a74e6207d1525ea4d505fc7fb9546828e51a2d15cabc412ec8f949fec93fee23

Analysis

max time kernel
149s
max time network
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.7MB
Sample260710-22tlsagy2z
SHA256 a74e6207d1525ea4d505fc7fb9546828e51a2d15cabc412ec8f949fec93fee23
MD5 00e540646ecc1b7e2ae7b65b2ba61338
SHA1 1b3823b352f1e6a85814bf227250c0b474629f43
SHA512 3e69139a109a629dea4021750a4ce24503f5611992471822ed5cbcbcefd0efe32a2650e8267e7d45901e2da80cbd144c4907e3c625179f84181e066c72f3b492
SSDEEP 393216:FtnWuRFqsm8JV8OuO3h9UHbszLRYXMCHWUjXXcuI3/PGTAI:FhmB8J2IdzLaXMb8XsH/O7
TLSH
T1C7E63318D6E003EAE537813DEED269A5D5F5303147B2C6DF1BA857B7AE372A1083E205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1952	powershell.exe
760	powershell.exe
2380	powershell.exe
4184	powershell.exe
1940	powershell.exe
3708	powershell.exe
5012	powershell.exe
2764	powershell.exe
3584	powershell.exe
1212	powershell.exe
6084	powershell.exe
2420	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2420	powershell.exe
2420	powershell.exe
1952	powershell.exe
1952	powershell.exe
760	powershell.exe
760	powershell.exe
2764	powershell.exe
2764	powershell.exe
3584	powershell.exe
3584	powershell.exe
1212	powershell.exe
1212	powershell.exe
6084	powershell.exe
6084	powershell.exe
2380	powershell.exe
2380	powershell.exe
4184	powershell.exe
4184	powershell.exe
1940	powershell.exe
1940	powershell.exe
3708	powershell.exe
3708	powershell.exe
5012	powershell.exe
5012	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeIncreaseQuotaPrivilege	2420	powershell.exe
Token: SeSecurityPrivilege	2420	powershell.exe
Token: SeTakeOwnershipPrivilege	2420	powershell.exe
Token: SeLoadDriverPrivilege	2420	powershell.exe
Token: SeSystemProfilePrivilege	2420	powershell.exe
Token: SeSystemtimePrivilege	2420	powershell.exe
Token: SeProfSingleProcessPrivilege	2420	powershell.exe
Token: SeIncBasePriorityPrivilege	2420	powershell.exe
Token: SeCreatePagefilePrivilege	2420	powershell.exe
Token: SeBackupPrivilege	2420	powershell.exe
Token: SeRestorePrivilege	2420	powershell.exe
Token: SeShutdownPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeSystemEnvironmentPrivilege	2420	powershell.exe
Token: SeRemoteShutdownPrivilege	2420	powershell.exe
Token: SeUndockPrivilege	2420	powershell.exe
Token: SeManageVolumePrivilege	2420	powershell.exe
Token: 33	2420	powershell.exe
Token: 34	2420	powershell.exe
Token: 35	2420	powershell.exe
Token: 36	2420	powershell.exe
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeIncreaseQuotaPrivilege	1952	powershell.exe
Token: SeSecurityPrivilege	1952	powershell.exe
Token: SeTakeOwnershipPrivilege	1952	powershell.exe
Token: SeLoadDriverPrivilege	1952	powershell.exe
Token: SeSystemProfilePrivilege	1952	powershell.exe
Token: SeSystemtimePrivilege	1952	powershell.exe
Token: SeProfSingleProcessPrivilege	1952	powershell.exe
Token: SeIncBasePriorityPrivilege	1952	powershell.exe
Token: SeCreatePagefilePrivilege	1952	powershell.exe
Token: SeBackupPrivilege	1952	powershell.exe
Token: SeRestorePrivilege	1952	powershell.exe
Token: SeShutdownPrivilege	1952	powershell.exe
Token: SeDebugPrivilege	1952	powershell.exe
Token: SeSystemEnvironmentPrivilege	1952	powershell.exe
Token: SeRemoteShutdownPrivilege	1952	powershell.exe
Token: SeUndockPrivilege	1952	powershell.exe
Token: SeManageVolumePrivilege	1952	powershell.exe
Token: 33	1952	powershell.exe
Token: 34	1952	powershell.exe
Token: 35	1952	powershell.exe
Token: 36	1952	powershell.exe
Token: SeDebugPrivilege	760	powershell.exe
Token: SeIncreaseQuotaPrivilege	760	powershell.exe
Token: SeSecurityPrivilege	760	powershell.exe
Token: SeTakeOwnershipPrivilege	760	powershell.exe
Token: SeLoadDriverPrivilege	760	powershell.exe
Token: SeSystemProfilePrivilege	760	powershell.exe
Token: SeSystemtimePrivilege	760	powershell.exe
Token: SeProfSingleProcessPrivilege	760	powershell.exe
Token: SeIncBasePriorityPrivilege	760	powershell.exe
Token: SeCreatePagefilePrivilege	760	powershell.exe
Token: SeBackupPrivilege	760	powershell.exe
Token: SeRestorePrivilege	760	powershell.exe
Token: SeShutdownPrivilege	760	powershell.exe
Token: SeDebugPrivilege	760	powershell.exe
Token: SeSystemEnvironmentPrivilege	760	powershell.exe
Token: SeRemoteShutdownPrivilege	760	powershell.exe
Token: SeUndockPrivilege	760	powershell.exe
Token: SeManageVolumePrivilege	760	powershell.exe
Token: 33	760	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5408 wrote to memory of 3592	5408	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	87
PID 3592 wrote to memory of 1228	3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	88
PID 1228 wrote to memory of 2420	1228	cmd.exe	90
PID 3592 wrote to memory of 1140	3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 1140 wrote to memory of 1952	1140	cmd.exe	94
PID 3592 wrote to memory of 300	3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	95
PID 300 wrote to memory of 760	300	cmd.exe	97
PID 3592 wrote to memory of 1444	3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	98
PID 1444 wrote to memory of 2764	1444	cmd.exe	100
PID 3592 wrote to memory of 4196	3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	101
PID 4196 wrote to memory of 3584	4196	cmd.exe	103
PID 3592 wrote to memory of 4404	3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	104
PID 4404 wrote to memory of 1212	4404	cmd.exe	106
PID 3592 wrote to memory of 4864	3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	107
PID 4864 wrote to memory of 6084	4864	cmd.exe	109
PID 3592 wrote to memory of 3336	3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	110
PID 3336 wrote to memory of 2380	3336	cmd.exe	112
PID 3592 wrote to memory of 4324	3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	113
PID 4324 wrote to memory of 4184	4324	cmd.exe	115
PID 3592 wrote to memory of 4636	3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	116
PID 4636 wrote to memory of 1940	4636	cmd.exe	118
PID 3592 wrote to memory of 3756	3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	119
PID 3756 wrote to memory of 3708	3756	cmd.exe	121
PID 3592 wrote to memory of 1092	3592	2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	122
PID 1092 wrote to memory of 5012	1092	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5408
- C:\Users\Admin\AppData\Local\Temp\2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-10_00e540646ecc1b7e2ae7b65b2ba61338_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\hirireha'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\hirireha'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:300
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact