2ac624a3af6ced560bbd2d62e4ff7d64c630e825f2d145b1dd553123eb23288d

Analysis

max time kernel
149s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 15:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260705-tah2zag16m
SHA256 2ac624a3af6ced560bbd2d62e4ff7d64c630e825f2d145b1dd553123eb23288d
MD5 d03797cec95defec8381d7e4a8e871ca
SHA1 e84109fe8d9343755bf7a6585b01f240ca88a884
SHA512 fc2acff416c44e97ea1b18ab120065966f238daa6664f07bd232a910cbf6c5742d05912eb68f99297410c31abbc13f90f2fa4a3b2d37acac03f145e370a97db9
SSDEEP 393216:5KCpOeHR1Up1juPvXMCHWUjXQcuI3/PGTAI:5u+1UpFu3XMb8XFH/O7
TLSH
T193E63318A7E412FFEE77817CE9616651E4A470B30B71C68F5BE483A11E633D14A38B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1272	powershell.exe
3904	powershell.exe
1492	powershell.exe
3400	powershell.exe
1576	powershell.exe
3560	powershell.exe
4776	powershell.exe
1804	powershell.exe
4500	powershell.exe
5092	powershell.exe
2588	powershell.exe
3804	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3560	powershell.exe
3560	powershell.exe
1272	powershell.exe
1272	powershell.exe
3904	powershell.exe
3904	powershell.exe
4776	powershell.exe
4776	powershell.exe
1804	powershell.exe
1804	powershell.exe
4500	powershell.exe
4500	powershell.exe
1492	powershell.exe
1492	powershell.exe
5092	powershell.exe
5092	powershell.exe
2588	powershell.exe
2588	powershell.exe
3400	powershell.exe
3400	powershell.exe
3804	powershell.exe
3804	powershell.exe
1576	powershell.exe
1576	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	3560	powershell.exe
Token: SeIncreaseQuotaPrivilege	3560	powershell.exe
Token: SeSecurityPrivilege	3560	powershell.exe
Token: SeTakeOwnershipPrivilege	3560	powershell.exe
Token: SeLoadDriverPrivilege	3560	powershell.exe
Token: SeSystemProfilePrivilege	3560	powershell.exe
Token: SeSystemtimePrivilege	3560	powershell.exe
Token: SeProfSingleProcessPrivilege	3560	powershell.exe
Token: SeIncBasePriorityPrivilege	3560	powershell.exe
Token: SeCreatePagefilePrivilege	3560	powershell.exe
Token: SeBackupPrivilege	3560	powershell.exe
Token: SeRestorePrivilege	3560	powershell.exe
Token: SeShutdownPrivilege	3560	powershell.exe
Token: SeDebugPrivilege	3560	powershell.exe
Token: SeSystemEnvironmentPrivilege	3560	powershell.exe
Token: SeRemoteShutdownPrivilege	3560	powershell.exe
Token: SeUndockPrivilege	3560	powershell.exe
Token: SeManageVolumePrivilege	3560	powershell.exe
Token: 33	3560	powershell.exe
Token: 34	3560	powershell.exe
Token: 35	3560	powershell.exe
Token: 36	3560	powershell.exe
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeIncreaseQuotaPrivilege	1272	powershell.exe
Token: SeSecurityPrivilege	1272	powershell.exe
Token: SeTakeOwnershipPrivilege	1272	powershell.exe
Token: SeLoadDriverPrivilege	1272	powershell.exe
Token: SeSystemProfilePrivilege	1272	powershell.exe
Token: SeSystemtimePrivilege	1272	powershell.exe
Token: SeProfSingleProcessPrivilege	1272	powershell.exe
Token: SeIncBasePriorityPrivilege	1272	powershell.exe
Token: SeCreatePagefilePrivilege	1272	powershell.exe
Token: SeBackupPrivilege	1272	powershell.exe
Token: SeRestorePrivilege	1272	powershell.exe
Token: SeShutdownPrivilege	1272	powershell.exe
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeSystemEnvironmentPrivilege	1272	powershell.exe
Token: SeRemoteShutdownPrivilege	1272	powershell.exe
Token: SeUndockPrivilege	1272	powershell.exe
Token: SeManageVolumePrivilege	1272	powershell.exe
Token: 33	1272	powershell.exe
Token: 34	1272	powershell.exe
Token: 35	1272	powershell.exe
Token: 36	1272	powershell.exe
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeIncreaseQuotaPrivilege	3904	powershell.exe
Token: SeSecurityPrivilege	3904	powershell.exe
Token: SeTakeOwnershipPrivilege	3904	powershell.exe
Token: SeLoadDriverPrivilege	3904	powershell.exe
Token: SeSystemProfilePrivilege	3904	powershell.exe
Token: SeSystemtimePrivilege	3904	powershell.exe
Token: SeProfSingleProcessPrivilege	3904	powershell.exe
Token: SeIncBasePriorityPrivilege	3904	powershell.exe
Token: SeCreatePagefilePrivilege	3904	powershell.exe
Token: SeBackupPrivilege	3904	powershell.exe
Token: SeRestorePrivilege	3904	powershell.exe
Token: SeShutdownPrivilege	3904	powershell.exe
Token: SeDebugPrivilege	3904	powershell.exe
Token: SeSystemEnvironmentPrivilege	3904	powershell.exe
Token: SeRemoteShutdownPrivilege	3904	powershell.exe
Token: SeUndockPrivilege	3904	powershell.exe
Token: SeManageVolumePrivilege	3904	powershell.exe
Token: 33	3904	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4328	4456	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	87
PID 4328 wrote to memory of 4708	4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	88
PID 4708 wrote to memory of 3560	4708	cmd.exe	90
PID 4328 wrote to memory of 5820	4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 5820 wrote to memory of 1272	5820	cmd.exe	94
PID 4328 wrote to memory of 2864	4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	95
PID 2864 wrote to memory of 3904	2864	cmd.exe	97
PID 4328 wrote to memory of 4468	4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	98
PID 4468 wrote to memory of 4776	4468	cmd.exe	100
PID 4328 wrote to memory of 1072	4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	101
PID 1072 wrote to memory of 1804	1072	cmd.exe	103
PID 4328 wrote to memory of 5672	4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	104
PID 5672 wrote to memory of 4500	5672	cmd.exe	106
PID 4328 wrote to memory of 980	4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	107
PID 980 wrote to memory of 1492	980	cmd.exe	109
PID 4328 wrote to memory of 1060	4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	110
PID 1060 wrote to memory of 5092	1060	cmd.exe	112
PID 4328 wrote to memory of 3972	4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	113
PID 3972 wrote to memory of 2588	3972	cmd.exe	115
PID 4328 wrote to memory of 5648	4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	116
PID 5648 wrote to memory of 3400	5648	cmd.exe	118
PID 4328 wrote to memory of 5964	4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	119
PID 5964 wrote to memory of 3804	5964	cmd.exe	121
PID 4328 wrote to memory of 3728	4328	2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	122
PID 3728 wrote to memory of 1576	3728	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Local\Temp\2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-05_d03797cec95defec8381d7e4a8e871ca_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\caxiriza'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\caxiriza'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1072
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:980
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5648
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact