fb4e253c24c0584ff00392058e8e98699b4232993792989143a865c0b8d00350

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260702-1bppgafs8x
SHA256 fb4e253c24c0584ff00392058e8e98699b4232993792989143a865c0b8d00350
MD5 0f416233f9bcdc6040030ae4f0821b81
SHA1 8f5a249df1b2495ddf4c8ab5e972c1f7fdf15e85
SHA512 3cebb2b4196d66551074d344a414b395652b6f213bdc1e4df916d3442ed3e176bc1f4ed9feba81e5d15e56a86ce7fc55cfa4f9b8e687747659916770ab8644ee
SSDEEP 393216:kVHjqx3Ir0Rr+94vFyBXMCHWUjXfcuI3/PGTAI:kVDk3Ir0CAIXMb8X0H/O7
TLSH
T1C8E6334867E413EEE677803CEEF152A9E5A5B4620375CBEB076886D24E4B1F10D7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3420	powershell.exe
4668	powershell.exe
1076	powershell.exe
5564	powershell.exe
4284	powershell.exe
2172	powershell.exe
1940	powershell.exe
3744	powershell.exe
1200	powershell.exe
5184	powershell.exe
4532	powershell.exe
6016	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1940	powershell.exe
1940	powershell.exe
3744	powershell.exe
3744	powershell.exe
1200	powershell.exe
1200	powershell.exe
1076	powershell.exe
1076	powershell.exe
5564	powershell.exe
5564	powershell.exe
5184	powershell.exe
5184	powershell.exe
4284	powershell.exe
4284	powershell.exe
4532	powershell.exe
4532	powershell.exe
6016	powershell.exe
6016	powershell.exe
3420	powershell.exe
3420	powershell.exe
4668	powershell.exe
4668	powershell.exe
2172	powershell.exe
2172	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeIncreaseQuotaPrivilege	1940	powershell.exe
Token: SeSecurityPrivilege	1940	powershell.exe
Token: SeTakeOwnershipPrivilege	1940	powershell.exe
Token: SeLoadDriverPrivilege	1940	powershell.exe
Token: SeSystemProfilePrivilege	1940	powershell.exe
Token: SeSystemtimePrivilege	1940	powershell.exe
Token: SeProfSingleProcessPrivilege	1940	powershell.exe
Token: SeIncBasePriorityPrivilege	1940	powershell.exe
Token: SeCreatePagefilePrivilege	1940	powershell.exe
Token: SeBackupPrivilege	1940	powershell.exe
Token: SeRestorePrivilege	1940	powershell.exe
Token: SeShutdownPrivilege	1940	powershell.exe
Token: SeDebugPrivilege	1940	powershell.exe
Token: SeSystemEnvironmentPrivilege	1940	powershell.exe
Token: SeRemoteShutdownPrivilege	1940	powershell.exe
Token: SeUndockPrivilege	1940	powershell.exe
Token: SeManageVolumePrivilege	1940	powershell.exe
Token: 33	1940	powershell.exe
Token: 34	1940	powershell.exe
Token: 35	1940	powershell.exe
Token: 36	1940	powershell.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeIncreaseQuotaPrivilege	3744	powershell.exe
Token: SeSecurityPrivilege	3744	powershell.exe
Token: SeTakeOwnershipPrivilege	3744	powershell.exe
Token: SeLoadDriverPrivilege	3744	powershell.exe
Token: SeSystemProfilePrivilege	3744	powershell.exe
Token: SeSystemtimePrivilege	3744	powershell.exe
Token: SeProfSingleProcessPrivilege	3744	powershell.exe
Token: SeIncBasePriorityPrivilege	3744	powershell.exe
Token: SeCreatePagefilePrivilege	3744	powershell.exe
Token: SeBackupPrivilege	3744	powershell.exe
Token: SeRestorePrivilege	3744	powershell.exe
Token: SeShutdownPrivilege	3744	powershell.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeSystemEnvironmentPrivilege	3744	powershell.exe
Token: SeRemoteShutdownPrivilege	3744	powershell.exe
Token: SeUndockPrivilege	3744	powershell.exe
Token: SeManageVolumePrivilege	3744	powershell.exe
Token: 33	3744	powershell.exe
Token: 34	3744	powershell.exe
Token: 35	3744	powershell.exe
Token: 36	3744	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeIncreaseQuotaPrivilege	1200	powershell.exe
Token: SeSecurityPrivilege	1200	powershell.exe
Token: SeTakeOwnershipPrivilege	1200	powershell.exe
Token: SeLoadDriverPrivilege	1200	powershell.exe
Token: SeSystemProfilePrivilege	1200	powershell.exe
Token: SeSystemtimePrivilege	1200	powershell.exe
Token: SeProfSingleProcessPrivilege	1200	powershell.exe
Token: SeIncBasePriorityPrivilege	1200	powershell.exe
Token: SeCreatePagefilePrivilege	1200	powershell.exe
Token: SeBackupPrivilege	1200	powershell.exe
Token: SeRestorePrivilege	1200	powershell.exe
Token: SeShutdownPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeSystemEnvironmentPrivilege	1200	powershell.exe
Token: SeRemoteShutdownPrivilege	1200	powershell.exe
Token: SeUndockPrivilege	1200	powershell.exe
Token: SeManageVolumePrivilege	1200	powershell.exe
Token: 33	1200	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 472	1540	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 472 wrote to memory of 1856	472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 1856 wrote to memory of 1940	1856	cmd.exe	92
PID 472 wrote to memory of 5844	472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 5844 wrote to memory of 3744	5844	cmd.exe	96
PID 472 wrote to memory of 2276	472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 2276 wrote to memory of 1200	2276	cmd.exe	99
PID 472 wrote to memory of 4344	472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 4344 wrote to memory of 1076	4344	cmd.exe	102
PID 472 wrote to memory of 2900	472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 2900 wrote to memory of 5564	2900	cmd.exe	105
PID 472 wrote to memory of 1616	472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 1616 wrote to memory of 5184	1616	cmd.exe	108
PID 472 wrote to memory of 1384	472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 1384 wrote to memory of 4284	1384	cmd.exe	111
PID 472 wrote to memory of 2116	472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 2116 wrote to memory of 4532	2116	cmd.exe	114
PID 472 wrote to memory of 5104	472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 5104 wrote to memory of 6016	5104	cmd.exe	117
PID 472 wrote to memory of 3908	472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 3908 wrote to memory of 3420	3908	cmd.exe	120
PID 472 wrote to memory of 1880	472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 1880 wrote to memory of 4668	1880	cmd.exe	123
PID 472 wrote to memory of 3564	472	2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	124
PID 3564 wrote to memory of 2172	3564	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Users\Admin\AppData\Local\Temp\2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-02_0f416233f9bcdc6040030ae4f0821b81_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\jezaciho'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5844
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\jezaciho'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact