8c4cac17d41571cc262de43846310440f0d0e31bd3dfa6e5c9df00bcbd5b323e

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260718-m5z6eahs5n
SHA256 8c4cac17d41571cc262de43846310440f0d0e31bd3dfa6e5c9df00bcbd5b323e
MD5 7849b8d963c64b913d89f8d512559119
SHA1 b67922864eb02abffbb792e59749553b4ba80df3
SHA512 a7294d37057035bd5b07f7960d37dd24ebf232733a0edf9a0cf67ca703e5244fdafa98432df7cb8892e7ce3dcbff76969b85153f2e7ea48986ba458d294e4e64
SSDEEP 393216:dnoTR43c2YufRJOX9NXMCHWUjX8cuI3/PGTAI:dod2c18AHXMb8XpH/O7
TLSH
T168E6335CE5E022FFE6639138E9F242D4E598B4760BB3D5DB479493B27E172E0093C622
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2520	powershell.exe
3280	powershell.exe
2244	powershell.exe
5888	powershell.exe
2552	powershell.exe
2872	powershell.exe
5548	powershell.exe
5456	powershell.exe
1400	powershell.exe
3688	powershell.exe
612	powershell.exe
2660	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2284	cmd.exe
1592	cmd.exe
3044	cmd.exe
5196	cmd.exe
4168	cmd.exe
1608	cmd.exe
4144	cmd.exe
2356	cmd.exe
2232	cmd.exe
3816	cmd.exe
4288	cmd.exe
1308	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3688	powershell.exe
3688	powershell.exe
2244	powershell.exe
2244	powershell.exe
2244	powershell.exe
5888	powershell.exe
5888	powershell.exe
5888	powershell.exe
2552	powershell.exe
2552	powershell.exe
2552	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
2872	powershell.exe
2872	powershell.exe
2872	powershell.exe
2660	powershell.exe
2660	powershell.exe
2660	powershell.exe
5548	powershell.exe
5548	powershell.exe
5548	powershell.exe
2520	powershell.exe
2520	powershell.exe
2520	powershell.exe
5456	powershell.exe
5456	powershell.exe
5456	powershell.exe
1400	powershell.exe
1400	powershell.exe
1400	powershell.exe
3280	powershell.exe
3280	powershell.exe
3280	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	3688	powershell.exe
Token: SeIncreaseQuotaPrivilege	3688	powershell.exe
Token: SeSecurityPrivilege	3688	powershell.exe
Token: SeTakeOwnershipPrivilege	3688	powershell.exe
Token: SeLoadDriverPrivilege	3688	powershell.exe
Token: SeSystemProfilePrivilege	3688	powershell.exe
Token: SeSystemtimePrivilege	3688	powershell.exe
Token: SeProfSingleProcessPrivilege	3688	powershell.exe
Token: SeIncBasePriorityPrivilege	3688	powershell.exe
Token: SeCreatePagefilePrivilege	3688	powershell.exe
Token: SeBackupPrivilege	3688	powershell.exe
Token: SeRestorePrivilege	3688	powershell.exe
Token: SeShutdownPrivilege	3688	powershell.exe
Token: SeDebugPrivilege	3688	powershell.exe
Token: SeSystemEnvironmentPrivilege	3688	powershell.exe
Token: SeRemoteShutdownPrivilege	3688	powershell.exe
Token: SeUndockPrivilege	3688	powershell.exe
Token: SeManageVolumePrivilege	3688	powershell.exe
Token: 33	3688	powershell.exe
Token: 34	3688	powershell.exe
Token: 35	3688	powershell.exe
Token: 36	3688	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeIncreaseQuotaPrivilege	2244	powershell.exe
Token: SeSecurityPrivilege	2244	powershell.exe
Token: SeTakeOwnershipPrivilege	2244	powershell.exe
Token: SeLoadDriverPrivilege	2244	powershell.exe
Token: SeSystemProfilePrivilege	2244	powershell.exe
Token: SeSystemtimePrivilege	2244	powershell.exe
Token: SeProfSingleProcessPrivilege	2244	powershell.exe
Token: SeIncBasePriorityPrivilege	2244	powershell.exe
Token: SeCreatePagefilePrivilege	2244	powershell.exe
Token: SeBackupPrivilege	2244	powershell.exe
Token: SeRestorePrivilege	2244	powershell.exe
Token: SeShutdownPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeSystemEnvironmentPrivilege	2244	powershell.exe
Token: SeRemoteShutdownPrivilege	2244	powershell.exe
Token: SeUndockPrivilege	2244	powershell.exe
Token: SeManageVolumePrivilege	2244	powershell.exe
Token: 33	2244	powershell.exe
Token: 34	2244	powershell.exe
Token: 35	2244	powershell.exe
Token: 36	2244	powershell.exe
Token: SeDebugPrivilege	5888	powershell.exe
Token: SeIncreaseQuotaPrivilege	5888	powershell.exe
Token: SeSecurityPrivilege	5888	powershell.exe
Token: SeTakeOwnershipPrivilege	5888	powershell.exe
Token: SeLoadDriverPrivilege	5888	powershell.exe
Token: SeSystemProfilePrivilege	5888	powershell.exe
Token: SeSystemtimePrivilege	5888	powershell.exe
Token: SeProfSingleProcessPrivilege	5888	powershell.exe
Token: SeIncBasePriorityPrivilege	5888	powershell.exe
Token: SeCreatePagefilePrivilege	5888	powershell.exe
Token: SeBackupPrivilege	5888	powershell.exe
Token: SeRestorePrivilege	5888	powershell.exe
Token: SeShutdownPrivilege	5888	powershell.exe
Token: SeDebugPrivilege	5888	powershell.exe
Token: SeSystemEnvironmentPrivilege	5888	powershell.exe
Token: SeRemoteShutdownPrivilege	5888	powershell.exe
Token: SeUndockPrivilege	5888	powershell.exe
Token: SeManageVolumePrivilege	5888	powershell.exe
Token: 33	5888	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 4044	4516	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 4044 wrote to memory of 4144	4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4144 wrote to memory of 3688	4144	cmd.exe	92
PID 4044 wrote to memory of 2356	4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 2356 wrote to memory of 2244	2356	cmd.exe	96
PID 4044 wrote to memory of 3044	4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 3044 wrote to memory of 5888	3044	cmd.exe	99
PID 4044 wrote to memory of 2232	4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 2232 wrote to memory of 2552	2232	cmd.exe	102
PID 4044 wrote to memory of 3816	4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 3816 wrote to memory of 612	3816	cmd.exe	105
PID 4044 wrote to memory of 4288	4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 4288 wrote to memory of 2872	4288	cmd.exe	108
PID 4044 wrote to memory of 5196	4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 5196 wrote to memory of 2660	5196	cmd.exe	111
PID 4044 wrote to memory of 1308	4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 1308 wrote to memory of 5548	1308	cmd.exe	114
PID 4044 wrote to memory of 4168	4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 4168 wrote to memory of 2520	4168	cmd.exe	117
PID 4044 wrote to memory of 2284	4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 2284 wrote to memory of 5456	2284	cmd.exe	120
PID 4044 wrote to memory of 1592	4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 1592 wrote to memory of 1400	1592	cmd.exe	123
PID 4044 wrote to memory of 1608	4044	2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	124
PID 1608 wrote to memory of 3280	1608	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Local\Temp\2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-18_7849b8d963c64b913d89f8d512559119_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\lohocada'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\lohocada'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1592
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact