Analysis
- max time kernel
148s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
25/09/2026, 20:52
General
- Target 2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 6.8MB
- Sample260925-zn2dcsxt6j
- SHA256 7e15806991107bffd8905138c3c3df759ac7de0d716d24ecaf12c963d95993d3
Malware Config
Signatures
- Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
- Detects DarkSideRAT 7 IoCs
- Loads dropped DLL 8 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-25_b45531d48dafec76a6a491f49985b306_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"3⤵
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
base_library.zip
libcrypto-3.dll
python312.dll
select.pyd
unicodedata.pyd
memory/1720-21-0x0000000140000000-0x00000001406E2000-memory.dmp
memory/1720-43-0x0000000140000000-0x00000001406E2000-memory.dmp
memory/1784-8-0x0000000140000000-0x0000000140015000-memory.dmp
memory/1784-13-0x0000000140000000-0x0000000140015000-memory.dmp
memory/1784-12-0x0000000140000000-0x0000000140015000-memory.dmp
memory/1784-4-0x0000000140000000-0x0000000140015000-memory.dmp
memory/2712-0-0x0000000140000000-0x00000001406E2000-memory.dmp
memory/2712-42-0x0000000140000000-0x00000001406E2000-memory.dmp
memory/3368-26-0x0000000140000000-0x0000000140015000-memory.dmp
memory/3368-27-0x0000000140000000-0x0000000140015000-memory.dmp
memory/3368-24-0x0000000140000000-0x0000000140015000-memory.dmp