81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.7MB
Sample260711-qs85bsdv3x
SHA256 81438ec974a24527a4218f451214e4abeda74c6d112c2b2366571d1ba8eb700e
MD5 46a7d8d9303db9b9c5301b6d080088cc
SHA1 27312667da1771cefb8880a0364d41ed056b59f0
SHA512 f9ccadd4da6f6cfbd59cf909d12372c45aee182517e67b3ddd22cd2227bccb17214dedb2a11ad981769462b3cf5b80e19f38b2c1889ed4b1042c412dbb598ef1
SSDEEP 393216:4Xp7kyys4TMx9h4BdKDXMCHWUjXMcuI3/PGTAI:GhuTMJ4Bd2XMb8XZH/O7
TLSH
T120E63354B5E020FDE9B7423CFEE1818AE4D570224F75CA9B47688AF4AF131E06D3DA16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3064	powershell.exe
3232	powershell.exe
1380	powershell.exe
5928	powershell.exe
4960	powershell.exe
4264	powershell.exe
2944	powershell.exe
5328	powershell.exe
5644	powershell.exe
2928	powershell.exe
1684	powershell.exe
1424	powershell.exe

Loads dropped DLL 16 IoCs

pid	Process
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2928	powershell.exe
2928	powershell.exe
4264	powershell.exe
4264	powershell.exe
1684	powershell.exe
1684	powershell.exe
1424	powershell.exe
1424	powershell.exe
2944	powershell.exe
2944	powershell.exe
3064	powershell.exe
3064	powershell.exe
5328	powershell.exe
5328	powershell.exe
5644	powershell.exe
5644	powershell.exe
3232	powershell.exe
3232	powershell.exe
1380	powershell.exe
1380	powershell.exe
5928	powershell.exe
5928	powershell.exe
4960	powershell.exe
4960	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeIncreaseQuotaPrivilege	2928	powershell.exe
Token: SeSecurityPrivilege	2928	powershell.exe
Token: SeTakeOwnershipPrivilege	2928	powershell.exe
Token: SeLoadDriverPrivilege	2928	powershell.exe
Token: SeSystemProfilePrivilege	2928	powershell.exe
Token: SeSystemtimePrivilege	2928	powershell.exe
Token: SeProfSingleProcessPrivilege	2928	powershell.exe
Token: SeIncBasePriorityPrivilege	2928	powershell.exe
Token: SeCreatePagefilePrivilege	2928	powershell.exe
Token: SeBackupPrivilege	2928	powershell.exe
Token: SeRestorePrivilege	2928	powershell.exe
Token: SeShutdownPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeSystemEnvironmentPrivilege	2928	powershell.exe
Token: SeRemoteShutdownPrivilege	2928	powershell.exe
Token: SeUndockPrivilege	2928	powershell.exe
Token: SeManageVolumePrivilege	2928	powershell.exe
Token: 33	2928	powershell.exe
Token: 34	2928	powershell.exe
Token: 35	2928	powershell.exe
Token: 36	2928	powershell.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeIncreaseQuotaPrivilege	4264	powershell.exe
Token: SeSecurityPrivilege	4264	powershell.exe
Token: SeTakeOwnershipPrivilege	4264	powershell.exe
Token: SeLoadDriverPrivilege	4264	powershell.exe
Token: SeSystemProfilePrivilege	4264	powershell.exe
Token: SeSystemtimePrivilege	4264	powershell.exe
Token: SeProfSingleProcessPrivilege	4264	powershell.exe
Token: SeIncBasePriorityPrivilege	4264	powershell.exe
Token: SeCreatePagefilePrivilege	4264	powershell.exe
Token: SeBackupPrivilege	4264	powershell.exe
Token: SeRestorePrivilege	4264	powershell.exe
Token: SeShutdownPrivilege	4264	powershell.exe
Token: SeDebugPrivilege	4264	powershell.exe
Token: SeSystemEnvironmentPrivilege	4264	powershell.exe
Token: SeRemoteShutdownPrivilege	4264	powershell.exe
Token: SeUndockPrivilege	4264	powershell.exe
Token: SeManageVolumePrivilege	4264	powershell.exe
Token: 33	4264	powershell.exe
Token: 34	4264	powershell.exe
Token: 35	4264	powershell.exe
Token: 36	4264	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeIncreaseQuotaPrivilege	1684	powershell.exe
Token: SeSecurityPrivilege	1684	powershell.exe
Token: SeTakeOwnershipPrivilege	1684	powershell.exe
Token: SeLoadDriverPrivilege	1684	powershell.exe
Token: SeSystemProfilePrivilege	1684	powershell.exe
Token: SeSystemtimePrivilege	1684	powershell.exe
Token: SeProfSingleProcessPrivilege	1684	powershell.exe
Token: SeIncBasePriorityPrivilege	1684	powershell.exe
Token: SeCreatePagefilePrivilege	1684	powershell.exe
Token: SeBackupPrivilege	1684	powershell.exe
Token: SeRestorePrivilege	1684	powershell.exe
Token: SeShutdownPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeSystemEnvironmentPrivilege	1684	powershell.exe
Token: SeRemoteShutdownPrivilege	1684	powershell.exe
Token: SeUndockPrivilege	1684	powershell.exe
Token: SeManageVolumePrivilege	1684	powershell.exe
Token: 33	1684	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 5212	4672	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	88
PID 5212 wrote to memory of 2672	5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 2672 wrote to memory of 2928	2672	cmd.exe	91
PID 5212 wrote to memory of 4208	5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	93
PID 4208 wrote to memory of 4264	4208	cmd.exe	95
PID 5212 wrote to memory of 2024	5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	96
PID 2024 wrote to memory of 1684	2024	cmd.exe	98
PID 5212 wrote to memory of 3252	5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	99
PID 3252 wrote to memory of 1424	3252	cmd.exe	101
PID 5212 wrote to memory of 1816	5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	102
PID 1816 wrote to memory of 2944	1816	cmd.exe	104
PID 5212 wrote to memory of 5292	5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	105
PID 5292 wrote to memory of 3064	5292	cmd.exe	107
PID 5212 wrote to memory of 3400	5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	108
PID 3400 wrote to memory of 5328	3400	cmd.exe	110
PID 5212 wrote to memory of 5532	5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	111
PID 5532 wrote to memory of 5644	5532	cmd.exe	113
PID 5212 wrote to memory of 2744	5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	114
PID 2744 wrote to memory of 3232	2744	cmd.exe	116
PID 5212 wrote to memory of 3332	5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	117
PID 3332 wrote to memory of 1380	3332	cmd.exe	119
PID 5212 wrote to memory of 1388	5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	120
PID 1388 wrote to memory of 5928	1388	cmd.exe	122
PID 5212 wrote to memory of 4260	5212	2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	123
PID 4260 wrote to memory of 4960	4260	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Users\Admin\AppData\Local\Temp\2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-11_46a7d8d9303db9b9c5301b6d080088cc_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\huxepihi'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\huxepihi'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2944
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact