f4c32b3f9a949e5a17ff0b8ad130ba5ca15e5d9a037c7a97dcc68a6b4c3212f7

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.7MB
Sample260729-b3f4zaem2w
SHA256 f4c32b3f9a949e5a17ff0b8ad130ba5ca15e5d9a037c7a97dcc68a6b4c3212f7
MD5 219b5d691744d7a98c8b4df067b0b136
SHA1 8587723e626cb2b73b27e79c8828abe8d5bc1996
SHA512 ea8320c16e1f968320e8905910ebfb1d49ca03d742b3a3b761b5c53639f61f2d33b6aca12183fff2025a46a9938615d9d249ba3dc5b9b8badd2ca1c09c760eea
SSDEEP 393216:ELZKsRWVOpGJEst1yGXMCHWUjX6cuI3/PGTAI:ErWVOpGuI1TXMb8X3H/O7
TLSH
T140E63348B7E492EEF5B3843CBCA160A5D5A4F8734732C5DB4B6883B2AD172E04939753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2060	powershell.exe
1544	powershell.exe
3636	powershell.exe
2356	powershell.exe
3440	powershell.exe
4760	powershell.exe
1696	powershell.exe
4260	powershell.exe
4428	powershell.exe
3760	powershell.exe
2528	powershell.exe
1724	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5100	cmd.exe
2840	cmd.exe
432	cmd.exe
2828	cmd.exe
5564	cmd.exe
1720	cmd.exe
6136	cmd.exe
5836	cmd.exe
2796	cmd.exe
2164	cmd.exe
2896	cmd.exe
3484	cmd.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
1724	powershell.exe
1724	powershell.exe
2060	powershell.exe
2060	powershell.exe
2060	powershell.exe
3440	powershell.exe
3440	powershell.exe
3440	powershell.exe
4760	powershell.exe
4760	powershell.exe
4760	powershell.exe
1696	powershell.exe
1696	powershell.exe
4260	powershell.exe
4260	powershell.exe
4428	powershell.exe
4428	powershell.exe
3760	powershell.exe
3760	powershell.exe
2528	powershell.exe
2528	powershell.exe
1544	powershell.exe
1544	powershell.exe
3636	powershell.exe
3636	powershell.exe
3636	powershell.exe
2356	powershell.exe
2356	powershell.exe
2356	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeIncreaseQuotaPrivilege	1724	powershell.exe
Token: SeSecurityPrivilege	1724	powershell.exe
Token: SeTakeOwnershipPrivilege	1724	powershell.exe
Token: SeLoadDriverPrivilege	1724	powershell.exe
Token: SeSystemProfilePrivilege	1724	powershell.exe
Token: SeSystemtimePrivilege	1724	powershell.exe
Token: SeProfSingleProcessPrivilege	1724	powershell.exe
Token: SeIncBasePriorityPrivilege	1724	powershell.exe
Token: SeCreatePagefilePrivilege	1724	powershell.exe
Token: SeBackupPrivilege	1724	powershell.exe
Token: SeRestorePrivilege	1724	powershell.exe
Token: SeShutdownPrivilege	1724	powershell.exe
Token: SeDebugPrivilege	1724	powershell.exe
Token: SeSystemEnvironmentPrivilege	1724	powershell.exe
Token: SeRemoteShutdownPrivilege	1724	powershell.exe
Token: SeUndockPrivilege	1724	powershell.exe
Token: SeManageVolumePrivilege	1724	powershell.exe
Token: 33	1724	powershell.exe
Token: 34	1724	powershell.exe
Token: 35	1724	powershell.exe
Token: 36	1724	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeIncreaseQuotaPrivilege	2060	powershell.exe
Token: SeSecurityPrivilege	2060	powershell.exe
Token: SeTakeOwnershipPrivilege	2060	powershell.exe
Token: SeLoadDriverPrivilege	2060	powershell.exe
Token: SeSystemProfilePrivilege	2060	powershell.exe
Token: SeSystemtimePrivilege	2060	powershell.exe
Token: SeProfSingleProcessPrivilege	2060	powershell.exe
Token: SeIncBasePriorityPrivilege	2060	powershell.exe
Token: SeCreatePagefilePrivilege	2060	powershell.exe
Token: SeBackupPrivilege	2060	powershell.exe
Token: SeRestorePrivilege	2060	powershell.exe
Token: SeShutdownPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeSystemEnvironmentPrivilege	2060	powershell.exe
Token: SeRemoteShutdownPrivilege	2060	powershell.exe
Token: SeUndockPrivilege	2060	powershell.exe
Token: SeManageVolumePrivilege	2060	powershell.exe
Token: 33	2060	powershell.exe
Token: 34	2060	powershell.exe
Token: 35	2060	powershell.exe
Token: 36	2060	powershell.exe
Token: SeDebugPrivilege	3440	powershell.exe
Token: SeIncreaseQuotaPrivilege	3440	powershell.exe
Token: SeSecurityPrivilege	3440	powershell.exe
Token: SeTakeOwnershipPrivilege	3440	powershell.exe
Token: SeLoadDriverPrivilege	3440	powershell.exe
Token: SeSystemProfilePrivilege	3440	powershell.exe
Token: SeSystemtimePrivilege	3440	powershell.exe
Token: SeProfSingleProcessPrivilege	3440	powershell.exe
Token: SeIncBasePriorityPrivilege	3440	powershell.exe
Token: SeCreatePagefilePrivilege	3440	powershell.exe
Token: SeBackupPrivilege	3440	powershell.exe
Token: SeRestorePrivilege	3440	powershell.exe
Token: SeShutdownPrivilege	3440	powershell.exe
Token: SeDebugPrivilege	3440	powershell.exe
Token: SeSystemEnvironmentPrivilege	3440	powershell.exe
Token: SeRemoteShutdownPrivilege	3440	powershell.exe
Token: SeUndockPrivilege	3440	powershell.exe
Token: SeManageVolumePrivilege	3440	powershell.exe
Token: 33	3440	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 3220	5016	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 3220 wrote to memory of 2840	3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 2840 wrote to memory of 1724	2840	cmd.exe	92
PID 3220 wrote to memory of 2796	3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 2796 wrote to memory of 2060	2796	cmd.exe	96
PID 3220 wrote to memory of 432	3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 432 wrote to memory of 3440	432	cmd.exe	99
PID 3220 wrote to memory of 2828	3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 2828 wrote to memory of 4760	2828	cmd.exe	102
PID 3220 wrote to memory of 2164	3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 2164 wrote to memory of 1696	2164	cmd.exe	105
PID 3220 wrote to memory of 5564	3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 5564 wrote to memory of 4260	5564	cmd.exe	108
PID 3220 wrote to memory of 1720	3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 1720 wrote to memory of 4428	1720	cmd.exe	111
PID 3220 wrote to memory of 6136	3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 6136 wrote to memory of 3760	6136	cmd.exe	114
PID 3220 wrote to memory of 2896	3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 2896 wrote to memory of 2528	2896	cmd.exe	117
PID 3220 wrote to memory of 5836	3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 5836 wrote to memory of 1544	5836	cmd.exe	120
PID 3220 wrote to memory of 3484	3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 3484 wrote to memory of 3636	3484	cmd.exe	123
PID 3220 wrote to memory of 5100	3220	2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	124
PID 5100 wrote to memory of 2356	5100	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Users\Admin\AppData\Local\Temp\2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-28_219b5d691744d7a98c8b4df067b0b136_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dufefos'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\dufefos'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact