05b70f3f4f9bda0e2efae7d7c3c33afc86f3962124d92692e7db279b49768356

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 07:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260713-h1c3vsfs5x
SHA256 05b70f3f4f9bda0e2efae7d7c3c33afc86f3962124d92692e7db279b49768356
MD5 308e5edf5571d41dcafc02c64b768bdb
SHA1 199cae35735258460c0026e890fb5e03a1bb835e
SHA512 f8cdf79acfb8a2f194b8004ba136c795e4f4996a8f48b60d0b366613b46e8bad5416989942cefea1e4466b2bb1bdc674e9ee93c0c0e8646888a98c37cf13e153
SSDEEP 393216:G6ox7Yps+ID+u+KbmSyXMCHWUjXccuI3/PGTAI:GSlID+uwSyXMb8XJH/O7
TLSH
T195E63329AEE412FDD5774039EEE199D2E678B8311B31C99F139C86325E232D01E3D267
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2000	powershell.exe
3896	powershell.exe
1916	powershell.exe
3808	powershell.exe
3188	powershell.exe
4556	powershell.exe
5696	powershell.exe
2160	powershell.exe
2888	powershell.exe
5876	powershell.exe
2792	powershell.exe
3448	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2000	powershell.exe
2000	powershell.exe
2160	powershell.exe
2160	powershell.exe
2888	powershell.exe
2888	powershell.exe
5876	powershell.exe
5876	powershell.exe
3896	powershell.exe
3896	powershell.exe
1916	powershell.exe
1916	powershell.exe
3808	powershell.exe
3808	powershell.exe
3188	powershell.exe
3188	powershell.exe
2792	powershell.exe
2792	powershell.exe
3448	powershell.exe
3448	powershell.exe
4556	powershell.exe
4556	powershell.exe
5696	powershell.exe
5696	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeIncreaseQuotaPrivilege	2000	powershell.exe
Token: SeSecurityPrivilege	2000	powershell.exe
Token: SeTakeOwnershipPrivilege	2000	powershell.exe
Token: SeLoadDriverPrivilege	2000	powershell.exe
Token: SeSystemProfilePrivilege	2000	powershell.exe
Token: SeSystemtimePrivilege	2000	powershell.exe
Token: SeProfSingleProcessPrivilege	2000	powershell.exe
Token: SeIncBasePriorityPrivilege	2000	powershell.exe
Token: SeCreatePagefilePrivilege	2000	powershell.exe
Token: SeBackupPrivilege	2000	powershell.exe
Token: SeRestorePrivilege	2000	powershell.exe
Token: SeShutdownPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeSystemEnvironmentPrivilege	2000	powershell.exe
Token: SeRemoteShutdownPrivilege	2000	powershell.exe
Token: SeUndockPrivilege	2000	powershell.exe
Token: SeManageVolumePrivilege	2000	powershell.exe
Token: 33	2000	powershell.exe
Token: 34	2000	powershell.exe
Token: 35	2000	powershell.exe
Token: 36	2000	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeIncreaseQuotaPrivilege	2160	powershell.exe
Token: SeSecurityPrivilege	2160	powershell.exe
Token: SeTakeOwnershipPrivilege	2160	powershell.exe
Token: SeLoadDriverPrivilege	2160	powershell.exe
Token: SeSystemProfilePrivilege	2160	powershell.exe
Token: SeSystemtimePrivilege	2160	powershell.exe
Token: SeProfSingleProcessPrivilege	2160	powershell.exe
Token: SeIncBasePriorityPrivilege	2160	powershell.exe
Token: SeCreatePagefilePrivilege	2160	powershell.exe
Token: SeBackupPrivilege	2160	powershell.exe
Token: SeRestorePrivilege	2160	powershell.exe
Token: SeShutdownPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeSystemEnvironmentPrivilege	2160	powershell.exe
Token: SeRemoteShutdownPrivilege	2160	powershell.exe
Token: SeUndockPrivilege	2160	powershell.exe
Token: SeManageVolumePrivilege	2160	powershell.exe
Token: 33	2160	powershell.exe
Token: 34	2160	powershell.exe
Token: 35	2160	powershell.exe
Token: 36	2160	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeIncreaseQuotaPrivilege	2888	powershell.exe
Token: SeSecurityPrivilege	2888	powershell.exe
Token: SeTakeOwnershipPrivilege	2888	powershell.exe
Token: SeLoadDriverPrivilege	2888	powershell.exe
Token: SeSystemProfilePrivilege	2888	powershell.exe
Token: SeSystemtimePrivilege	2888	powershell.exe
Token: SeProfSingleProcessPrivilege	2888	powershell.exe
Token: SeIncBasePriorityPrivilege	2888	powershell.exe
Token: SeCreatePagefilePrivilege	2888	powershell.exe
Token: SeBackupPrivilege	2888	powershell.exe
Token: SeRestorePrivilege	2888	powershell.exe
Token: SeShutdownPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeSystemEnvironmentPrivilege	2888	powershell.exe
Token: SeRemoteShutdownPrivilege	2888	powershell.exe
Token: SeUndockPrivilege	2888	powershell.exe
Token: SeManageVolumePrivilege	2888	powershell.exe
Token: 33	2888	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 5700	1604	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	87
PID 5700 wrote to memory of 4116	5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	88
PID 4116 wrote to memory of 2000	4116	cmd.exe	90
PID 5700 wrote to memory of 4396	5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 4396 wrote to memory of 2160	4396	cmd.exe	94
PID 5700 wrote to memory of 624	5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	95
PID 624 wrote to memory of 2888	624	cmd.exe	97
PID 5700 wrote to memory of 1804	5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	98
PID 1804 wrote to memory of 5876	1804	cmd.exe	100
PID 5700 wrote to memory of 6012	5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	101
PID 6012 wrote to memory of 3896	6012	cmd.exe	103
PID 5700 wrote to memory of 1676	5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	104
PID 1676 wrote to memory of 1916	1676	cmd.exe	106
PID 5700 wrote to memory of 1780	5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	107
PID 1780 wrote to memory of 3808	1780	cmd.exe	109
PID 5700 wrote to memory of 5928	5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	110
PID 5928 wrote to memory of 3188	5928	cmd.exe	112
PID 5700 wrote to memory of 4568	5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	113
PID 4568 wrote to memory of 2792	4568	cmd.exe	115
PID 5700 wrote to memory of 2348	5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	116
PID 2348 wrote to memory of 3448	2348	cmd.exe	118
PID 5700 wrote to memory of 5452	5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	119
PID 5452 wrote to memory of 4556	5452	cmd.exe	121
PID 5700 wrote to memory of 3404	5700	2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	122
PID 3404 wrote to memory of 5696	3404	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Users\Admin\AppData\Local\Temp\2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-13_308e5edf5571d41dcafc02c64b768bdb_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\movekana'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\movekana'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact