df8056bd298f4fd5bc18e419e525f4ee8bda52496b45806d6505ecc2c2ab7f99

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 16:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260724-tv2ptahe45
SHA256 df8056bd298f4fd5bc18e419e525f4ee8bda52496b45806d6505ecc2c2ab7f99
MD5 1a975ae02f8a20bd2e816a7df4564df3
SHA1 ee96c8f79eade46adb305d545e111d1eb46d603b
SHA512 fcf99a3c5cde4753cb880ffc6e09d3ce5b0f2129c9d757e37b6cf25bec79c4bd0ff3f0a3cfc1566b1ca3cbe0b8b8b2283f4996b8886dffa5ffd4751fc33c1e1c
SSDEEP 393216:MkY3jYtrGhsw5xhTNMmYyQ5ULCXMCHWUjXbcuI3/PGTAI:Mf3XfhJGiCXMb8XYH/O7
TLSH
T197E6331C16E551FEEEB3823DDAE11959E178B4634BB1C69F939893A12F073E0893C253
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5400	powershell.exe
3408	powershell.exe
772	powershell.exe
5876	powershell.exe
624	powershell.exe
3416	powershell.exe
1864	powershell.exe
1504	powershell.exe
5980	powershell.exe
5804	powershell.exe
3056	powershell.exe
5712	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4544	cmd.exe
5244	cmd.exe
2164	cmd.exe
4004	cmd.exe
2476	cmd.exe
5468	cmd.exe
628	cmd.exe
5932	cmd.exe
1936	cmd.exe
5532	cmd.exe
4328	cmd.exe
2396	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
624	powershell.exe
624	powershell.exe
3416	powershell.exe
3416	powershell.exe
3416	powershell.exe
5712	powershell.exe
5712	powershell.exe
5712	powershell.exe
1864	powershell.exe
1864	powershell.exe
1864	powershell.exe
5400	powershell.exe
5400	powershell.exe
5400	powershell.exe
1504	powershell.exe
1504	powershell.exe
1504	powershell.exe
3408	powershell.exe
3408	powershell.exe
3408	powershell.exe
5980	powershell.exe
5980	powershell.exe
5980	powershell.exe
5804	powershell.exe
5804	powershell.exe
5804	powershell.exe
3056	powershell.exe
3056	powershell.exe
3056	powershell.exe
772	powershell.exe
772	powershell.exe
772	powershell.exe
5876	powershell.exe
5876	powershell.exe
5876	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeIncreaseQuotaPrivilege	624	powershell.exe
Token: SeSecurityPrivilege	624	powershell.exe
Token: SeTakeOwnershipPrivilege	624	powershell.exe
Token: SeLoadDriverPrivilege	624	powershell.exe
Token: SeSystemProfilePrivilege	624	powershell.exe
Token: SeSystemtimePrivilege	624	powershell.exe
Token: SeProfSingleProcessPrivilege	624	powershell.exe
Token: SeIncBasePriorityPrivilege	624	powershell.exe
Token: SeCreatePagefilePrivilege	624	powershell.exe
Token: SeBackupPrivilege	624	powershell.exe
Token: SeRestorePrivilege	624	powershell.exe
Token: SeShutdownPrivilege	624	powershell.exe
Token: SeDebugPrivilege	624	powershell.exe
Token: SeSystemEnvironmentPrivilege	624	powershell.exe
Token: SeRemoteShutdownPrivilege	624	powershell.exe
Token: SeUndockPrivilege	624	powershell.exe
Token: SeManageVolumePrivilege	624	powershell.exe
Token: 33	624	powershell.exe
Token: 34	624	powershell.exe
Token: 35	624	powershell.exe
Token: 36	624	powershell.exe
Token: SeDebugPrivilege	3416	powershell.exe
Token: SeIncreaseQuotaPrivilege	3416	powershell.exe
Token: SeSecurityPrivilege	3416	powershell.exe
Token: SeTakeOwnershipPrivilege	3416	powershell.exe
Token: SeLoadDriverPrivilege	3416	powershell.exe
Token: SeSystemProfilePrivilege	3416	powershell.exe
Token: SeSystemtimePrivilege	3416	powershell.exe
Token: SeProfSingleProcessPrivilege	3416	powershell.exe
Token: SeIncBasePriorityPrivilege	3416	powershell.exe
Token: SeCreatePagefilePrivilege	3416	powershell.exe
Token: SeBackupPrivilege	3416	powershell.exe
Token: SeRestorePrivilege	3416	powershell.exe
Token: SeShutdownPrivilege	3416	powershell.exe
Token: SeDebugPrivilege	3416	powershell.exe
Token: SeSystemEnvironmentPrivilege	3416	powershell.exe
Token: SeRemoteShutdownPrivilege	3416	powershell.exe
Token: SeUndockPrivilege	3416	powershell.exe
Token: SeManageVolumePrivilege	3416	powershell.exe
Token: 33	3416	powershell.exe
Token: 34	3416	powershell.exe
Token: 35	3416	powershell.exe
Token: 36	3416	powershell.exe
Token: SeDebugPrivilege	5712	powershell.exe
Token: SeIncreaseQuotaPrivilege	5712	powershell.exe
Token: SeSecurityPrivilege	5712	powershell.exe
Token: SeTakeOwnershipPrivilege	5712	powershell.exe
Token: SeLoadDriverPrivilege	5712	powershell.exe
Token: SeSystemProfilePrivilege	5712	powershell.exe
Token: SeSystemtimePrivilege	5712	powershell.exe
Token: SeProfSingleProcessPrivilege	5712	powershell.exe
Token: SeIncBasePriorityPrivilege	5712	powershell.exe
Token: SeCreatePagefilePrivilege	5712	powershell.exe
Token: SeBackupPrivilege	5712	powershell.exe
Token: SeRestorePrivilege	5712	powershell.exe
Token: SeShutdownPrivilege	5712	powershell.exe
Token: SeDebugPrivilege	5712	powershell.exe
Token: SeSystemEnvironmentPrivilege	5712	powershell.exe
Token: SeRemoteShutdownPrivilege	5712	powershell.exe
Token: SeUndockPrivilege	5712	powershell.exe
Token: SeManageVolumePrivilege	5712	powershell.exe
Token: 33	5712	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 5232	4156	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 5232 wrote to memory of 4544	5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4544 wrote to memory of 624	4544	cmd.exe	92
PID 5232 wrote to memory of 1936	5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 1936 wrote to memory of 3416	1936	cmd.exe	96
PID 5232 wrote to memory of 5532	5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 5532 wrote to memory of 5712	5532	cmd.exe	99
PID 5232 wrote to memory of 5244	5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 5244 wrote to memory of 1864	5244	cmd.exe	102
PID 5232 wrote to memory of 2164	5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 2164 wrote to memory of 5400	2164	cmd.exe	105
PID 5232 wrote to memory of 4328	5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 4328 wrote to memory of 1504	4328	cmd.exe	108
PID 5232 wrote to memory of 4004	5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 4004 wrote to memory of 3408	4004	cmd.exe	111
PID 5232 wrote to memory of 2476	5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 2476 wrote to memory of 5980	2476	cmd.exe	114
PID 5232 wrote to memory of 5468	5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 5468 wrote to memory of 5804	5468	cmd.exe	117
PID 5232 wrote to memory of 2396	5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 2396 wrote to memory of 3056	2396	cmd.exe	120
PID 5232 wrote to memory of 628	5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	122
PID 628 wrote to memory of 772	628	cmd.exe	124
PID 5232 wrote to memory of 5932	5232	2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	125
PID 5932 wrote to memory of 5876	5932	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Users\Admin\AppData\Local\Temp\2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-24_1a975ae02f8a20bd2e816a7df4564df3_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cuveged'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cuveged'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact