6d84b3d3de4ab1905e9cddbb2e519226eff88f0a753f3c9a5aee012e692d9e6b

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.7MB
Sample260702-v72q1sf14n
SHA256 6d84b3d3de4ab1905e9cddbb2e519226eff88f0a753f3c9a5aee012e692d9e6b
MD5 56b7532dda483d8b41516b84355790ce
SHA1 3fc9b3e2f6085898249c4f0956a71daadc5a01ec
SHA512 cefca14de1b3ff4d22970d824c734331d8743ac1eb8178953a1aba87418df8b49d9fd1614a02ce889dbb6d6ed52dfb3c4839cac670a17e0cff6fce4fde05e66b
SSDEEP 393216:odKAdvJCeWqtTpFpu8++v1oXMCHWUjXHcuI3/PGTAI:o8AvPZQ8+6eXMb8X8H/O7
TLSH
T133E6331856D413FFF8B38039B9E0A599D578B4B51B32C2AB17BC83659D232D04C7DA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1712	powershell.exe
1376	powershell.exe
2100	powershell.exe
1060	powershell.exe
1100	powershell.exe
1772	powershell.exe
3496	powershell.exe
2088	powershell.exe
3692	powershell.exe
5292	powershell.exe
2496	powershell.exe
4272	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1376	powershell.exe
1376	powershell.exe
2088	powershell.exe
2088	powershell.exe
2100	powershell.exe
2100	powershell.exe
3692	powershell.exe
3692	powershell.exe
5292	powershell.exe
5292	powershell.exe
1060	powershell.exe
1060	powershell.exe
1100	powershell.exe
1100	powershell.exe
2496	powershell.exe
2496	powershell.exe
1772	powershell.exe
1772	powershell.exe
4272	powershell.exe
4272	powershell.exe
1712	powershell.exe
1712	powershell.exe
3496	powershell.exe
3496	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeIncreaseQuotaPrivilege	1376	powershell.exe
Token: SeSecurityPrivilege	1376	powershell.exe
Token: SeTakeOwnershipPrivilege	1376	powershell.exe
Token: SeLoadDriverPrivilege	1376	powershell.exe
Token: SeSystemProfilePrivilege	1376	powershell.exe
Token: SeSystemtimePrivilege	1376	powershell.exe
Token: SeProfSingleProcessPrivilege	1376	powershell.exe
Token: SeIncBasePriorityPrivilege	1376	powershell.exe
Token: SeCreatePagefilePrivilege	1376	powershell.exe
Token: SeBackupPrivilege	1376	powershell.exe
Token: SeRestorePrivilege	1376	powershell.exe
Token: SeShutdownPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeSystemEnvironmentPrivilege	1376	powershell.exe
Token: SeRemoteShutdownPrivilege	1376	powershell.exe
Token: SeUndockPrivilege	1376	powershell.exe
Token: SeManageVolumePrivilege	1376	powershell.exe
Token: 33	1376	powershell.exe
Token: 34	1376	powershell.exe
Token: 35	1376	powershell.exe
Token: 36	1376	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeIncreaseQuotaPrivilege	2088	powershell.exe
Token: SeSecurityPrivilege	2088	powershell.exe
Token: SeTakeOwnershipPrivilege	2088	powershell.exe
Token: SeLoadDriverPrivilege	2088	powershell.exe
Token: SeSystemProfilePrivilege	2088	powershell.exe
Token: SeSystemtimePrivilege	2088	powershell.exe
Token: SeProfSingleProcessPrivilege	2088	powershell.exe
Token: SeIncBasePriorityPrivilege	2088	powershell.exe
Token: SeCreatePagefilePrivilege	2088	powershell.exe
Token: SeBackupPrivilege	2088	powershell.exe
Token: SeRestorePrivilege	2088	powershell.exe
Token: SeShutdownPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeSystemEnvironmentPrivilege	2088	powershell.exe
Token: SeRemoteShutdownPrivilege	2088	powershell.exe
Token: SeUndockPrivilege	2088	powershell.exe
Token: SeManageVolumePrivilege	2088	powershell.exe
Token: 33	2088	powershell.exe
Token: 34	2088	powershell.exe
Token: 35	2088	powershell.exe
Token: 36	2088	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeIncreaseQuotaPrivilege	2100	powershell.exe
Token: SeSecurityPrivilege	2100	powershell.exe
Token: SeTakeOwnershipPrivilege	2100	powershell.exe
Token: SeLoadDriverPrivilege	2100	powershell.exe
Token: SeSystemProfilePrivilege	2100	powershell.exe
Token: SeSystemtimePrivilege	2100	powershell.exe
Token: SeProfSingleProcessPrivilege	2100	powershell.exe
Token: SeIncBasePriorityPrivilege	2100	powershell.exe
Token: SeCreatePagefilePrivilege	2100	powershell.exe
Token: SeBackupPrivilege	2100	powershell.exe
Token: SeRestorePrivilege	2100	powershell.exe
Token: SeShutdownPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeSystemEnvironmentPrivilege	2100	powershell.exe
Token: SeRemoteShutdownPrivilege	2100	powershell.exe
Token: SeUndockPrivilege	2100	powershell.exe
Token: SeManageVolumePrivilege	2100	powershell.exe
Token: 33	2100	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5788 wrote to memory of 632	5788	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	88
PID 632 wrote to memory of 1064	632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 1064 wrote to memory of 1376	1064	cmd.exe	91
PID 632 wrote to memory of 4948	632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	93
PID 4948 wrote to memory of 2088	4948	cmd.exe	95
PID 632 wrote to memory of 3508	632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	96
PID 3508 wrote to memory of 2100	3508	cmd.exe	98
PID 632 wrote to memory of 5548	632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	99
PID 5548 wrote to memory of 3692	5548	cmd.exe	101
PID 632 wrote to memory of 1932	632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	102
PID 1932 wrote to memory of 5292	1932	cmd.exe	104
PID 632 wrote to memory of 2296	632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	105
PID 2296 wrote to memory of 1060	2296	cmd.exe	107
PID 632 wrote to memory of 1468	632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	108
PID 1468 wrote to memory of 1100	1468	cmd.exe	110
PID 632 wrote to memory of 3332	632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	111
PID 3332 wrote to memory of 2496	3332	cmd.exe	113
PID 632 wrote to memory of 3116	632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	114
PID 3116 wrote to memory of 1772	3116	cmd.exe	116
PID 632 wrote to memory of 1696	632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	117
PID 1696 wrote to memory of 4272	1696	cmd.exe	119
PID 632 wrote to memory of 5556	632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	120
PID 5556 wrote to memory of 1712	5556	cmd.exe	122
PID 632 wrote to memory of 5288	632	2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	123
PID 5288 wrote to memory of 3496	5288	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5788
- C:\Users\Admin\AppData\Local\Temp\2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-02_56b7532dda483d8b41516b84355790ce_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\jezaciho'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\jezaciho'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5548
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact