4525e03d021750c4e162add7251fbdf63ba3cff650bf1389b1041357b63c38a2

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260701-ktedfshz2p
SHA256 4525e03d021750c4e162add7251fbdf63ba3cff650bf1389b1041357b63c38a2
MD5 96f00b970bd07ad22b1c7d5a4a76a0e5
SHA1 2e9cc76dcd94c0a3fd47c504b90ed7860207d728
SHA512 734aa5e342fb222fdc254d10a85f3c603ef11cf1487d763402cc6b18e2a5023808660900555424ccf9081b2d4b0e1ef0d0ebb554c50abc195856e96abbd21687
SSDEEP 393216:p+Leh2XcwQf00g3XMCHWUjXmcuI3/PGTAI:pT2X7O00g3XMb8XbH/O7
TLSH
T121E63358F6D002B4F5B71234FEE2916BF57930A50B71CAEB87684292BD532C25A3E353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3336	powershell.exe
6332	powershell.exe
5888	powershell.exe
1988	powershell.exe
260	powershell.exe
3824	powershell.exe
5596	powershell.exe
1944	powershell.exe
6420	powershell.exe
2824	powershell.exe
2800	powershell.exe
6100	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1944	powershell.exe
1944	powershell.exe
6420	powershell.exe
6420	powershell.exe
5888	powershell.exe
5888	powershell.exe
1988	powershell.exe
1988	powershell.exe
2824	powershell.exe
2824	powershell.exe
2800	powershell.exe
2800	powershell.exe
6100	powershell.exe
6100	powershell.exe
3336	powershell.exe
3336	powershell.exe
260	powershell.exe
260	powershell.exe
3824	powershell.exe
3824	powershell.exe
6332	powershell.exe
6332	powershell.exe
5596	powershell.exe
5596	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeIncreaseQuotaPrivilege	1944	powershell.exe
Token: SeSecurityPrivilege	1944	powershell.exe
Token: SeTakeOwnershipPrivilege	1944	powershell.exe
Token: SeLoadDriverPrivilege	1944	powershell.exe
Token: SeSystemProfilePrivilege	1944	powershell.exe
Token: SeSystemtimePrivilege	1944	powershell.exe
Token: SeProfSingleProcessPrivilege	1944	powershell.exe
Token: SeIncBasePriorityPrivilege	1944	powershell.exe
Token: SeCreatePagefilePrivilege	1944	powershell.exe
Token: SeBackupPrivilege	1944	powershell.exe
Token: SeRestorePrivilege	1944	powershell.exe
Token: SeShutdownPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeSystemEnvironmentPrivilege	1944	powershell.exe
Token: SeRemoteShutdownPrivilege	1944	powershell.exe
Token: SeUndockPrivilege	1944	powershell.exe
Token: SeManageVolumePrivilege	1944	powershell.exe
Token: 33	1944	powershell.exe
Token: 34	1944	powershell.exe
Token: 35	1944	powershell.exe
Token: 36	1944	powershell.exe
Token: SeDebugPrivilege	6420	powershell.exe
Token: SeIncreaseQuotaPrivilege	6420	powershell.exe
Token: SeSecurityPrivilege	6420	powershell.exe
Token: SeTakeOwnershipPrivilege	6420	powershell.exe
Token: SeLoadDriverPrivilege	6420	powershell.exe
Token: SeSystemProfilePrivilege	6420	powershell.exe
Token: SeSystemtimePrivilege	6420	powershell.exe
Token: SeProfSingleProcessPrivilege	6420	powershell.exe
Token: SeIncBasePriorityPrivilege	6420	powershell.exe
Token: SeCreatePagefilePrivilege	6420	powershell.exe
Token: SeBackupPrivilege	6420	powershell.exe
Token: SeRestorePrivilege	6420	powershell.exe
Token: SeShutdownPrivilege	6420	powershell.exe
Token: SeDebugPrivilege	6420	powershell.exe
Token: SeSystemEnvironmentPrivilege	6420	powershell.exe
Token: SeRemoteShutdownPrivilege	6420	powershell.exe
Token: SeUndockPrivilege	6420	powershell.exe
Token: SeManageVolumePrivilege	6420	powershell.exe
Token: 33	6420	powershell.exe
Token: 34	6420	powershell.exe
Token: 35	6420	powershell.exe
Token: 36	6420	powershell.exe
Token: SeDebugPrivilege	5888	powershell.exe
Token: SeIncreaseQuotaPrivilege	5888	powershell.exe
Token: SeSecurityPrivilege	5888	powershell.exe
Token: SeTakeOwnershipPrivilege	5888	powershell.exe
Token: SeLoadDriverPrivilege	5888	powershell.exe
Token: SeSystemProfilePrivilege	5888	powershell.exe
Token: SeSystemtimePrivilege	5888	powershell.exe
Token: SeProfSingleProcessPrivilege	5888	powershell.exe
Token: SeIncBasePriorityPrivilege	5888	powershell.exe
Token: SeCreatePagefilePrivilege	5888	powershell.exe
Token: SeBackupPrivilege	5888	powershell.exe
Token: SeRestorePrivilege	5888	powershell.exe
Token: SeShutdownPrivilege	5888	powershell.exe
Token: SeDebugPrivilege	5888	powershell.exe
Token: SeSystemEnvironmentPrivilege	5888	powershell.exe
Token: SeRemoteShutdownPrivilege	5888	powershell.exe
Token: SeUndockPrivilege	5888	powershell.exe
Token: SeManageVolumePrivilege	5888	powershell.exe
Token: 33	5888	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 5524	2428	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 5524 wrote to memory of 4920	5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4920 wrote to memory of 1944	4920	cmd.exe	92
PID 5524 wrote to memory of 3220	5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 3220 wrote to memory of 6420	3220	cmd.exe	96
PID 5524 wrote to memory of 6376	5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 6376 wrote to memory of 5888	6376	cmd.exe	99
PID 5524 wrote to memory of 5032	5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 5032 wrote to memory of 1988	5032	cmd.exe	102
PID 5524 wrote to memory of 3240	5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 3240 wrote to memory of 2824	3240	cmd.exe	105
PID 5524 wrote to memory of 3568	5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 3568 wrote to memory of 2800	3568	cmd.exe	108
PID 5524 wrote to memory of 5328	5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 5328 wrote to memory of 6100	5328	cmd.exe	111
PID 5524 wrote to memory of 3696	5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 3696 wrote to memory of 3336	3696	cmd.exe	114
PID 5524 wrote to memory of 2056	5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 2056 wrote to memory of 260	2056	cmd.exe	117
PID 5524 wrote to memory of 4976	5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 4976 wrote to memory of 3824	4976	cmd.exe	120
PID 5524 wrote to memory of 4592	5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 4592 wrote to memory of 6332	4592	cmd.exe	123
PID 5524 wrote to memory of 5800	5524	2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	124
PID 5800 wrote to memory of 5596	5800	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Users\Admin\AppData\Local\Temp\2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-01_96f00b970bd07ad22b1c7d5a4a76a0e5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\yuhataga'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\yuhataga'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact