Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/09/2026, 08:40
General
- Target 2026-09-22_06e0ca6ff9373f6ab6842daa82231d13_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 11.2MB
- Sample260922-kk3ppaxtft
- SHA256 794c6eea17d0ec331e9d32755ee16368fd57b44ba8328518b1b3a2d7478e6c0d
Malware Config
Signatures
- Loads dropped DLL 23 IoCs
- UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-22_06e0ca6ff9373f6ab6842daa82231d13_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-22_06e0ca6ff9373f6ab6842daa82231d13_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-22_06e0ca6ff9373f6ab6842daa82231d13_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-22_06e0ca6ff9373f6ab6842daa82231d13_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
_raw_aes.pyd
_raw_aesni.pyd
_raw_cbc.pyd
_cpuid_c.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
_psutil_windows.pyd
python3.DLL
python312.dll
select.pyd
Lorem ipsum.txt
ucrtbase.dll
memory/5556-162-0x00007FF8B6920000-0x00007FF8B6953000-memory.dmp
memory/5556-119-0x00007FF8A3DC0000-0x00007FF8A4481000-memory.dmp
memory/5556-156-0x00007FF8A3DC0000-0x00007FF8A4481000-memory.dmp
memory/5556-150-0x00007FF8B7250000-0x00007FF8B725F000-memory.dmp
memory/5556-146-0x00007FF8B7810000-0x00007FF8B781D000-memory.dmp
memory/5556-164-0x00007FF8AF060000-0x00007FF8AF12E000-memory.dmp
memory/5556-142-0x00007FF8B7C70000-0x00007FF8B7C7D000-memory.dmp
memory/5556-161-0x00007FF8B7C80000-0x00007FF8B7CA5000-memory.dmp
memory/5556-157-0x00007FF8A3880000-0x00007FF8A3DB3000-memory.dmp
memory/5556-140-0x00007FF8B6990000-0x00007FF8B69A9000-memory.dmp
memory/5556-136-0x00007FF8B6D50000-0x00007FF8B6D7C000-memory.dmp
memory/5556-169-0x00007FF8B6910000-0x00007FF8B691B000-memory.dmp
memory/5556-168-0x00007FF8B7260000-0x00007FF8B7279000-memory.dmp
memory/5556-133-0x00007FF8B7260000-0x00007FF8B7279000-memory.dmp
memory/5556-131-0x00007FF8BABF0000-0x00007FF8BABFF000-memory.dmp
memory/5556-173-0x00007FF8B68F0000-0x00007FF8B6902000-memory.dmp
memory/5556-175-0x00007FF8B68E0000-0x00007FF8B68EC000-memory.dmp
memory/5556-128-0x00007FF8B7C80000-0x00007FF8B7CA5000-memory.dmp
memory/5556-178-0x00007FF8B68C0000-0x00007FF8B68D9000-memory.dmp
memory/5556-154-0x00007FF8B6960000-0x00007FF8B6974000-memory.dmp
memory/5556-181-0x00007FF8B67D0000-0x00007FF8B67DB000-memory.dmp
memory/5556-184-0x00007FF8BABF0000-0x00007FF8BABFF000-memory.dmp
memory/5556-199-0x00007FF8B67D0000-0x00007FF8B67DB000-memory.dmp
memory/5556-200-0x00007FF8A3DC0000-0x00007FF8A4481000-memory.dmp
memory/5556-201-0x00007FF8A3880000-0x00007FF8A3DB3000-memory.dmp
memory/5556-194-0x00007FF8AF060000-0x00007FF8AF12E000-memory.dmp
memory/5556-197-0x00007FF8B68E0000-0x00007FF8B68EC000-memory.dmp
memory/5556-196-0x00007FF8B68F0000-0x00007FF8B6902000-memory.dmp
memory/5556-195-0x00007FF8B6910000-0x00007FF8B691B000-memory.dmp
memory/5556-193-0x00007FF8B6920000-0x00007FF8B6953000-memory.dmp
memory/5556-191-0x00007FF8B6960000-0x00007FF8B6974000-memory.dmp
memory/5556-190-0x00007FF8B7250000-0x00007FF8B725F000-memory.dmp
memory/5556-189-0x00007FF8B7810000-0x00007FF8B781D000-memory.dmp
memory/5556-188-0x00007FF8B7C70000-0x00007FF8B7C7D000-memory.dmp
memory/5556-187-0x00007FF8B6990000-0x00007FF8B69A9000-memory.dmp
memory/5556-186-0x00007FF8B6D50000-0x00007FF8B6D7C000-memory.dmp
memory/5556-183-0x00007FF8B7C80000-0x00007FF8B7CA5000-memory.dmp
memory/5556-198-0x00007FF8B68C0000-0x00007FF8B68D9000-memory.dmp
memory/5556-185-0x00007FF8B7260000-0x00007FF8B7279000-memory.dmp