Overview

overview

4

Static

static

1

2026-10-28...at.exe

windows10-2004-x64

4

2026-10-28...at.exe

windows11-ltsc_2024-x64

4

Analysis

  • max time kernel
    149s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/10/2026, 10:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-28_1010339c26d8e55c5baef05f2c710cc4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  • Size 43.0MB
  • Sample261030-malpjaxyfv
  • SHA256 91b07a0e5b4acf39b5fb94cf57e2522e4fd4eb571929ffd2ee918c1754e7bfe2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 54 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-28_1010339c26d8e55c5baef05f2c710cc4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-28_1010339c26d8e55c5baef05f2c710cc4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3432
    • C:\Users\Admin\AppData\Local\Temp\2026-10-28_1010339c26d8e55c5baef05f2c710cc4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-28_1010339c26d8e55c5baef05f2c710cc4_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      PID:5644

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\VCRUNTIME140.dll
        • Size 121KB
        • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\_asyncio.pyd
        • Size 57KB
        • SHA256 40cf20613fef1ff9f29a6c57cb568b17b447221e24437e71d9a9d8954d05dc15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _brotli.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\_brotli.cp313-win_amd64.pyd
        • Size 836KB
        • SHA256 a7f83086a999a01db0ca8cba6d476b4aa74ec2f96292cf4e17446dd30c085c61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\_bz2.pyd
        • Size 71KB
        • SHA256 6bc462c03bce5f280c6555184e4bfdff66af79481f26d57edc0e7a15f6ea705e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\_cffi_backend.cp313-win_amd64.pyd
        • Size 176KB
        • SHA256 d5b09da2e726b4e90cf0edad5d2a0ec52f369dfd060e14d3807a32b2205031fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\_ctypes.pyd
        • Size 120KB
        • SHA256 de4a711595fdcf2fa21e611f848244ccea755062573476f2d24af59225eb39cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\_decimal.pyd
        • Size 266KB
        • SHA256 fc050989189fc91be12a4b840c2aef3c35a18f01c9683d6167f4a1bf1ec19e7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\_hashlib.pyd
        • Size 54KB
        • SHA256 5c02ba2f6f37950e5a265a09df6eac5912cdf95ae60de6aa4c8aa3f80e170a46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\_lzma.pyd
        • Size 149KB
        • SHA256 de4ee854ee620557e9e2a462d7f8919c3e821c07e1e95cae3497db490dcc63b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\_overlapped.pyd
        • Size 42KB
        • SHA256 98028a77e2f8e9d104becb48e5155321bb7f432f39d68bfff1a1e2dc8215ffb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\_queue.pyd
        • Size 21KB
        • SHA256 9bedea4884b3023455bb492929b58a4dfeca9b28a0ac85d9d6f83a8366b024d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ruamel_yaml.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\_ruamel_yaml.cp313-win_amd64.pyd
        • Size 265KB
        • SHA256 89d2782375578fb3312432294816f3bb1d5831b0c8652051603c75ee6b156a02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\_socket.pyd
        • Size 71KB
        • SHA256 4fac04dfcaadcdec2c826bce01162b120ee2b93900bfe191f04c2d377d931d43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\_ssl.pyd
        • Size 164KB
        • SHA256 85fe56f7e860eae22df8caf9074cd2768a3bdde01111352fb089ab0969c79a2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\_uuid.pyd
        • Size 13KB
        • SHA256 e5b6f22f2067da2593cc65901e8779751bdb68df8391a40b992d2435b8ed0eb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\_wmi.pyd
        • Size 25KB
        • SHA256 fc0181934d5579540431810dae709a48ab8f5fd7fab4a58c893b8be6354521ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zoneinfo.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\_zoneinfo.pyd
        • Size 36KB
        • SHA256 01a2be822a60ec38ac5d2eab7a50ef19601cf1fb6ea4ae1913d2e67512f3b081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\base_library.zip
        • Size 1.3MB
        • SHA256 9b5463c88bea4152a1909801d1e67cdae2e7f2b67fa21b9945c242be6ea7eecb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bcrypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\bcrypt\_bcrypt.pyd
        • Size 298KB
        • SHA256 898d1fe05e287d66bd379f26eb49d27a260f14666c7dc8b1719dae8c489abff0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        INSTALLER
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\cryptography-46.0.3.dist-info\INSTALLER
        • Size 2B
        • SHA256 e6184ce10e266134fdcfa401e8f1a95005bcd4f18d16b62b757323e2833fe9a9
        • MD5 SHA1 SHA512
        Submit Download

        _rust.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\cryptography\hazmat\bindings\_rust.pyd
        • Size 8.8MB
        • SHA256 92f58bb4f01a75a0ef4dd9425dc2a96ddfe25fc93fd9dc11ea8f0d05b7a4f085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\libcrypto-3-x64.dll
        • Size 7.6MB
        • SHA256 dc62f57d7f00f02d37d3fcb96c847be59ddbac4914e6db9389757d3eacee3b7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\libffi-8.dll
        • Size 27KB
        • SHA256 fa39a2083b10d3742c545eaeb1d84c85351d90a5de8aec552cc80c1be8879914
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\libssl-3-x64.dll
        • Size 1.5MB
        • SHA256 6abd6cb59b82bed9e2b54e0b1fa636e5b302d49f669b40cee7779fdd5c76a296
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _pydantic_core.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\pydantic_core\_pydantic_core.cp313-win_amd64.pyd
        • Size 5.2MB
        • SHA256 77077f8f3b7dfbd9f6d4386f5ce424f72085e5fbfcd1593759fcfa1849f586e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\python3.DLL
        • Size 57KB
        • SHA256 bea2eb75f72605580fbbb8c3c8456c34ebbfe32a7a4fcb6758f4103d58a6afcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\python313.dll
        • Size 5.9MB
        • SHA256 a049780ec6abb5de96b89819b3d0ec94a2ce373508d2c2c3510eab6c02895265
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\pywin32_system32\pywintypes313.dll
        • Size 132KB
        • SHA256 9bb6dece38380abc747dce9ba8b0834a2bec469bc942dbcc8658e30ebdfb59a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\select.pyd
        • Size 18KB
        • SHA256 5790b0b3cf89c6f1b3450ee3930f5d8a404954c171a8b12c2663abcadb140497
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\win32\win32api.pyd
        • Size 132KB
        • SHA256 b80722e54741563e72e264ca33e1900ee49c927c475e54ef8f94c3eac9032465
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32event.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\win32\win32event.pyd
        • Size 28KB
        • SHA256 b70d2aebb12d2a0c8d100f37e109319407cf025fc406ef23d13c1b5ddb64370a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32service.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI34322\win32\win32service.pyd
        • Size 58KB
        • SHA256 eb3ea4dab12ecfb5296627435d2d0425d80e02ff73f586af166687a60215fff7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download