1138f7a02699421c300ea4a08e02fa014ea1e15f36647b27cd79eb339231842d

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.7MB
Sample260710-ttyxjacy5q
SHA256 1138f7a02699421c300ea4a08e02fa014ea1e15f36647b27cd79eb339231842d
MD5 1b05bb4b7783efd8ac3e9d0ea2cd0254
SHA1 9d1f8916a0a1b5379dc2138fb2ffc3b552d2285b
SHA512 de0c06dfb422237ff768fdb1643eab0b950e2727b15e8e27498772b4323dfea92474c0f2bb09cf9cb31ee3f8f30b57302329b43fb1773c40d67a6f00c854b9fc
SSDEEP 393216:evkeZZXmvVUWjWG0i9kXMCHWUjXrcuI3/PGTAI:evPXSVH7zkXMb8XIH/O7
TLSH
T17FE6335CB6D116FDEAA3807DBEE20A99E02A78250B76C6DF0B5443B56E1B0D0CC3C657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
488	powershell.exe
2760	powershell.exe
1592	powershell.exe
1984	powershell.exe
2404	powershell.exe
3928	powershell.exe
3540	powershell.exe
4396	powershell.exe
3388	powershell.exe
5528	powershell.exe
4292	powershell.exe
1296	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2760	powershell.exe
2760	powershell.exe
1592	powershell.exe
1592	powershell.exe
1984	powershell.exe
1984	powershell.exe
2404	powershell.exe
2404	powershell.exe
3388	powershell.exe
3388	powershell.exe
3928	powershell.exe
3928	powershell.exe
3540	powershell.exe
3540	powershell.exe
4396	powershell.exe
4396	powershell.exe
5528	powershell.exe
5528	powershell.exe
4292	powershell.exe
4292	powershell.exe
1296	powershell.exe
1296	powershell.exe
488	powershell.exe
488	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeIncreaseQuotaPrivilege	2760	powershell.exe
Token: SeSecurityPrivilege	2760	powershell.exe
Token: SeTakeOwnershipPrivilege	2760	powershell.exe
Token: SeLoadDriverPrivilege	2760	powershell.exe
Token: SeSystemProfilePrivilege	2760	powershell.exe
Token: SeSystemtimePrivilege	2760	powershell.exe
Token: SeProfSingleProcessPrivilege	2760	powershell.exe
Token: SeIncBasePriorityPrivilege	2760	powershell.exe
Token: SeCreatePagefilePrivilege	2760	powershell.exe
Token: SeBackupPrivilege	2760	powershell.exe
Token: SeRestorePrivilege	2760	powershell.exe
Token: SeShutdownPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeSystemEnvironmentPrivilege	2760	powershell.exe
Token: SeRemoteShutdownPrivilege	2760	powershell.exe
Token: SeUndockPrivilege	2760	powershell.exe
Token: SeManageVolumePrivilege	2760	powershell.exe
Token: 33	2760	powershell.exe
Token: 34	2760	powershell.exe
Token: 35	2760	powershell.exe
Token: 36	2760	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeIncreaseQuotaPrivilege	1592	powershell.exe
Token: SeSecurityPrivilege	1592	powershell.exe
Token: SeTakeOwnershipPrivilege	1592	powershell.exe
Token: SeLoadDriverPrivilege	1592	powershell.exe
Token: SeSystemProfilePrivilege	1592	powershell.exe
Token: SeSystemtimePrivilege	1592	powershell.exe
Token: SeProfSingleProcessPrivilege	1592	powershell.exe
Token: SeIncBasePriorityPrivilege	1592	powershell.exe
Token: SeCreatePagefilePrivilege	1592	powershell.exe
Token: SeBackupPrivilege	1592	powershell.exe
Token: SeRestorePrivilege	1592	powershell.exe
Token: SeShutdownPrivilege	1592	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeSystemEnvironmentPrivilege	1592	powershell.exe
Token: SeRemoteShutdownPrivilege	1592	powershell.exe
Token: SeUndockPrivilege	1592	powershell.exe
Token: SeManageVolumePrivilege	1592	powershell.exe
Token: 33	1592	powershell.exe
Token: 34	1592	powershell.exe
Token: 35	1592	powershell.exe
Token: 36	1592	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeIncreaseQuotaPrivilege	1984	powershell.exe
Token: SeSecurityPrivilege	1984	powershell.exe
Token: SeTakeOwnershipPrivilege	1984	powershell.exe
Token: SeLoadDriverPrivilege	1984	powershell.exe
Token: SeSystemProfilePrivilege	1984	powershell.exe
Token: SeSystemtimePrivilege	1984	powershell.exe
Token: SeProfSingleProcessPrivilege	1984	powershell.exe
Token: SeIncBasePriorityPrivilege	1984	powershell.exe
Token: SeCreatePagefilePrivilege	1984	powershell.exe
Token: SeBackupPrivilege	1984	powershell.exe
Token: SeRestorePrivilege	1984	powershell.exe
Token: SeShutdownPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeSystemEnvironmentPrivilege	1984	powershell.exe
Token: SeRemoteShutdownPrivilege	1984	powershell.exe
Token: SeUndockPrivilege	1984	powershell.exe
Token: SeManageVolumePrivilege	1984	powershell.exe
Token: 33	1984	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 6124	2456	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	86
PID 6124 wrote to memory of 5896	6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	87
PID 5896 wrote to memory of 2760	5896	cmd.exe	89
PID 6124 wrote to memory of 4216	6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	91
PID 4216 wrote to memory of 1592	4216	cmd.exe	93
PID 6124 wrote to memory of 4892	6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 4892 wrote to memory of 1984	4892	cmd.exe	96
PID 6124 wrote to memory of 5228	6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 5228 wrote to memory of 2404	5228	cmd.exe	99
PID 6124 wrote to memory of 5724	6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 5724 wrote to memory of 3388	5724	cmd.exe	102
PID 6124 wrote to memory of 4004	6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 4004 wrote to memory of 3928	4004	cmd.exe	105
PID 6124 wrote to memory of 5996	6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 5996 wrote to memory of 3540	5996	cmd.exe	108
PID 6124 wrote to memory of 4040	6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 4040 wrote to memory of 4396	4040	cmd.exe	111
PID 6124 wrote to memory of 3060	6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 3060 wrote to memory of 5528	3060	cmd.exe	114
PID 6124 wrote to memory of 3456	6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 3456 wrote to memory of 4292	3456	cmd.exe	117
PID 6124 wrote to memory of 4316	6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 4316 wrote to memory of 1296	4316	cmd.exe	120
PID 6124 wrote to memory of 6080	6124	2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 6080 wrote to memory of 488	6080	cmd.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-10_1b05bb4b7783efd8ac3e9d0ea2cd0254_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\hirireha'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\hirireha'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6080
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact