9a9c54408a1d2373aeefac87017e1532764ae54f95774acabcdba60aa6af01e0

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260718-dxafcaex2n
SHA256 9a9c54408a1d2373aeefac87017e1532764ae54f95774acabcdba60aa6af01e0
MD5 72fb58810c5e9e98ab26d3996421977e
SHA1 8b95508fcc1be3814a549d13714d064cd777dc7a
SHA512 73f7efc1c9d4c558013130ab44edbda274afb51c322330d185d8816d41f113bbf558176da6457491bb26bb7621dc9baa2f5337cedafecbea576e7ac18f13ea4d
SSDEEP 393216:7zBwMIIDgptcp1u9+SOo4GVTXMCHWUjXlcuI3/PGTAI:7NwjYgptcDqTXMb8XSH/O7
TLSH
T113E6331413D014EEFAA2913CE9F299A1F1B474B12735C65703E88A763E7B1D14D3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2948	powershell.exe
6108	powershell.exe
5796	powershell.exe
5580	powershell.exe
4560	powershell.exe
1264	powershell.exe
2544	powershell.exe
5000	powershell.exe
4260	powershell.exe
2668	powershell.exe
1912	powershell.exe
5408	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2672	cmd.exe
5200	cmd.exe
568	cmd.exe
2528	cmd.exe
3132	cmd.exe
5504	cmd.exe
5960	cmd.exe
5612	cmd.exe
1624	cmd.exe
3692	cmd.exe
1504	cmd.exe
1840	cmd.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2544	powershell.exe
2544	powershell.exe
5000	powershell.exe
5000	powershell.exe
5000	powershell.exe
4260	powershell.exe
4260	powershell.exe
4260	powershell.exe
2948	powershell.exe
2948	powershell.exe
6108	powershell.exe
6108	powershell.exe
5796	powershell.exe
5796	powershell.exe
5796	powershell.exe
5580	powershell.exe
5580	powershell.exe
5580	powershell.exe
2668	powershell.exe
2668	powershell.exe
2668	powershell.exe
1912	powershell.exe
1912	powershell.exe
1912	powershell.exe
5408	powershell.exe
5408	powershell.exe
5408	powershell.exe
4560	powershell.exe
4560	powershell.exe
4560	powershell.exe
1264	powershell.exe
1264	powershell.exe
1264	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeIncreaseQuotaPrivilege	2544	powershell.exe
Token: SeSecurityPrivilege	2544	powershell.exe
Token: SeTakeOwnershipPrivilege	2544	powershell.exe
Token: SeLoadDriverPrivilege	2544	powershell.exe
Token: SeSystemProfilePrivilege	2544	powershell.exe
Token: SeSystemtimePrivilege	2544	powershell.exe
Token: SeProfSingleProcessPrivilege	2544	powershell.exe
Token: SeIncBasePriorityPrivilege	2544	powershell.exe
Token: SeCreatePagefilePrivilege	2544	powershell.exe
Token: SeBackupPrivilege	2544	powershell.exe
Token: SeRestorePrivilege	2544	powershell.exe
Token: SeShutdownPrivilege	2544	powershell.exe
Token: SeDebugPrivilege	2544	powershell.exe
Token: SeSystemEnvironmentPrivilege	2544	powershell.exe
Token: SeRemoteShutdownPrivilege	2544	powershell.exe
Token: SeUndockPrivilege	2544	powershell.exe
Token: SeManageVolumePrivilege	2544	powershell.exe
Token: 33	2544	powershell.exe
Token: 34	2544	powershell.exe
Token: 35	2544	powershell.exe
Token: 36	2544	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeIncreaseQuotaPrivilege	5000	powershell.exe
Token: SeSecurityPrivilege	5000	powershell.exe
Token: SeTakeOwnershipPrivilege	5000	powershell.exe
Token: SeLoadDriverPrivilege	5000	powershell.exe
Token: SeSystemProfilePrivilege	5000	powershell.exe
Token: SeSystemtimePrivilege	5000	powershell.exe
Token: SeProfSingleProcessPrivilege	5000	powershell.exe
Token: SeIncBasePriorityPrivilege	5000	powershell.exe
Token: SeCreatePagefilePrivilege	5000	powershell.exe
Token: SeBackupPrivilege	5000	powershell.exe
Token: SeRestorePrivilege	5000	powershell.exe
Token: SeShutdownPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeSystemEnvironmentPrivilege	5000	powershell.exe
Token: SeRemoteShutdownPrivilege	5000	powershell.exe
Token: SeUndockPrivilege	5000	powershell.exe
Token: SeManageVolumePrivilege	5000	powershell.exe
Token: 33	5000	powershell.exe
Token: 34	5000	powershell.exe
Token: 35	5000	powershell.exe
Token: 36	5000	powershell.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeIncreaseQuotaPrivilege	4260	powershell.exe
Token: SeSecurityPrivilege	4260	powershell.exe
Token: SeTakeOwnershipPrivilege	4260	powershell.exe
Token: SeLoadDriverPrivilege	4260	powershell.exe
Token: SeSystemProfilePrivilege	4260	powershell.exe
Token: SeSystemtimePrivilege	4260	powershell.exe
Token: SeProfSingleProcessPrivilege	4260	powershell.exe
Token: SeIncBasePriorityPrivilege	4260	powershell.exe
Token: SeCreatePagefilePrivilege	4260	powershell.exe
Token: SeBackupPrivilege	4260	powershell.exe
Token: SeRestorePrivilege	4260	powershell.exe
Token: SeShutdownPrivilege	4260	powershell.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeSystemEnvironmentPrivilege	4260	powershell.exe
Token: SeRemoteShutdownPrivilege	4260	powershell.exe
Token: SeUndockPrivilege	4260	powershell.exe
Token: SeManageVolumePrivilege	4260	powershell.exe
Token: 33	4260	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 5064	4332	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 5064 wrote to memory of 3692	5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 3692 wrote to memory of 2544	3692	cmd.exe	92
PID 5064 wrote to memory of 1504	5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 1504 wrote to memory of 5000	1504	cmd.exe	96
PID 5064 wrote to memory of 1840	5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 1840 wrote to memory of 4260	1840	cmd.exe	99
PID 5064 wrote to memory of 2672	5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 2672 wrote to memory of 2948	2672	cmd.exe	102
PID 5064 wrote to memory of 5200	5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 5200 wrote to memory of 6108	5200	cmd.exe	105
PID 5064 wrote to memory of 568	5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 568 wrote to memory of 5796	568	cmd.exe	108
PID 5064 wrote to memory of 5504	5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 5504 wrote to memory of 5580	5504	cmd.exe	111
PID 5064 wrote to memory of 5960	5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 5960 wrote to memory of 2668	5960	cmd.exe	114
PID 5064 wrote to memory of 5612	5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 5612 wrote to memory of 1912	5612	cmd.exe	117
PID 5064 wrote to memory of 2528	5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 2528 wrote to memory of 5408	2528	cmd.exe	120
PID 5064 wrote to memory of 3132	5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 3132 wrote to memory of 4560	3132	cmd.exe	123
PID 5064 wrote to memory of 1624	5064	2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	125
PID 1624 wrote to memory of 1264	1624	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Users\Admin\AppData\Local\Temp\2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-17_72fb58810c5e9e98ab26d3996421977e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3692
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\lohocada'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\lohocada'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5612
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact