054fe387cda25efcaf47ef4e5fc18fbfdc6c52f35715d2adbb22700eb96736be

Analysis

max time kernel
149s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 05:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.7MB
Sample260730-gbsxcace32
SHA256 054fe387cda25efcaf47ef4e5fc18fbfdc6c52f35715d2adbb22700eb96736be
MD5 5785ea78b4e7e0528c2c0c3291732d51
SHA1 438b9abe8850803897999c0ff6a7be7d0b06b135
SHA512 0f48952ec35b28024c8b42a014b84c78789a8979cb8e63c341021ab1e406b56ad3579f1b78f799802d0178d0d37de614c2e4cf279e2e82e65d33f75b6962b642
SSDEEP 393216:YogWk9afkYro02nk+DJmNkGjiZyXMCHWUjXDcuI3/PGTAI:Y7WiafkEynANeyXMb8XgH/O7
TLSH
T19FE63304A5E415FFCAF3A13889D106A1E8B87C620F71C5EB575883B2DE773904CB9A5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5132	powershell.exe
5872	powershell.exe
720	powershell.exe
3280	powershell.exe
5264	powershell.exe
4836	powershell.exe
6024	powershell.exe
3948	powershell.exe
4244	powershell.exe
4236	powershell.exe
4412	powershell.exe
4980	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2752	cmd.exe
4160	cmd.exe
1920	cmd.exe
5504	cmd.exe
4872	cmd.exe
5864	cmd.exe
2680	cmd.exe
5924	cmd.exe
4532	cmd.exe
2388	cmd.exe
4524	cmd.exe
1304	cmd.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4412	powershell.exe
4412	powershell.exe
6024	powershell.exe
6024	powershell.exe
3948	powershell.exe
3948	powershell.exe
4980	powershell.exe
4980	powershell.exe
5132	powershell.exe
5132	powershell.exe
5132	powershell.exe
5872	powershell.exe
5872	powershell.exe
5872	powershell.exe
720	powershell.exe
720	powershell.exe
720	powershell.exe
3280	powershell.exe
3280	powershell.exe
3280	powershell.exe
4244	powershell.exe
4244	powershell.exe
4244	powershell.exe
5264	powershell.exe
5264	powershell.exe
5264	powershell.exe
4236	powershell.exe
4236	powershell.exe
4236	powershell.exe
4836	powershell.exe
4836	powershell.exe
4836	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeIncreaseQuotaPrivilege	4412	powershell.exe
Token: SeSecurityPrivilege	4412	powershell.exe
Token: SeTakeOwnershipPrivilege	4412	powershell.exe
Token: SeLoadDriverPrivilege	4412	powershell.exe
Token: SeSystemProfilePrivilege	4412	powershell.exe
Token: SeSystemtimePrivilege	4412	powershell.exe
Token: SeProfSingleProcessPrivilege	4412	powershell.exe
Token: SeIncBasePriorityPrivilege	4412	powershell.exe
Token: SeCreatePagefilePrivilege	4412	powershell.exe
Token: SeBackupPrivilege	4412	powershell.exe
Token: SeRestorePrivilege	4412	powershell.exe
Token: SeShutdownPrivilege	4412	powershell.exe
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeSystemEnvironmentPrivilege	4412	powershell.exe
Token: SeRemoteShutdownPrivilege	4412	powershell.exe
Token: SeUndockPrivilege	4412	powershell.exe
Token: SeManageVolumePrivilege	4412	powershell.exe
Token: 33	4412	powershell.exe
Token: 34	4412	powershell.exe
Token: 35	4412	powershell.exe
Token: 36	4412	powershell.exe
Token: SeDebugPrivilege	6024	powershell.exe
Token: SeIncreaseQuotaPrivilege	6024	powershell.exe
Token: SeSecurityPrivilege	6024	powershell.exe
Token: SeTakeOwnershipPrivilege	6024	powershell.exe
Token: SeLoadDriverPrivilege	6024	powershell.exe
Token: SeSystemProfilePrivilege	6024	powershell.exe
Token: SeSystemtimePrivilege	6024	powershell.exe
Token: SeProfSingleProcessPrivilege	6024	powershell.exe
Token: SeIncBasePriorityPrivilege	6024	powershell.exe
Token: SeCreatePagefilePrivilege	6024	powershell.exe
Token: SeBackupPrivilege	6024	powershell.exe
Token: SeRestorePrivilege	6024	powershell.exe
Token: SeShutdownPrivilege	6024	powershell.exe
Token: SeDebugPrivilege	6024	powershell.exe
Token: SeSystemEnvironmentPrivilege	6024	powershell.exe
Token: SeRemoteShutdownPrivilege	6024	powershell.exe
Token: SeUndockPrivilege	6024	powershell.exe
Token: SeManageVolumePrivilege	6024	powershell.exe
Token: 33	6024	powershell.exe
Token: 34	6024	powershell.exe
Token: 35	6024	powershell.exe
Token: 36	6024	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeIncreaseQuotaPrivilege	3948	powershell.exe
Token: SeSecurityPrivilege	3948	powershell.exe
Token: SeTakeOwnershipPrivilege	3948	powershell.exe
Token: SeLoadDriverPrivilege	3948	powershell.exe
Token: SeSystemProfilePrivilege	3948	powershell.exe
Token: SeSystemtimePrivilege	3948	powershell.exe
Token: SeProfSingleProcessPrivilege	3948	powershell.exe
Token: SeIncBasePriorityPrivilege	3948	powershell.exe
Token: SeCreatePagefilePrivilege	3948	powershell.exe
Token: SeBackupPrivilege	3948	powershell.exe
Token: SeRestorePrivilege	3948	powershell.exe
Token: SeShutdownPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeSystemEnvironmentPrivilege	3948	powershell.exe
Token: SeRemoteShutdownPrivilege	3948	powershell.exe
Token: SeUndockPrivilege	3948	powershell.exe
Token: SeManageVolumePrivilege	3948	powershell.exe
Token: 33	3948	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 2812	3348	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 2812 wrote to memory of 5504	2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 5504 wrote to memory of 4412	5504	cmd.exe	92
PID 2812 wrote to memory of 4524	2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 4524 wrote to memory of 6024	4524	cmd.exe	96
PID 2812 wrote to memory of 1304	2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 1304 wrote to memory of 3948	1304	cmd.exe	99
PID 2812 wrote to memory of 4872	2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 4872 wrote to memory of 4980	4872	cmd.exe	102
PID 2812 wrote to memory of 5864	2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 5864 wrote to memory of 5132	5864	cmd.exe	105
PID 2812 wrote to memory of 2752	2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 2752 wrote to memory of 5872	2752	cmd.exe	108
PID 2812 wrote to memory of 2680	2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 2680 wrote to memory of 720	2680	cmd.exe	111
PID 2812 wrote to memory of 4160	2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 4160 wrote to memory of 3280	4160	cmd.exe	114
PID 2812 wrote to memory of 5924	2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 5924 wrote to memory of 4244	5924	cmd.exe	117
PID 2812 wrote to memory of 1920	2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 1920 wrote to memory of 5264	1920	cmd.exe	120
PID 2812 wrote to memory of 4532	2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 4532 wrote to memory of 4236	4532	cmd.exe	123
PID 2812 wrote to memory of 2388	2812	2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	125
PID 2388 wrote to memory of 4836	2388	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-30_5785ea78b4e7e0528c2c0c3291732d51_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\mimiles'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact