9c13c855e12616db30895d03c56f053cafa6be7055103afc260b41abce9d2bff

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260716-eb24xacw2l
SHA256 9c13c855e12616db30895d03c56f053cafa6be7055103afc260b41abce9d2bff
MD5 1216276d8a429e10fa7f0b4df8042910
SHA1 316a039ebf009e2ff33fbd52e52a0728189e1625
SHA512 df74b60dc6c7a2bd5a2273692401512ab88071153757c5cfbd8f2976a234843eb35ff4f028113974acc2156fb00dc9bc2eb309b1539b48bcf0a42b9ef7e5bd8b
SSDEEP 393216:oHui0M+zX1kPUDDjE4CntaSahS3XMCHWUjX2cuI3/PGTAI:oOiGzX9vjE7lt3XMb8XLH/O7
TLSH
T184E6335C99F012FAE0B34038AAE15195EA64BC764731C5CF8BE883E1BE632915D3CB57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
620	powershell.exe
2652	powershell.exe
5196	powershell.exe
4396	powershell.exe
5980	powershell.exe
5420	powershell.exe
3220	powershell.exe
1244	powershell.exe
2724	powershell.exe
1584	powershell.exe
2508	powershell.exe
940	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1244	powershell.exe
1244	powershell.exe
2724	powershell.exe
2724	powershell.exe
620	powershell.exe
620	powershell.exe
1584	powershell.exe
1584	powershell.exe
2652	powershell.exe
2652	powershell.exe
5196	powershell.exe
5196	powershell.exe
2508	powershell.exe
2508	powershell.exe
940	powershell.exe
940	powershell.exe
4396	powershell.exe
4396	powershell.exe
5980	powershell.exe
5980	powershell.exe
5420	powershell.exe
5420	powershell.exe
3220	powershell.exe
3220	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeIncreaseQuotaPrivilege	1244	powershell.exe
Token: SeSecurityPrivilege	1244	powershell.exe
Token: SeTakeOwnershipPrivilege	1244	powershell.exe
Token: SeLoadDriverPrivilege	1244	powershell.exe
Token: SeSystemProfilePrivilege	1244	powershell.exe
Token: SeSystemtimePrivilege	1244	powershell.exe
Token: SeProfSingleProcessPrivilege	1244	powershell.exe
Token: SeIncBasePriorityPrivilege	1244	powershell.exe
Token: SeCreatePagefilePrivilege	1244	powershell.exe
Token: SeBackupPrivilege	1244	powershell.exe
Token: SeRestorePrivilege	1244	powershell.exe
Token: SeShutdownPrivilege	1244	powershell.exe
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeSystemEnvironmentPrivilege	1244	powershell.exe
Token: SeRemoteShutdownPrivilege	1244	powershell.exe
Token: SeUndockPrivilege	1244	powershell.exe
Token: SeManageVolumePrivilege	1244	powershell.exe
Token: 33	1244	powershell.exe
Token: 34	1244	powershell.exe
Token: 35	1244	powershell.exe
Token: 36	1244	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeIncreaseQuotaPrivilege	2724	powershell.exe
Token: SeSecurityPrivilege	2724	powershell.exe
Token: SeTakeOwnershipPrivilege	2724	powershell.exe
Token: SeLoadDriverPrivilege	2724	powershell.exe
Token: SeSystemProfilePrivilege	2724	powershell.exe
Token: SeSystemtimePrivilege	2724	powershell.exe
Token: SeProfSingleProcessPrivilege	2724	powershell.exe
Token: SeIncBasePriorityPrivilege	2724	powershell.exe
Token: SeCreatePagefilePrivilege	2724	powershell.exe
Token: SeBackupPrivilege	2724	powershell.exe
Token: SeRestorePrivilege	2724	powershell.exe
Token: SeShutdownPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeSystemEnvironmentPrivilege	2724	powershell.exe
Token: SeRemoteShutdownPrivilege	2724	powershell.exe
Token: SeUndockPrivilege	2724	powershell.exe
Token: SeManageVolumePrivilege	2724	powershell.exe
Token: 33	2724	powershell.exe
Token: 34	2724	powershell.exe
Token: 35	2724	powershell.exe
Token: 36	2724	powershell.exe
Token: SeDebugPrivilege	620	powershell.exe
Token: SeIncreaseQuotaPrivilege	620	powershell.exe
Token: SeSecurityPrivilege	620	powershell.exe
Token: SeTakeOwnershipPrivilege	620	powershell.exe
Token: SeLoadDriverPrivilege	620	powershell.exe
Token: SeSystemProfilePrivilege	620	powershell.exe
Token: SeSystemtimePrivilege	620	powershell.exe
Token: SeProfSingleProcessPrivilege	620	powershell.exe
Token: SeIncBasePriorityPrivilege	620	powershell.exe
Token: SeCreatePagefilePrivilege	620	powershell.exe
Token: SeBackupPrivilege	620	powershell.exe
Token: SeRestorePrivilege	620	powershell.exe
Token: SeShutdownPrivilege	620	powershell.exe
Token: SeDebugPrivilege	620	powershell.exe
Token: SeSystemEnvironmentPrivilege	620	powershell.exe
Token: SeRemoteShutdownPrivilege	620	powershell.exe
Token: SeUndockPrivilege	620	powershell.exe
Token: SeManageVolumePrivilege	620	powershell.exe
Token: 33	620	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5968 wrote to memory of 3348	5968	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	87
PID 3348 wrote to memory of 4116	3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	88
PID 4116 wrote to memory of 1244	4116	cmd.exe	90
PID 3348 wrote to memory of 1944	3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	92
PID 1944 wrote to memory of 2724	1944	cmd.exe	94
PID 3348 wrote to memory of 3960	3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	95
PID 3960 wrote to memory of 620	3960	cmd.exe	97
PID 3348 wrote to memory of 400	3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	98
PID 400 wrote to memory of 1584	400	cmd.exe	100
PID 3348 wrote to memory of 1532	3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	101
PID 1532 wrote to memory of 2652	1532	cmd.exe	103
PID 3348 wrote to memory of 1004	3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	104
PID 1004 wrote to memory of 5196	1004	cmd.exe	106
PID 3348 wrote to memory of 1596	3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	107
PID 1596 wrote to memory of 2508	1596	cmd.exe	109
PID 3348 wrote to memory of 988	3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	110
PID 988 wrote to memory of 940	988	cmd.exe	112
PID 3348 wrote to memory of 204	3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	113
PID 204 wrote to memory of 4396	204	cmd.exe	115
PID 3348 wrote to memory of 5864	3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	116
PID 5864 wrote to memory of 5980	5864	cmd.exe	118
PID 3348 wrote to memory of 1504	3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	119
PID 1504 wrote to memory of 5420	1504	cmd.exe	121
PID 3348 wrote to memory of 4124	3348	2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	122
PID 4124 wrote to memory of 3220	4124	cmd.exe	124

C:\Users\Admin\AppData\Local\Temp\2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5968
- C:\Users\Admin\AppData\Local\Temp\2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-16_1216276d8a429e10fa7f0b4df8042910_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\loqejidi'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\loqejidi'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact