e5f6c4d827a3dd8ce5aa80fa8e2cbb5b9892d12ef1c8ff379bafaee383799bfc

Analysis

max time kernel
9s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260707-th1a8ahs31
SHA256 e5f6c4d827a3dd8ce5aa80fa8e2cbb5b9892d12ef1c8ff379bafaee383799bfc
MD5 765f552c4888ae9c4c6c12b6e7b1f5a0
SHA1 a3f93f4e53a06c13fc60eb1d35c9148e38520879
SHA512 7c2218a95d1d2115689db02e024984ae2a9f3ffb7c539efc0e45d0257616a1e15c4e3bc9fbda1dd066867406650cbdbc312f0071d3f0f59f672e45fec70d30b0
SSDEEP 393216:JJbuALbAly1zCb3kJVzAmXMCHWUjXzcuI3/PGTAI:JNuw28cmXMb8XwH/O7
TLSH
T128E6338CA9E012EEF973423CAED1A255E455707A1731C9DB07B487F16E472A08E3D727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4872	powershell.exe
3008	powershell.exe
1064	powershell.exe
2308	powershell.exe
5812	powershell.exe
4748	powershell.exe
3024	powershell.exe
2212	powershell.exe
4364	powershell.exe
1464	powershell.exe
4528	powershell.exe
4680	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4748	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	4748	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2032	1908	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	88
PID 2032 wrote to memory of 3580	2032	2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 3580 wrote to memory of 4748	3580	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-07_765f552c4888ae9c4c6c12b6e7b1f5a0_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\gihigawi'""
    3⤵
    PID:1988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\gihigawi'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    PID:5396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    PID:5848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    PID:5864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    PID:2744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    PID:780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    PID:5988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    PID:4448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    PID:2620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    PID:1280
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    PID:4752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact