Overview

overview

7

Static

static

3

2026-09-24...at.exe

windows10-2004-x64

7

2026-09-24...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 05:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_8be5b0e3d5ea4d41ad3a13d11ec3493a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 88.1MB
  • Sample260925-fxjecsttfw
  • SHA256 eca05798b7443b6022481ad1022e8225221e17c97bc6cef3f736d05e72f24542
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 64 IoCs
  • Looks up external IP address via web service 1 TTPs 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Drops file in System32 directory 6 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_8be5b0e3d5ea4d41ad3a13d11ec3493a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_8be5b0e3d5ea4d41ad3a13d11ec3493a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5232
    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_8be5b0e3d5ea4d41ad3a13d11ec3493a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_8be5b0e3d5ea4d41ad3a13d11ec3493a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3048
      • C:\Windows\SYSTEM32\whoami.exe
        whoami
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4412
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks.exe /Create /TN WindowsUpdateService /TR \"C:\Windows\System32\write.exe\" /SC ONLOGON /RU Admin /IT /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1728
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D8
    1⤵
      PID:5128
    • C:\Windows\System32\write.exe
      "C:\Windows\System32\write.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5424
      • C:\Windows\System32\write.exe
        "C:\Windows\System32\write.exe"
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2748
        • C:\Windows\System32\whoami.exe
          whoami
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2160
        • C:\Windows\System32\schtasks.exe
          schtasks.exe /Create /TN WindowsUpdateService /TR \"C:\Windows\System32\WindowsUpdateService.exe\" /SC ONLOGON /RU Admin /IT /F
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:5420
    • C:\Windows\System32\WindowsUpdateService.exe
      "C:\Windows\System32\WindowsUpdateService.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5772
      • C:\Windows\System32\WindowsUpdateService.exe
        "C:\Windows\System32\WindowsUpdateService.exe"
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:6040
        • C:\Windows\System32\whoami.exe
          whoami
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:236
        • C:\Windows\System32\schtasks.exe
          schtasks.exe /Create /TN WindowsUpdateService /TR \"C:\Windows\System32\LocationManager.exe\" /SC ONLOGON /RU Admin /IT /F
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2796
    • C:\Windows\System32\LocationManager.exe
      "C:\Windows\System32\LocationManager.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1056
      • C:\Windows\System32\LocationManager.exe
        "C:\Windows\System32\LocationManager.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5376

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          elevation_log.log
          • Path C:\Users\Admin\AppData\Local\Temp\210_MAS\elevation_log.log
          • Size 681B
          • SHA256 dbd1e57fcd5f654634df65bc5946495f670434b2201d7b36d77f18f778b2b038
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          elevation_log.log
          • Path C:\Users\Admin\AppData\Local\Temp\210_MAS\elevation_log.log
          • Size 1KB
          • SHA256 4958c6eb9223bd809d5fd86d344964208b7683be5e19c1c43215a2fca67626eb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          elevation_log.log
          • Path C:\Users\Admin\AppData\Local\Temp\210_MAS\elevation_log.log
          • Size 1KB
          • SHA256 7963d67ec3560968bb5b1288b23843f82306efc0d6501b820472a9a4045b22b2
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          elevation_log.log
          • Path C:\Users\Admin\AppData\Local\Temp\210_MAS\elevation_log.log
          • Size 2KB
          • SHA256 0ff12ddd313156a072e72b5338226d67618a5808fe3abf83aad02a5c9d8e6de7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          elevation_log.log
          • Path C:\Users\Admin\AppData\Local\Temp\210_MAS\elevation_log.log
          • Size 2KB
          • SHA256 0bd7ae085219cf6167c0d86a82e5f27e4587061e63204dd33660643c7e9011d1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          elevation_log.log
          • Path C:\Users\Admin\AppData\Local\Temp\210_MAS\elevation_log.log
          • Size 3KB
          • SHA256 8f437503894fd7b238cf6492cedf8580feaa95bfcc2193fa71d1643aa2934236
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          elevation_log.log
          • Path C:\Users\Admin\AppData\Local\Temp\210_MAS\elevation_log.log
          • Size 4KB
          • SHA256 96095f55635485d8a1624d35cf400629e556bc5ea4884d0bedf9c3ef85b96df4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\81d243bd2c585b0f4821__mypyc.cp313-win_amd64.pyd
          • Size 213KB
          • SHA256 ba7fc544994f126cb7485ce52d265d2f32e93c4f1ea1fcd6fcdee3918f271979
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\VCRUNTIME140.dll
          • Size 117KB
          • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\_asyncio.pyd
          • Size 71KB
          • SHA256 423007b8c7d63b4cb5f23665a761dd5de1c7e15a65c8013391de0d18c89ce417
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\_bz2.pyd
          • Size 84KB
          • SHA256 1bf985b54f529a3cbb3e52532791cc4d4c64009142d37b54eb3521adec203d5c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\_ctypes.pyd
          • Size 131KB
          • SHA256 96b07339d52c74f2a1dd043df5eb931e4072eed90a3a8715ffec751d818e4117
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\_hashlib.pyd
          • Size 67KB
          • SHA256 50f3ce7a2281fd32f378f3ba5067bdd13e18ee95877db5199c6a0babdc9c516a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\_lzma.pyd
          • Size 155KB
          • SHA256 51815b6474d4216c6a2aeaffdae5d2ff4acb7a0236254f2cfe43247022f3d781
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\_overlapped.pyd
          • Size 56KB
          • SHA256 53fe68819f23fea7f6deb0054623e936cc2500241061f29bd5288cf4a511278f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\_queue.pyd
          • Size 34KB
          • SHA256 b5b5368026c33ade7651fb4cf4c6c1ca7eecc9c8cdad0af007da8a3ac0e067f7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\_socket.pyd
          • Size 84KB
          • SHA256 8676f3cebd9d01c7ad51a29b3f7ff429c0a8f6bc564cab21eb6cdaa2e26fd259
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\_ssl.pyd
          • Size 177KB
          • SHA256 b8118580b461801df12ec12d3d666aa0ebc2b3750bcf92b90b92789b152bf856
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\_uuid.pyd
          • Size 27KB
          • SHA256 0116497261edadfe42ba7daf367c8a9ea27a1db210c8384943c890f532e3ce72
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _wmi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\_wmi.pyd
          • Size 38KB
          • SHA256 9a7255064ea143895b28efea6d78e9e518bac290900aec52a6a0435c36a172fb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\base_library.zip
          • Size 1.3MB
          • SHA256 5cda1a381bf571464e1655c1355b9a9e1c09d8545c8190088c5bf1d71721a249
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cd.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\charset_normalizer\cd.cp313-win_amd64.pyd
          • Size 10KB
          • SHA256 2e9f5049b3c5db7ab78c6abb94dfbbfe035ebab8f40594320f8c92221f486f24
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          INSTALLER
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\itsdangerous-2.2.0.dist-info\INSTALLER
          • Size 4B
          • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
          • MD5 SHA1 SHA512
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\libcrypto-3.dll
          • Size 5.0MB
          • SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\libssl-3.dll
          • Size 776KB
          • SHA256 cf1a5fdcefa3daf69041f31f98ece1d7911ca4fcb8e9f1043b4d0f459ae4c936
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _psutil_windows.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\psutil\_psutil_windows.pyd
          • Size 69KB
          • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\pyexpat.pyd
          • Size 212KB
          • SHA256 b5f57327418750229656c30a809308669797cf30d7da3705f8cd584c2b8a038b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\python3.dll
          • Size 70KB
          • SHA256 cbc4876275178244905ee45a9ee6ec9fa4bfb9aad6209a03b756d38a186f80d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python313.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\python313.dll
          • Size 5.8MB
          • SHA256 6964e590037c41d631fd1215f05af154f7fa68105993c6f573a20689b473f1ac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pythoncom313.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\pywin32_system32\pythoncom313.dll
          • Size 674KB
          • SHA256 e312c8edb2d43a014daddfa984a805e6b5f933c60777e7b527332e682d9b1813
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pywintypes313.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\pywin32_system32\pywintypes313.dll
          • Size 132KB
          • SHA256 9bb6dece38380abc747dce9ba8b0834a2bec469bc942dbcc8658e30ebdfb59a4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\select.pyd
          • Size 32KB
          • SHA256 ddf1221851814943a82ed8a986d228463404da2ada969661bdd69223f14fc050
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\unicodedata.pyd
          • Size 695KB
          • SHA256 b965a80346ee95dbec0b147faab329f3276ba24fceb8df5df171367649f116f3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32api.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\win32\win32api.pyd
          • Size 132KB
          • SHA256 b80722e54741563e72e264ca33e1900ee49c927c475e54ef8f94c3eac9032465
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32crypt.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\win32\win32crypt.pyd
          • Size 121KB
          • SHA256 f07fbdcebda155ece29f64a4ca199db544bfa1f3472661f20b569d2b56926123
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32event.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\win32\win32event.pyd
          • Size 28KB
          • SHA256 b70d2aebb12d2a0c8d100f37e109319407cf025fc406ef23d13c1b5ddb64370a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32gui.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\win32\win32gui.pyd
          • Size 218KB
          • SHA256 6c545bd22720a7088c1353e5e554ded4db5db4c1b164689e7d42acf312561aca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32print.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI52322\win32\win32print.pyd
          • Size 73KB
          • SHA256 1a5a443d9154e6a3cf62fe39dd7f40a3fea272c297ac1e0aa9e10c0b0ea68bad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WHEEL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI54242\flask-3.1.3.dist-info\WHEEL
          • Size 82B
          • SHA256 1b68144734c4b66791f27add5d425f3620775585718a03d0f9b110ba3a4d88db
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _SHA224.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI57722\Crypto\Hash\_SHA224.pyd
          • Size 21KB
          • SHA256 773fac9a1a65b31d22f79a5e4f035ddc00301b741873d334ee9902db1d1bebfd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SDL2.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI57722\SDL2.dll
          • Size 2.4MB
          • SHA256 520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SDL2_image.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI57722\SDL2_image.dll
          • Size 122KB
          • SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SDL2_mixer.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI57722\SDL2_mixer.dll
          • Size 285KB
          • SHA256 2a0fc5e9f72c2eaec3240cb82b7594a58ccda609485981f256b94d0a4dd8d6f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SDL2_ttf.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI57722\SDL2_ttf.dll
          • Size 1.5MB
          • SHA256 fcdfabdfce868eb33f7514025ff59c1bb6c418f1bcd6ace2300a9cd4053e1d63
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          euc-cn.enc
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI57722\_tcl_data\encoding\euc-cn.enc
          • Size 84KB
          • SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          freetype.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI57722\freetype.dll
          • Size 639KB
          • SHA256 1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libjpeg-9.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI57722\libjpeg-9.dll
          • Size 238KB
          • SHA256 3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libogg-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI57722\libogg-0.dll
          • Size 25KB
          • SHA256 57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libopus-0.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI57722\libopus-0.dll
          • Size 359KB
          • SHA256 771cae79410f7fcc4f993a105a18c4ed9e8cbddd6f807a42228d95f575808806
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libpng16-16.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI57722\libpng16-16.dll
          • Size 206KB
          • SHA256 e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zlib1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI57722\pygame\zlib1.dll
          • Size 106KB
          • SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download