Analysis
- max time kernel
149s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 16:49
General
- Target 2026-06-04_78a444e829dab34dc02c9d839f20c084_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 84.0MB
- Sample260604-vbvylabx5m
- SHA256 c8e8caf33edc0795b506ee938ccb629b473c5a7b9f22c438e6e5cc5dce93b4ac
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Loads dropped DLL 17 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- UPX packed file 49 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_78a444e829dab34dc02c9d839f20c084_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_78a444e829dab34dc02c9d839f20c084_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_78a444e829dab34dc02c9d839f20c084_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_78a444e829dab34dc02c9d839f20c084_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-06-04_78a444e829dab34dc02c9d839f20c084_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe'"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-06-04_78a444e829dab34dc02c9d839f20c084_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
base_library.zip
blank.aes
blank.aes
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python311.dll
rar.exe
rarreg.key
select.pyd
sqlite3.dll
unicodedata.pyd
__PSScriptPolicyTest_e1y4qugm.osv.ps1
memory/1616-100-0x000001D679380000-0x000001D67939C000-memory.dmp
memory/1616-143-0x000001D660200000-0x000001D660CC2000-memory.dmp
memory/1616-101-0x000001D6793A0000-0x000001D679453000-memory.dmp
memory/2416-109-0x0000020BBEB10000-0x0000020BBEB2C000-memory.dmp
memory/2416-112-0x0000020BBEB30000-0x0000020BBEB4A000-memory.dmp
memory/2416-139-0x0000020BA56D0000-0x0000020BA6192000-memory.dmp
memory/2416-134-0x0000020BBEAF0000-0x0000020BBEAF6000-memory.dmp
memory/2416-135-0x0000020BBEB00000-0x0000020BBEB0A000-memory.dmp
memory/2416-86-0x0000020BA62A0000-0x0000020BA62C2000-memory.dmp
memory/2416-133-0x0000020BBE780000-0x0000020BBE788000-memory.dmp
memory/2416-111-0x0000020BBE5A0000-0x0000020BBE5AA000-memory.dmp
memory/2416-108-0x0000020BBE590000-0x0000020BBE59A000-memory.dmp
memory/4232-70-0x00007FFE5DF90000-0x00007FFE5E57E000-memory.dmp
memory/4232-52-0x00007FFE6EFB0000-0x00007FFE6EFDD000-memory.dmp
memory/4232-66-0x00007FFE6EEA0000-0x00007FFE6EED3000-memory.dmp
memory/4232-62-0x00007FFE6EF60000-0x00007FFE6EF79000-memory.dmp
memory/4232-110-0x00007FFE6EF80000-0x00007FFE6EFA3000-memory.dmp
memory/4232-71-0x00007FFE6F400000-0x00007FFE6F424000-memory.dmp
memory/4232-127-0x00007FFE5D780000-0x00007FFE5D89C000-memory.dmp
memory/4232-132-0x00007FFE6EF80000-0x00007FFE6EFA3000-memory.dmp
memory/4232-131-0x00007FFE6EFB0000-0x00007FFE6EFDD000-memory.dmp
memory/4232-130-0x00007FFE6F6B0000-0x00007FFE6F6C9000-memory.dmp
memory/4232-64-0x00007FFE73450000-0x00007FFE7345D000-memory.dmp
memory/4232-72-0x00007FFE63280000-0x00007FFE6334D000-memory.dmp
memory/4232-80-0x00007FFE5D780000-0x00007FFE5D89C000-memory.dmp
memory/4232-60-0x00007FFE6E460000-0x00007FFE6E5D6000-memory.dmp
memory/4232-78-0x00007FFE72990000-0x00007FFE7299D000-memory.dmp
memory/4232-76-0x00007FFE6EF40000-0x00007FFE6EF54000-memory.dmp
memory/4232-51-0x00007FFE6F6B0000-0x00007FFE6F6C9000-memory.dmp
memory/4232-73-0x0000028211690000-0x0000028211BB2000-memory.dmp
memory/4232-129-0x00007FFE73460000-0x00007FFE7346F000-memory.dmp
memory/4232-128-0x00007FFE5D8A0000-0x00007FFE5DDC2000-memory.dmp
memory/4232-123-0x00007FFE63280000-0x00007FFE6334D000-memory.dmp
memory/4232-122-0x00007FFE6EEA0000-0x00007FFE6EED3000-memory.dmp
memory/4232-121-0x00007FFE73450000-0x00007FFE7345D000-memory.dmp
memory/4232-120-0x00007FFE6EF60000-0x00007FFE6EF79000-memory.dmp
memory/4232-126-0x00007FFE72990000-0x00007FFE7299D000-memory.dmp
memory/4232-125-0x00007FFE6EF40000-0x00007FFE6EF54000-memory.dmp
memory/4232-119-0x00007FFE6E460000-0x00007FFE6E5D6000-memory.dmp
memory/4232-114-0x00007FFE6F400000-0x00007FFE6F424000-memory.dmp
memory/4232-113-0x00007FFE5DF90000-0x00007FFE5E57E000-memory.dmp
memory/4232-74-0x00007FFE5D8A0000-0x00007FFE5DDC2000-memory.dmp
memory/4232-58-0x00007FFE6EF80000-0x00007FFE6EFA3000-memory.dmp
memory/4232-48-0x00007FFE73460000-0x00007FFE7346F000-memory.dmp
memory/4232-47-0x00007FFE6F400000-0x00007FFE6F424000-memory.dmp
memory/4232-25-0x00007FFE5DF90000-0x00007FFE5E57E000-memory.dmp