4bf7703e645389e50288e51ebc0956848d35d604fccf6219c5e6b7401246b80a

Analysis

max time kernel
149s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.7MB
Sample260701-flzbfaex4n
SHA256 4bf7703e645389e50288e51ebc0956848d35d604fccf6219c5e6b7401246b80a
MD5 54094f184337d488d8436d75b9c85cfb
SHA1 afde1351bded7fbbaa0c19c1d76e828af23c8f16
SHA512 63770cccd4938a8115677efa92adafd5740fdd0aab8298745e58102e0d0155bbe4a8bce7856dabf942b661aa76e12c59799cca69a147399da8b8b05704e135ae
SSDEEP 393216:uCSho0NGORS2QkOW4hOH5lmOXMCHWUjXAcuI3/PGTAI:uSNORSAJZlmOXMb8XVH/O7
TLSH
T1D9E63304A6E002EEF9FBE23CDDA2B65AD19A70B15771C29B076897B15D473C08D3D683
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4972	powershell.exe
5956	powershell.exe
4584	powershell.exe
2800	powershell.exe
236	powershell.exe
2700	powershell.exe
1852	powershell.exe
6056	powershell.exe
5580	powershell.exe
5640	powershell.exe
956	powershell.exe
2872	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5640	powershell.exe
5640	powershell.exe
956	powershell.exe
956	powershell.exe
2872	powershell.exe
2872	powershell.exe
236	powershell.exe
236	powershell.exe
2700	powershell.exe
2700	powershell.exe
1852	powershell.exe
1852	powershell.exe
4972	powershell.exe
4972	powershell.exe
6056	powershell.exe
6056	powershell.exe
5956	powershell.exe
5956	powershell.exe
4584	powershell.exe
4584	powershell.exe
2800	powershell.exe
2800	powershell.exe
5580	powershell.exe
5580	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	5640	powershell.exe
Token: SeIncreaseQuotaPrivilege	5640	powershell.exe
Token: SeSecurityPrivilege	5640	powershell.exe
Token: SeTakeOwnershipPrivilege	5640	powershell.exe
Token: SeLoadDriverPrivilege	5640	powershell.exe
Token: SeSystemProfilePrivilege	5640	powershell.exe
Token: SeSystemtimePrivilege	5640	powershell.exe
Token: SeProfSingleProcessPrivilege	5640	powershell.exe
Token: SeIncBasePriorityPrivilege	5640	powershell.exe
Token: SeCreatePagefilePrivilege	5640	powershell.exe
Token: SeBackupPrivilege	5640	powershell.exe
Token: SeRestorePrivilege	5640	powershell.exe
Token: SeShutdownPrivilege	5640	powershell.exe
Token: SeDebugPrivilege	5640	powershell.exe
Token: SeSystemEnvironmentPrivilege	5640	powershell.exe
Token: SeRemoteShutdownPrivilege	5640	powershell.exe
Token: SeUndockPrivilege	5640	powershell.exe
Token: SeManageVolumePrivilege	5640	powershell.exe
Token: 33	5640	powershell.exe
Token: 34	5640	powershell.exe
Token: 35	5640	powershell.exe
Token: 36	5640	powershell.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeIncreaseQuotaPrivilege	956	powershell.exe
Token: SeSecurityPrivilege	956	powershell.exe
Token: SeTakeOwnershipPrivilege	956	powershell.exe
Token: SeLoadDriverPrivilege	956	powershell.exe
Token: SeSystemProfilePrivilege	956	powershell.exe
Token: SeSystemtimePrivilege	956	powershell.exe
Token: SeProfSingleProcessPrivilege	956	powershell.exe
Token: SeIncBasePriorityPrivilege	956	powershell.exe
Token: SeCreatePagefilePrivilege	956	powershell.exe
Token: SeBackupPrivilege	956	powershell.exe
Token: SeRestorePrivilege	956	powershell.exe
Token: SeShutdownPrivilege	956	powershell.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeSystemEnvironmentPrivilege	956	powershell.exe
Token: SeRemoteShutdownPrivilege	956	powershell.exe
Token: SeUndockPrivilege	956	powershell.exe
Token: SeManageVolumePrivilege	956	powershell.exe
Token: 33	956	powershell.exe
Token: 34	956	powershell.exe
Token: 35	956	powershell.exe
Token: 36	956	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeIncreaseQuotaPrivilege	2872	powershell.exe
Token: SeSecurityPrivilege	2872	powershell.exe
Token: SeTakeOwnershipPrivilege	2872	powershell.exe
Token: SeLoadDriverPrivilege	2872	powershell.exe
Token: SeSystemProfilePrivilege	2872	powershell.exe
Token: SeSystemtimePrivilege	2872	powershell.exe
Token: SeProfSingleProcessPrivilege	2872	powershell.exe
Token: SeIncBasePriorityPrivilege	2872	powershell.exe
Token: SeCreatePagefilePrivilege	2872	powershell.exe
Token: SeBackupPrivilege	2872	powershell.exe
Token: SeRestorePrivilege	2872	powershell.exe
Token: SeShutdownPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeSystemEnvironmentPrivilege	2872	powershell.exe
Token: SeRemoteShutdownPrivilege	2872	powershell.exe
Token: SeUndockPrivilege	2872	powershell.exe
Token: SeManageVolumePrivilege	2872	powershell.exe
Token: 33	2872	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5708 wrote to memory of 4220	5708	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	88
PID 4220 wrote to memory of 3392	4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 3392 wrote to memory of 5640	3392	cmd.exe	91
PID 4220 wrote to memory of 4788	4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	93
PID 4788 wrote to memory of 956	4788	cmd.exe	95
PID 4220 wrote to memory of 4644	4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	96
PID 4644 wrote to memory of 2872	4644	cmd.exe	98
PID 4220 wrote to memory of 3420	4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	99
PID 3420 wrote to memory of 236	3420	cmd.exe	101
PID 4220 wrote to memory of 3260	4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	102
PID 3260 wrote to memory of 2700	3260	cmd.exe	104
PID 4220 wrote to memory of 940	4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	105
PID 940 wrote to memory of 1852	940	cmd.exe	107
PID 4220 wrote to memory of 6020	4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	108
PID 6020 wrote to memory of 4972	6020	cmd.exe	110
PID 4220 wrote to memory of 2016	4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	111
PID 2016 wrote to memory of 6056	2016	cmd.exe	113
PID 4220 wrote to memory of 1396	4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	114
PID 1396 wrote to memory of 5956	1396	cmd.exe	116
PID 4220 wrote to memory of 3824	4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	117
PID 3824 wrote to memory of 4584	3824	cmd.exe	119
PID 4220 wrote to memory of 5400	4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 4220 wrote to memory of 4924	4220	2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	124
PID 4924 wrote to memory of 5580	4924	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Users\Admin\AppData\Local\Temp\2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-30_54094f184337d488d8436d75b9c85cfb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\yuhataga'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\yuhataga'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6020
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    PID:5400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact