862e54dc3f126e9bdc1c1be9c2abf1cea7348c39d22044b20bab193e74871e8e

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260715-afhtlsfx5l
SHA256 862e54dc3f126e9bdc1c1be9c2abf1cea7348c39d22044b20bab193e74871e8e
MD5 e22497172f8d4c6b9a465fdee1cd1c94
SHA1 5f9b041f77fb0af092e1e5a567cb3882e843fa64
SHA512 e82e5094aa828eeb3a238c75a2766e76bffd568263bfa321ab2faf219b678a36fd37679e7a0d7da06627c58be9d0ca946b71ea4b88824423fc7af0e64ba1f71f
SSDEEP 393216:+gFuUcpFB8gEHiZ3PjMAUWqZOkWPyIXMCHWUjXqcuI3/PGTAI:+g1EFiM3PZqZayIXMb8XHH/O7
TLSH
T191E633999AD102FDE8B3803CFE916A44E0B974660BB2CEDB0AB443556D532918F3D377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1168	powershell.exe
5736	powershell.exe
4488	powershell.exe
4668	powershell.exe
5996	powershell.exe
5244	powershell.exe
4136	powershell.exe
5652	powershell.exe
4188	powershell.exe
3924	powershell.exe
3012	powershell.exe
4444	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4668	powershell.exe
4668	powershell.exe
5996	powershell.exe
5996	powershell.exe
5244	powershell.exe
5244	powershell.exe
4444	powershell.exe
4444	powershell.exe
4136	powershell.exe
4136	powershell.exe
5652	powershell.exe
5652	powershell.exe
4188	powershell.exe
4188	powershell.exe
3924	powershell.exe
3924	powershell.exe
3012	powershell.exe
3012	powershell.exe
1168	powershell.exe
1168	powershell.exe
5736	powershell.exe
5736	powershell.exe
4488	powershell.exe
4488	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeIncreaseQuotaPrivilege	4668	powershell.exe
Token: SeSecurityPrivilege	4668	powershell.exe
Token: SeTakeOwnershipPrivilege	4668	powershell.exe
Token: SeLoadDriverPrivilege	4668	powershell.exe
Token: SeSystemProfilePrivilege	4668	powershell.exe
Token: SeSystemtimePrivilege	4668	powershell.exe
Token: SeProfSingleProcessPrivilege	4668	powershell.exe
Token: SeIncBasePriorityPrivilege	4668	powershell.exe
Token: SeCreatePagefilePrivilege	4668	powershell.exe
Token: SeBackupPrivilege	4668	powershell.exe
Token: SeRestorePrivilege	4668	powershell.exe
Token: SeShutdownPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeSystemEnvironmentPrivilege	4668	powershell.exe
Token: SeRemoteShutdownPrivilege	4668	powershell.exe
Token: SeUndockPrivilege	4668	powershell.exe
Token: SeManageVolumePrivilege	4668	powershell.exe
Token: 33	4668	powershell.exe
Token: 34	4668	powershell.exe
Token: 35	4668	powershell.exe
Token: 36	4668	powershell.exe
Token: SeDebugPrivilege	5996	powershell.exe
Token: SeIncreaseQuotaPrivilege	5996	powershell.exe
Token: SeSecurityPrivilege	5996	powershell.exe
Token: SeTakeOwnershipPrivilege	5996	powershell.exe
Token: SeLoadDriverPrivilege	5996	powershell.exe
Token: SeSystemProfilePrivilege	5996	powershell.exe
Token: SeSystemtimePrivilege	5996	powershell.exe
Token: SeProfSingleProcessPrivilege	5996	powershell.exe
Token: SeIncBasePriorityPrivilege	5996	powershell.exe
Token: SeCreatePagefilePrivilege	5996	powershell.exe
Token: SeBackupPrivilege	5996	powershell.exe
Token: SeRestorePrivilege	5996	powershell.exe
Token: SeShutdownPrivilege	5996	powershell.exe
Token: SeDebugPrivilege	5996	powershell.exe
Token: SeSystemEnvironmentPrivilege	5996	powershell.exe
Token: SeRemoteShutdownPrivilege	5996	powershell.exe
Token: SeUndockPrivilege	5996	powershell.exe
Token: SeManageVolumePrivilege	5996	powershell.exe
Token: 33	5996	powershell.exe
Token: 34	5996	powershell.exe
Token: 35	5996	powershell.exe
Token: 36	5996	powershell.exe
Token: SeDebugPrivilege	5244	powershell.exe
Token: SeIncreaseQuotaPrivilege	5244	powershell.exe
Token: SeSecurityPrivilege	5244	powershell.exe
Token: SeTakeOwnershipPrivilege	5244	powershell.exe
Token: SeLoadDriverPrivilege	5244	powershell.exe
Token: SeSystemProfilePrivilege	5244	powershell.exe
Token: SeSystemtimePrivilege	5244	powershell.exe
Token: SeProfSingleProcessPrivilege	5244	powershell.exe
Token: SeIncBasePriorityPrivilege	5244	powershell.exe
Token: SeCreatePagefilePrivilege	5244	powershell.exe
Token: SeBackupPrivilege	5244	powershell.exe
Token: SeRestorePrivilege	5244	powershell.exe
Token: SeShutdownPrivilege	5244	powershell.exe
Token: SeDebugPrivilege	5244	powershell.exe
Token: SeSystemEnvironmentPrivilege	5244	powershell.exe
Token: SeRemoteShutdownPrivilege	5244	powershell.exe
Token: SeUndockPrivilege	5244	powershell.exe
Token: SeManageVolumePrivilege	5244	powershell.exe
Token: 33	5244	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 1620	4960	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	88
PID 1620 wrote to memory of 3352	1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 3352 wrote to memory of 4668	3352	cmd.exe	91
PID 1620 wrote to memory of 4412	1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	93
PID 4412 wrote to memory of 5996	4412	cmd.exe	95
PID 1620 wrote to memory of 1508	1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	96
PID 1508 wrote to memory of 5244	1508	cmd.exe	98
PID 1620 wrote to memory of 5376	1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	99
PID 5376 wrote to memory of 4444	5376	cmd.exe	101
PID 1620 wrote to memory of 3288	1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	102
PID 3288 wrote to memory of 4136	3288	cmd.exe	104
PID 1620 wrote to memory of 2876	1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	105
PID 2876 wrote to memory of 5652	2876	cmd.exe	107
PID 1620 wrote to memory of 3228	1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	108
PID 3228 wrote to memory of 4188	3228	cmd.exe	110
PID 1620 wrote to memory of 5132	1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	111
PID 5132 wrote to memory of 3924	5132	cmd.exe	113
PID 1620 wrote to memory of 4624	1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	114
PID 4624 wrote to memory of 3012	4624	cmd.exe	116
PID 1620 wrote to memory of 5704	1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	117
PID 5704 wrote to memory of 1168	5704	cmd.exe	119
PID 1620 wrote to memory of 3564	1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	120
PID 3564 wrote to memory of 5736	3564	cmd.exe	122
PID 1620 wrote to memory of 3108	1620	2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	123
PID 3108 wrote to memory of 4488	3108	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Users\Admin\AppData\Local\Temp\2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-14_e22497172f8d4c6b9a465fdee1cd1c94_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\rikarajo'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\rikarajo'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5376
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact