Overview

overview

7

Static

static

3

2026-09-29...at.exe

windows10-2004-x64

7

2026-09-29...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 17:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-29_ae56397b819b8b648aafe564d5e1948b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 15.2MB
  • Sample260930-v2bmmszzbx
  • SHA256 a52e4fe83c48af7db2539f5fbcb99ea52dbfdf3eb0bd060d7f99c7568f1fa4a7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 18 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-29_ae56397b819b8b648aafe564d5e1948b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-29_ae56397b819b8b648aafe564d5e1948b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4868
    • C:\Users\Admin\AppData\Local\Temp\2026-09-29_ae56397b819b8b648aafe564d5e1948b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-29_ae56397b819b8b648aafe564d5e1948b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      PID:1532

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\VCRUNTIME140.dll
        • Size 121KB
        • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\_bz2.pyd
        • Size 72KB
        • SHA256 aabcb1a21b29fee2d1a7e758c7d04d9ef737a0b933b38aa019ba0c913d9dfe36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\_ctypes.pyd
        • Size 127KB
        • SHA256 4f94f7489e313146b8324bcfdd1a9850ed9b8689b9938b326349934b258536a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\_hashlib.pyd
        • Size 54KB
        • SHA256 230936f6028fa63761d7d709677d887a74c59eea09d3f5b524eb4b374c27e9a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\_lzma.pyd
        • Size 149KB
        • SHA256 5bcf33774dcfed9fd724ebe9d68ca37948a080d1b98e2b064cd0b6336b080814
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\_queue.pyd
        • Size 22KB
        • SHA256 0d62376d6b0aa16145c43f0337e67609a509da4d8f1067c404c5a156c5d3480e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\_socket.pyd
        • Size 71KB
        • SHA256 fcc94c22c950300aff8c1f72cc65c9ca5ede41d334798e8a4b9e273c88db979e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\_ssl.pyd
        • Size 172KB
        • SHA256 1b66167c45b40f08b5ebd66eab38f6cd75f961489dbb871c58919c4aa8b582b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\_wmi.pyd
        • Size 25KB
        • SHA256 de7d9edbdb83ef0c3e3d3edc6590c69c0e1a4177569b1e37caaf964c47b1ed65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\_zstd.pyd
        • Size 478KB
        • SHA256 9abf749ca769449ccb71ca56b508212ec53f90459a8be850fd289e0186b40b7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\base_library.zip
        • Size 1.3MB
        • SHA256 6f04794c07f547e2dbfe44506df1c70e74228302e49536f0c6229a112faafcb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\libcrypto-3-x64.dll
        • Size 7.6MB
        • SHA256 332308d9d0de10dfd90ee130915a2162e00ee226543bc0105eb040a9185b27ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\libffi-8.dll
        • Size 27KB
        • SHA256 a1d301254480c6f61d03c86eda7cc6c78128e948c658b0f156eb7e8ca9d87803
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\libssl-3-x64.dll
        • Size 1.5MB
        • SHA256 2860e9c7c79c0fdd30db887f2d0727a918aa8629470bbe04a0127e5e47f1e121
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\python3.DLL
        • Size 58KB
        • SHA256 fa901f6ffb7d973a287984dbe4684d0d4b25d424438b3f82be782a8359afa780
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\python314.dll
        • Size 6.3MB
        • SHA256 832c4f199c1b3b81b62ecfa555035778ab20bf8eb7cd4663c322c7d40b8078b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\ucrtbase.dll
        • Size 1.3MB
        • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download