77e74075645dd76bc4836bb5e8ffb6a6a1dbdfb520a5cd116b8e6848a6ec61ac

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 11:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.7MB
Sample260718-ny2lbsav5m
SHA256 77e74075645dd76bc4836bb5e8ffb6a6a1dbdfb520a5cd116b8e6848a6ec61ac
MD5 18ad51d34f7092e6c87930c40cde319a
SHA1 7086f9d1f0f080219b5048418b91a03a9349be51
SHA512 7d005b495b6323c49760e06f19ddcbe5f9e0f0d19bfdf0f9e84989f15e9754a9fd8a22d6519dac2954b52df826bbcc3da07f8410f7fbcf13d56a331e579194f6
SSDEEP 393216:09arm+y38sLWluhEncuv1ZPGTXMCHWUjXVcuI3/PGTAI:090xy3IlJc+ZPGTXMb8XiH/O7
TLSH
T191E6339869E039FDFA73907C9DE19892E129B82507B3C6CB176483A65E171D0CD3EB13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5776	powershell.exe
4808	powershell.exe
3400	powershell.exe
4540	powershell.exe
1896	powershell.exe
1424	powershell.exe
6000	powershell.exe
3724	powershell.exe
2228	powershell.exe
4208	powershell.exe
3492	powershell.exe
4468	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1044	cmd.exe
3796	cmd.exe
3188	cmd.exe
2936	cmd.exe
5628	cmd.exe
4528	cmd.exe
4536	cmd.exe
3428	cmd.exe
3792	cmd.exe
4952	cmd.exe
4240	cmd.exe
6004	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3492	powershell.exe
3492	powershell.exe
4540	powershell.exe
4540	powershell.exe
1896	powershell.exe
1896	powershell.exe
1424	powershell.exe
1424	powershell.exe
4468	powershell.exe
4468	powershell.exe
5776	powershell.exe
5776	powershell.exe
6000	powershell.exe
6000	powershell.exe
4808	powershell.exe
4808	powershell.exe
3724	powershell.exe
3724	powershell.exe
2228	powershell.exe
2228	powershell.exe
4208	powershell.exe
4208	powershell.exe
3400	powershell.exe
3400	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	3492	powershell.exe
Token: SeIncreaseQuotaPrivilege	3492	powershell.exe
Token: SeSecurityPrivilege	3492	powershell.exe
Token: SeTakeOwnershipPrivilege	3492	powershell.exe
Token: SeLoadDriverPrivilege	3492	powershell.exe
Token: SeSystemProfilePrivilege	3492	powershell.exe
Token: SeSystemtimePrivilege	3492	powershell.exe
Token: SeProfSingleProcessPrivilege	3492	powershell.exe
Token: SeIncBasePriorityPrivilege	3492	powershell.exe
Token: SeCreatePagefilePrivilege	3492	powershell.exe
Token: SeBackupPrivilege	3492	powershell.exe
Token: SeRestorePrivilege	3492	powershell.exe
Token: SeShutdownPrivilege	3492	powershell.exe
Token: SeDebugPrivilege	3492	powershell.exe
Token: SeSystemEnvironmentPrivilege	3492	powershell.exe
Token: SeRemoteShutdownPrivilege	3492	powershell.exe
Token: SeUndockPrivilege	3492	powershell.exe
Token: SeManageVolumePrivilege	3492	powershell.exe
Token: 33	3492	powershell.exe
Token: 34	3492	powershell.exe
Token: 35	3492	powershell.exe
Token: 36	3492	powershell.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeIncreaseQuotaPrivilege	4540	powershell.exe
Token: SeSecurityPrivilege	4540	powershell.exe
Token: SeTakeOwnershipPrivilege	4540	powershell.exe
Token: SeLoadDriverPrivilege	4540	powershell.exe
Token: SeSystemProfilePrivilege	4540	powershell.exe
Token: SeSystemtimePrivilege	4540	powershell.exe
Token: SeProfSingleProcessPrivilege	4540	powershell.exe
Token: SeIncBasePriorityPrivilege	4540	powershell.exe
Token: SeCreatePagefilePrivilege	4540	powershell.exe
Token: SeBackupPrivilege	4540	powershell.exe
Token: SeRestorePrivilege	4540	powershell.exe
Token: SeShutdownPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeSystemEnvironmentPrivilege	4540	powershell.exe
Token: SeRemoteShutdownPrivilege	4540	powershell.exe
Token: SeUndockPrivilege	4540	powershell.exe
Token: SeManageVolumePrivilege	4540	powershell.exe
Token: 33	4540	powershell.exe
Token: 34	4540	powershell.exe
Token: 35	4540	powershell.exe
Token: 36	4540	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeIncreaseQuotaPrivilege	1896	powershell.exe
Token: SeSecurityPrivilege	1896	powershell.exe
Token: SeTakeOwnershipPrivilege	1896	powershell.exe
Token: SeLoadDriverPrivilege	1896	powershell.exe
Token: SeSystemProfilePrivilege	1896	powershell.exe
Token: SeSystemtimePrivilege	1896	powershell.exe
Token: SeProfSingleProcessPrivilege	1896	powershell.exe
Token: SeIncBasePriorityPrivilege	1896	powershell.exe
Token: SeCreatePagefilePrivilege	1896	powershell.exe
Token: SeBackupPrivilege	1896	powershell.exe
Token: SeRestorePrivilege	1896	powershell.exe
Token: SeShutdownPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeSystemEnvironmentPrivilege	1896	powershell.exe
Token: SeRemoteShutdownPrivilege	1896	powershell.exe
Token: SeUndockPrivilege	1896	powershell.exe
Token: SeManageVolumePrivilege	1896	powershell.exe
Token: 33	1896	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2912	1548	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 2912 wrote to memory of 4528	2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4528 wrote to memory of 3492	4528	cmd.exe	92
PID 2912 wrote to memory of 4536	2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 4536 wrote to memory of 4540	4536	cmd.exe	96
PID 2912 wrote to memory of 3428	2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 3428 wrote to memory of 1896	3428	cmd.exe	99
PID 2912 wrote to memory of 6004	2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 6004 wrote to memory of 1424	6004	cmd.exe	102
PID 2912 wrote to memory of 3792	2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 3792 wrote to memory of 4468	3792	cmd.exe	105
PID 2912 wrote to memory of 1044	2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 1044 wrote to memory of 5776	1044	cmd.exe	108
PID 2912 wrote to memory of 3796	2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 3796 wrote to memory of 6000	3796	cmd.exe	111
PID 2912 wrote to memory of 3188	2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 3188 wrote to memory of 4808	3188	cmd.exe	114
PID 2912 wrote to memory of 2936	2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 2936 wrote to memory of 3724	2936	cmd.exe	117
PID 2912 wrote to memory of 4952	2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 4952 wrote to memory of 2228	4952	cmd.exe	120
PID 2912 wrote to memory of 4240	2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	122
PID 4240 wrote to memory of 4208	4240	cmd.exe	124
PID 2912 wrote to memory of 5628	2912	2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	125
PID 5628 wrote to memory of 3400	5628	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-18_18ad51d34f7092e6c87930c40cde319a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\lohocada'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Videos\lohocada'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact