Size 96B
        • SHA256 15b7c0fa1755b7bcc1eabaa248576a2d244890dff7aff3b4538f816a46b29804
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\libssl-3.dll
        • Size 776KB
        • SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libscipy_openblas64_-13e2df515630b4a41f92893938845698.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\numpy.libs\libscipy_openblas64_-13e2df515630b4a41f92893938845698.dll
        • Size 19.4MB
        • SHA256 6547e9fb966e9773caee2755e91a8bf4d6f3a2f0eebf9646b0158f8675ea4ab5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140-263139962577ecda4cd9469ca360a746.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\numpy.libs\msvcp140-263139962577ecda4cd9469ca360a746.dll
        • Size 561KB
        • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiarray_umath.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\numpy\_core\_multiarray_umath.cp313-win_amd64.pyd
        • Size 4.0MB
        • SHA256 64b08945fb969e50f56fa2e993f018e3eeaa14c077f24efbf3b4cb0bb0606a6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _umath_linalg.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\numpy\linalg\_umath_linalg.cp313-win_amd64.pyd
        • Size 105KB
        • SHA256 c6924a5773009521015502ae9f38b7b98ca3d278a3eea1568a01dea9b6464b28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\python3.DLL
        • Size 70KB
        • SHA256 85d02d4c7e28c0f183415dc2be5fe8e06aa7fa0567673c75c65c0031f59e1e8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\python313.dll
        • Size 5.8MB
        • SHA256 0565965617d94274d7f2c2958d0bef33392cd9d2f346f99d8e1bedbdf264ee85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\select.pyd
        • Size 32KB
        • SHA256 d1e486de9653640be7c3a9bed04aa716b29ea76a69e1de758dd9fa708f2c9d38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\ucrtbase.dll
        • Size 1.3MB
        • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56162\unicodedata.pyd
        • Size 695KB
        • SHA256 e7d0375a7064b1c8916cca7cabf7e3df559fc8463dfdf831f403e95c79499121
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4472-183-0x00007FFCD2830000-0x00007FFCD3BAB000-memory.dmp
        Download