Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
25/04/2026, 04:48
General
- Target 2026-04-25_85752ff189faf1abe44186139f4d5dfa_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 9.9MB
- Sample260425-ffbm7afy2z
- SHA256 3d2aa3bd6f67c2ca39d491304efec6b11642353cde8751b0e9dfe8b1d182d8cc
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Deletes itself 1 IoCs
- Loads dropped DLL 16 IoCs
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Enumerates system info in registry 2 TTPs 2 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-25_85752ff189faf1abe44186139f4d5dfa_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-25_85752ff189faf1abe44186139f4d5dfa_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-04-25_85752ff189faf1abe44186139f4d5dfa_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-25_85752ff189faf1abe44186139f4d5dfa_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Deletes itself
- Loads dropped DLL
- Enumerates system info in registry
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Write-Host \"Test\""3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Get-Process3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Get-Service3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-WmiObject Win32_ComputerSystem"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath \"C:\Temp\""3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
auto.tcl
cp1252.enc
pkgIndex.tcl
init.tcl
pkgIndex.tcl
package.tcl
tclIndex
tm.tcl
button.tcl
entry.tcl
icons.tcl
listbox.tcl
menu.tcl
panedwindow.tcl
pkgIndex.tcl
scale.tcl
scrlbar.tcl
spinbox.tcl
text.tcl
tk.tcl
cursors.tcl
fonts.tcl
ttk.tcl
utils.tcl
_tkinter.pyd
_wmi.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
python312.dll
select.pyd
tcl86t.dll
msgcat-1.6.1.tm
tk86t.dll
unicodedata.pyd
zlib1.dll
__PSScriptPolicyTest_mc2fa544.e5h.ps1
memory/1924-1029-0x00000161390C0000-0x00000161390CC000-memory.dmp
memory/1924-1030-0x0000016139160000-0x0000016139172000-memory.dmp
memory/2368-1033-0x000002576B9C0000-0x000002576B9CC000-memory.dmp
memory/2368-1034-0x000002576BA50000-0x000002576BA62000-memory.dmp
memory/3864-1019-0x000002D0002A0000-0x000002D0002B2000-memory.dmp
memory/3864-1018-0x000002D000190000-0x000002D00019C000-memory.dmp
memory/3944-1020-0x000001599C940000-0x000001599C94A000-memory.dmp
memory/3944-1038-0x00000159B4BC0000-0x00000159B4BC6000-memory.dmp
memory/3944-1014-0x000001599C920000-0x000001599C93C000-memory.dmp
memory/3944-1015-0x00000159B4EB0000-0x00000159B4F63000-memory.dmp
memory/3944-1043-0x000001599C810000-0x000001599C822000-memory.dmp
memory/3944-1026-0x00000159B4BA0000-0x00000159B4BBC000-memory.dmp
memory/3944-1042-0x000001599AB80000-0x000001599AB8C000-memory.dmp
memory/3944-1035-0x000001599C950000-0x000001599C95A000-memory.dmp
memory/3944-1037-0x000001599C960000-0x000001599C968000-memory.dmp
memory/3944-1036-0x00000159B4C00000-0x00000159B4C1A000-memory.dmp
memory/3944-1039-0x00000159B4BD0000-0x00000159B4BDA000-memory.dmp
memory/4004-1025-0x0000012EE9000000-0x0000012EE9012000-memory.dmp
memory/4004-983-0x0000012EE9390000-0x0000012EE93B2000-memory.dmp
memory/4004-1024-0x0000012EE8FC0000-0x0000012EE8FCC000-memory.dmp
memory/4888-1069-0x00007FF8D3C70000-0x00007FF8D3C9A000-memory.dmp