78495c054f2466cb5997d0fc5d1ee913d01edeb191b7e730cf508d17ec1b3083

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.7MB
Sample260723-vffdpsgl5t
SHA256 78495c054f2466cb5997d0fc5d1ee913d01edeb191b7e730cf508d17ec1b3083
MD5 58809009fa78d2d9c757f730bfe843a6
SHA1 a3bcd3d86ce11488a403e5af142c9d95c6708424
SHA512 3dc9a6566c3bb246fd95eb626e67df0636ef7ea1c53bd9a69e0e2d2482bff5532aea2940e653238b92a7d2ea101e287cdba2aac6b19145a4998d70572bf0b4a8
SSDEEP 393216:ksK4m2fOjhiPWRK6pqOnukM0OXMCHWUjXGcuI3/PGTAI:kREV6pokDOXMb8X7H/O7
TLSH
T1C1E6335CA9D111FCD6A3503CAFA14572E568B8721B73C6AF1BB4C7A67E032D08A3D613
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2560	powershell.exe
3588	powershell.exe
3024	powershell.exe
556	powershell.exe
5716	powershell.exe
6136	powershell.exe
5668	powershell.exe
4720	powershell.exe
3704	powershell.exe
5452	powershell.exe
5744	powershell.exe
2456	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3344	cmd.exe
3756	cmd.exe
2912	cmd.exe
1516	cmd.exe
1172	cmd.exe
1180	cmd.exe
1740	cmd.exe
2960	cmd.exe
2424	cmd.exe
3328	cmd.exe
3028	cmd.exe
872	cmd.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3704	powershell.exe
3704	powershell.exe
2560	powershell.exe
2560	powershell.exe
2560	powershell.exe
3588	powershell.exe
3588	powershell.exe
3024	powershell.exe
3024	powershell.exe
5452	powershell.exe
5452	powershell.exe
556	powershell.exe
556	powershell.exe
5716	powershell.exe
5716	powershell.exe
5716	powershell.exe
6136	powershell.exe
6136	powershell.exe
6136	powershell.exe
5668	powershell.exe
5668	powershell.exe
5668	powershell.exe
4720	powershell.exe
4720	powershell.exe
4720	powershell.exe
5744	powershell.exe
5744	powershell.exe
5744	powershell.exe
2456	powershell.exe
2456	powershell.exe
2456	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	3704	powershell.exe
Token: SeIncreaseQuotaPrivilege	3704	powershell.exe
Token: SeSecurityPrivilege	3704	powershell.exe
Token: SeTakeOwnershipPrivilege	3704	powershell.exe
Token: SeLoadDriverPrivilege	3704	powershell.exe
Token: SeSystemProfilePrivilege	3704	powershell.exe
Token: SeSystemtimePrivilege	3704	powershell.exe
Token: SeProfSingleProcessPrivilege	3704	powershell.exe
Token: SeIncBasePriorityPrivilege	3704	powershell.exe
Token: SeCreatePagefilePrivilege	3704	powershell.exe
Token: SeBackupPrivilege	3704	powershell.exe
Token: SeRestorePrivilege	3704	powershell.exe
Token: SeShutdownPrivilege	3704	powershell.exe
Token: SeDebugPrivilege	3704	powershell.exe
Token: SeSystemEnvironmentPrivilege	3704	powershell.exe
Token: SeRemoteShutdownPrivilege	3704	powershell.exe
Token: SeUndockPrivilege	3704	powershell.exe
Token: SeManageVolumePrivilege	3704	powershell.exe
Token: 33	3704	powershell.exe
Token: 34	3704	powershell.exe
Token: 35	3704	powershell.exe
Token: 36	3704	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeIncreaseQuotaPrivilege	2560	powershell.exe
Token: SeSecurityPrivilege	2560	powershell.exe
Token: SeTakeOwnershipPrivilege	2560	powershell.exe
Token: SeLoadDriverPrivilege	2560	powershell.exe
Token: SeSystemProfilePrivilege	2560	powershell.exe
Token: SeSystemtimePrivilege	2560	powershell.exe
Token: SeProfSingleProcessPrivilege	2560	powershell.exe
Token: SeIncBasePriorityPrivilege	2560	powershell.exe
Token: SeCreatePagefilePrivilege	2560	powershell.exe
Token: SeBackupPrivilege	2560	powershell.exe
Token: SeRestorePrivilege	2560	powershell.exe
Token: SeShutdownPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeSystemEnvironmentPrivilege	2560	powershell.exe
Token: SeRemoteShutdownPrivilege	2560	powershell.exe
Token: SeUndockPrivilege	2560	powershell.exe
Token: SeManageVolumePrivilege	2560	powershell.exe
Token: 33	2560	powershell.exe
Token: 34	2560	powershell.exe
Token: 35	2560	powershell.exe
Token: 36	2560	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeIncreaseQuotaPrivilege	3588	powershell.exe
Token: SeSecurityPrivilege	3588	powershell.exe
Token: SeTakeOwnershipPrivilege	3588	powershell.exe
Token: SeLoadDriverPrivilege	3588	powershell.exe
Token: SeSystemProfilePrivilege	3588	powershell.exe
Token: SeSystemtimePrivilege	3588	powershell.exe
Token: SeProfSingleProcessPrivilege	3588	powershell.exe
Token: SeIncBasePriorityPrivilege	3588	powershell.exe
Token: SeCreatePagefilePrivilege	3588	powershell.exe
Token: SeBackupPrivilege	3588	powershell.exe
Token: SeRestorePrivilege	3588	powershell.exe
Token: SeShutdownPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeSystemEnvironmentPrivilege	3588	powershell.exe
Token: SeRemoteShutdownPrivilege	3588	powershell.exe
Token: SeUndockPrivilege	3588	powershell.exe
Token: SeManageVolumePrivilege	3588	powershell.exe
Token: 33	3588	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5980 wrote to memory of 4272	5980	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 4272 wrote to memory of 1172	4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 1172 wrote to memory of 3704	1172	cmd.exe	92
PID 4272 wrote to memory of 3028	4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 3028 wrote to memory of 2560	3028	cmd.exe	96
PID 4272 wrote to memory of 872	4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 872 wrote to memory of 3588	872	cmd.exe	99
PID 4272 wrote to memory of 1180	4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 1180 wrote to memory of 3024	1180	cmd.exe	102
PID 4272 wrote to memory of 1740	4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 1740 wrote to memory of 5452	1740	cmd.exe	105
PID 4272 wrote to memory of 2960	4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 2960 wrote to memory of 556	2960	cmd.exe	108
PID 4272 wrote to memory of 3344	4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 3344 wrote to memory of 5716	3344	cmd.exe	111
PID 4272 wrote to memory of 3756	4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 3756 wrote to memory of 6136	3756	cmd.exe	114
PID 4272 wrote to memory of 2912	4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 2912 wrote to memory of 5668	2912	cmd.exe	117
PID 4272 wrote to memory of 2424	4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 2424 wrote to memory of 4720	2424	cmd.exe	120
PID 4272 wrote to memory of 3328	4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 3328 wrote to memory of 5744	3328	cmd.exe	123
PID 4272 wrote to memory of 1516	4272	2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	124
PID 1516 wrote to memory of 2456	1516	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Users\Admin\AppData\Local\Temp\2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-23_58809009fa78d2d9c757f730bfe843a6_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\bihutap'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\bihutap'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact