a0e092065fee647bd449bc16bc2026d2cd42633929fb77cef69132822e595b70

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260730-b3922sbj9w
SHA256 a0e092065fee647bd449bc16bc2026d2cd42633929fb77cef69132822e595b70
MD5 e9593859bbc2752c4d19de03e0606f4e
SHA1 3e05330ac44a5b2f5e43bca4bb04cb976fc12e8c
SHA512 bd346d25b18655470b8a0354022b5942dee9d13239600817b8a6b97e6ccd642565ea95350eedfdf7d0691c613ede3a0449d29c8958ea73473da79f4ffdf51656
SSDEEP 393216:+k+0cXbKnR/AlN7HWKXMCHWUjXscuI3/PGTAI:+R0VnEXMb8X5H/O7
TLSH
T118E633ACA5E215EEFA37803CE9E05A66E17CB4670776C5CF579883816D272E0193D323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
568	powershell.exe
5204	powershell.exe
2908	powershell.exe
1280	powershell.exe
1488	powershell.exe
3200	powershell.exe
5024	powershell.exe
5404	powershell.exe
4608	powershell.exe
4380	powershell.exe
4584	powershell.exe
4696	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5752	cmd.exe
1196	cmd.exe
3064	cmd.exe
1824	cmd.exe
1720	cmd.exe
4880	cmd.exe
976	cmd.exe
5984	cmd.exe
1508	cmd.exe
4772	cmd.exe
2600	cmd.exe
2252	cmd.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4608	powershell.exe
4608	powershell.exe
4380	powershell.exe
4380	powershell.exe
1488	powershell.exe
1488	powershell.exe
4584	powershell.exe
4584	powershell.exe
4696	powershell.exe
4696	powershell.exe
4696	powershell.exe
568	powershell.exe
568	powershell.exe
568	powershell.exe
3200	powershell.exe
3200	powershell.exe
3200	powershell.exe
5024	powershell.exe
5024	powershell.exe
5024	powershell.exe
5204	powershell.exe
5204	powershell.exe
5204	powershell.exe
5404	powershell.exe
5404	powershell.exe
5404	powershell.exe
2908	powershell.exe
2908	powershell.exe
2908	powershell.exe
1280	powershell.exe
1280	powershell.exe
1280	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	4608	powershell.exe
Token: SeIncreaseQuotaPrivilege	4608	powershell.exe
Token: SeSecurityPrivilege	4608	powershell.exe
Token: SeTakeOwnershipPrivilege	4608	powershell.exe
Token: SeLoadDriverPrivilege	4608	powershell.exe
Token: SeSystemProfilePrivilege	4608	powershell.exe
Token: SeSystemtimePrivilege	4608	powershell.exe
Token: SeProfSingleProcessPrivilege	4608	powershell.exe
Token: SeIncBasePriorityPrivilege	4608	powershell.exe
Token: SeCreatePagefilePrivilege	4608	powershell.exe
Token: SeBackupPrivilege	4608	powershell.exe
Token: SeRestorePrivilege	4608	powershell.exe
Token: SeShutdownPrivilege	4608	powershell.exe
Token: SeDebugPrivilege	4608	powershell.exe
Token: SeSystemEnvironmentPrivilege	4608	powershell.exe
Token: SeRemoteShutdownPrivilege	4608	powershell.exe
Token: SeUndockPrivilege	4608	powershell.exe
Token: SeManageVolumePrivilege	4608	powershell.exe
Token: 33	4608	powershell.exe
Token: 34	4608	powershell.exe
Token: 35	4608	powershell.exe
Token: 36	4608	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeIncreaseQuotaPrivilege	4380	powershell.exe
Token: SeSecurityPrivilege	4380	powershell.exe
Token: SeTakeOwnershipPrivilege	4380	powershell.exe
Token: SeLoadDriverPrivilege	4380	powershell.exe
Token: SeSystemProfilePrivilege	4380	powershell.exe
Token: SeSystemtimePrivilege	4380	powershell.exe
Token: SeProfSingleProcessPrivilege	4380	powershell.exe
Token: SeIncBasePriorityPrivilege	4380	powershell.exe
Token: SeCreatePagefilePrivilege	4380	powershell.exe
Token: SeBackupPrivilege	4380	powershell.exe
Token: SeRestorePrivilege	4380	powershell.exe
Token: SeShutdownPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeSystemEnvironmentPrivilege	4380	powershell.exe
Token: SeRemoteShutdownPrivilege	4380	powershell.exe
Token: SeUndockPrivilege	4380	powershell.exe
Token: SeManageVolumePrivilege	4380	powershell.exe
Token: 33	4380	powershell.exe
Token: 34	4380	powershell.exe
Token: 35	4380	powershell.exe
Token: 36	4380	powershell.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeIncreaseQuotaPrivilege	1488	powershell.exe
Token: SeSecurityPrivilege	1488	powershell.exe
Token: SeTakeOwnershipPrivilege	1488	powershell.exe
Token: SeLoadDriverPrivilege	1488	powershell.exe
Token: SeSystemProfilePrivilege	1488	powershell.exe
Token: SeSystemtimePrivilege	1488	powershell.exe
Token: SeProfSingleProcessPrivilege	1488	powershell.exe
Token: SeIncBasePriorityPrivilege	1488	powershell.exe
Token: SeCreatePagefilePrivilege	1488	powershell.exe
Token: SeBackupPrivilege	1488	powershell.exe
Token: SeRestorePrivilege	1488	powershell.exe
Token: SeShutdownPrivilege	1488	powershell.exe
Token: SeDebugPrivilege	1488	powershell.exe
Token: SeSystemEnvironmentPrivilege	1488	powershell.exe
Token: SeRemoteShutdownPrivilege	1488	powershell.exe
Token: SeUndockPrivilege	1488	powershell.exe
Token: SeManageVolumePrivilege	1488	powershell.exe
Token: 33	1488	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 4132	3256	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 4132 wrote to memory of 5984	4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 5984 wrote to memory of 4608	5984	cmd.exe	92
PID 4132 wrote to memory of 1508	4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 1508 wrote to memory of 4380	1508	cmd.exe	96
PID 4132 wrote to memory of 4772	4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 4772 wrote to memory of 1488	4772	cmd.exe	99
PID 4132 wrote to memory of 2600	4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 2600 wrote to memory of 4584	2600	cmd.exe	102
PID 4132 wrote to memory of 1196	4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 1196 wrote to memory of 4696	1196	cmd.exe	105
PID 4132 wrote to memory of 3064	4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 3064 wrote to memory of 568	3064	cmd.exe	108
PID 4132 wrote to memory of 1824	4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 1824 wrote to memory of 3200	1824	cmd.exe	111
PID 4132 wrote to memory of 1720	4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 1720 wrote to memory of 5024	1720	cmd.exe	114
PID 4132 wrote to memory of 2252	4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 2252 wrote to memory of 5204	2252	cmd.exe	117
PID 4132 wrote to memory of 4880	4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 4880 wrote to memory of 5404	4880	cmd.exe	120
PID 4132 wrote to memory of 5752	4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 5752 wrote to memory of 2908	5752	cmd.exe	123
PID 4132 wrote to memory of 976	4132	2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	125
PID 976 wrote to memory of 1280	976	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Users\Admin\AppData\Local\Temp\2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-29_e9593859bbc2752c4d19de03e0606f4e_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2600
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact