Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
19/07/2026, 04:23
General
- Target 2026-07-19_77d4225d0c20db780986414c9ed1f03c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 10.1MB
- Sample260719-ez486set7v
- SHA256 da37b2269e1ff3d0e931b23ed70597be7b5ee3d825652f581eaadad6103eac80
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Loads dropped DLL 18 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- UPX packed file 56 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_77d4225d0c20db780986414c9ed1f03c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_77d4225d0c20db780986414c9ed1f03c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_77d4225d0c20db780986414c9ed1f03c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_77d4225d0c20db780986414c9ed1f03c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-19_77d4225d0c20db780986414c9ed1f03c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe'"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-19_77d4225d0c20db780986414c9ed1f03c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_wmi.pyd
base_library.zip
blank.aes
blank.aes
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python313.dll
rar.exe
rarreg.key
select.pyd
Lorem ipsum.txt
sqlite3.dll
unicodedata.pyd
__PSScriptPolicyTest_kq1mqhkr.ttw.ps1
memory/1652-78-0x00007FFCFAAE0000-0x00007FFCFAAF4000-memory.dmp
memory/1652-50-0x00007FFCFAB40000-0x00007FFCFAB59000-memory.dmp
memory/1652-75-0x00007FFCFEB10000-0x00007FFCFEB1F000-memory.dmp
memory/1652-80-0x00007FFCECCA0000-0x00007FFCED1D3000-memory.dmp
memory/1652-82-0x00007FFCFAAC0000-0x00007FFCFAAD9000-memory.dmp
memory/1652-90-0x00007FFCFA060000-0x00007FFCFA12E000-memory.dmp
memory/1652-91-0x00007FFCFAA50000-0x00007FFCFAA84000-memory.dmp
memory/1652-88-0x00007FFCFBCF0000-0x00007FFCFBD17000-memory.dmp
memory/1652-87-0x00007FFCED1E0000-0x00007FFCED843000-memory.dmp
memory/1652-44-0x00007FFCFBCF0000-0x00007FFCFBD17000-memory.dmp
memory/1652-89-0x00007FFCFAAB0000-0x00007FFCFAABD000-memory.dmp
memory/1652-97-0x00007FFCFA030000-0x00007FFCFA055000-memory.dmp
memory/1652-99-0x00007FFCF9D90000-0x00007FFCF9F0F000-memory.dmp
memory/1652-101-0x00007FFCFAB10000-0x00007FFCFAB3B000-memory.dmp
memory/1652-102-0x00007FFCF9CD0000-0x00007FFCF9D83000-memory.dmp
memory/1652-38-0x00007FFCED1E0000-0x00007FFCED843000-memory.dmp
memory/1652-45-0x00007FFD045E0000-0x00007FFD045EF000-memory.dmp
memory/1652-74-0x00007FFCFEC50000-0x00007FFCFEC5D000-memory.dmp
memory/1652-51-0x00007FFCFAB10000-0x00007FFCFAB3B000-memory.dmp
memory/1652-123-0x00007FFCED1E0000-0x00007FFCED843000-memory.dmp
memory/1652-150-0x00007FFCFA060000-0x00007FFCFA12E000-memory.dmp
memory/1652-149-0x00007FFCFAAB0000-0x00007FFCFAABD000-memory.dmp
memory/1652-148-0x00007FFCFAAC0000-0x00007FFCFAAD9000-memory.dmp
memory/1652-147-0x00007FFCECCA0000-0x00007FFCED1D3000-memory.dmp
memory/1652-146-0x00007FFCFAAE0000-0x00007FFCFAAF4000-memory.dmp
memory/1652-145-0x00007FFCFEB10000-0x00007FFCFEB1F000-memory.dmp
memory/1652-144-0x00007FFCFEC50000-0x00007FFCFEC5D000-memory.dmp
memory/1652-143-0x00007FFCFAB40000-0x00007FFCFAB59000-memory.dmp
memory/1652-142-0x00007FFCFAB10000-0x00007FFCFAB3B000-memory.dmp
memory/1652-141-0x00007FFCFBCF0000-0x00007FFCFBD17000-memory.dmp
memory/1652-140-0x00007FFD045E0000-0x00007FFD045EF000-memory.dmp
memory/1652-139-0x00007FFCFAA50000-0x00007FFCFAA84000-memory.dmp
memory/1652-138-0x00007FFCF9CD0000-0x00007FFCF9D83000-memory.dmp
memory/1652-137-0x00007FFCF9D90000-0x00007FFCF9F0F000-memory.dmp
memory/1652-136-0x00007FFCFA030000-0x00007FFCFA055000-memory.dmp
memory/4776-103-0x000002AA4DC20000-0x000002AA4DC42000-memory.dmp