76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.7MB
Sample260731-29a5easglc
SHA256 76b2713b63e443c83a23794087f2cad4b7588e78b0afa9a0fc276dd5de65a226
MD5 c3752c08eb40761569cc7c4a90485320
SHA1 dae4a62d13b6f7f6d91151e5d6ec2a3803dcad42
SHA512 cceabebc1077dfda15bd450b4aa80e7ec2552967e86cb187ff3d09bd74e56e669d7ff32b4963564250ffe19288ced2bc11f6028628263340570bf7326f4a74b1
SSDEEP 393216:s97ZSvWf/1DA1Obgb+2rtmXMCHWUjXGcuI3/PGTAI:sLSvWf/aJrtmXMb8X7H/O7
TLSH
T16EE6331476E052FEDA73413DE9F1A2A6D06174720B72CBCF478887A1BEA72D0893D647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5204	powershell.exe
4972	powershell.exe
4120	powershell.exe
5044	powershell.exe
5220	powershell.exe
1480	powershell.exe
2816	powershell.exe
5108	powershell.exe
2204	powershell.exe
436	powershell.exe
6072	powershell.exe
5276	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4944	cmd.exe
5616	cmd.exe
3944	cmd.exe
3196	cmd.exe
4984	cmd.exe
1852	cmd.exe
4168	cmd.exe
1488	cmd.exe
4704	cmd.exe
5260	cmd.exe
5568	cmd.exe
1660	cmd.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5204	powershell.exe
5204	powershell.exe
4972	powershell.exe
4972	powershell.exe
2204	powershell.exe
2204	powershell.exe
4120	powershell.exe
4120	powershell.exe
436	powershell.exe
436	powershell.exe
5044	powershell.exe
5044	powershell.exe
5220	powershell.exe
5220	powershell.exe
6072	powershell.exe
6072	powershell.exe
6072	powershell.exe
1480	powershell.exe
1480	powershell.exe
1480	powershell.exe
5276	powershell.exe
5276	powershell.exe
5276	powershell.exe
2816	powershell.exe
2816	powershell.exe
2816	powershell.exe
5108	powershell.exe
5108	powershell.exe
5108	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	5204	powershell.exe
Token: SeIncreaseQuotaPrivilege	5204	powershell.exe
Token: SeSecurityPrivilege	5204	powershell.exe
Token: SeTakeOwnershipPrivilege	5204	powershell.exe
Token: SeLoadDriverPrivilege	5204	powershell.exe
Token: SeSystemProfilePrivilege	5204	powershell.exe
Token: SeSystemtimePrivilege	5204	powershell.exe
Token: SeProfSingleProcessPrivilege	5204	powershell.exe
Token: SeIncBasePriorityPrivilege	5204	powershell.exe
Token: SeCreatePagefilePrivilege	5204	powershell.exe
Token: SeBackupPrivilege	5204	powershell.exe
Token: SeRestorePrivilege	5204	powershell.exe
Token: SeShutdownPrivilege	5204	powershell.exe
Token: SeDebugPrivilege	5204	powershell.exe
Token: SeSystemEnvironmentPrivilege	5204	powershell.exe
Token: SeRemoteShutdownPrivilege	5204	powershell.exe
Token: SeUndockPrivilege	5204	powershell.exe
Token: SeManageVolumePrivilege	5204	powershell.exe
Token: 33	5204	powershell.exe
Token: 34	5204	powershell.exe
Token: 35	5204	powershell.exe
Token: 36	5204	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeIncreaseQuotaPrivilege	4972	powershell.exe
Token: SeSecurityPrivilege	4972	powershell.exe
Token: SeTakeOwnershipPrivilege	4972	powershell.exe
Token: SeLoadDriverPrivilege	4972	powershell.exe
Token: SeSystemProfilePrivilege	4972	powershell.exe
Token: SeSystemtimePrivilege	4972	powershell.exe
Token: SeProfSingleProcessPrivilege	4972	powershell.exe
Token: SeIncBasePriorityPrivilege	4972	powershell.exe
Token: SeCreatePagefilePrivilege	4972	powershell.exe
Token: SeBackupPrivilege	4972	powershell.exe
Token: SeRestorePrivilege	4972	powershell.exe
Token: SeShutdownPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeSystemEnvironmentPrivilege	4972	powershell.exe
Token: SeRemoteShutdownPrivilege	4972	powershell.exe
Token: SeUndockPrivilege	4972	powershell.exe
Token: SeManageVolumePrivilege	4972	powershell.exe
Token: 33	4972	powershell.exe
Token: 34	4972	powershell.exe
Token: 35	4972	powershell.exe
Token: 36	4972	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeIncreaseQuotaPrivilege	2204	powershell.exe
Token: SeSecurityPrivilege	2204	powershell.exe
Token: SeTakeOwnershipPrivilege	2204	powershell.exe
Token: SeLoadDriverPrivilege	2204	powershell.exe
Token: SeSystemProfilePrivilege	2204	powershell.exe
Token: SeSystemtimePrivilege	2204	powershell.exe
Token: SeProfSingleProcessPrivilege	2204	powershell.exe
Token: SeIncBasePriorityPrivilege	2204	powershell.exe
Token: SeCreatePagefilePrivilege	2204	powershell.exe
Token: SeBackupPrivilege	2204	powershell.exe
Token: SeRestorePrivilege	2204	powershell.exe
Token: SeShutdownPrivilege	2204	powershell.exe
Token: SeDebugPrivilege	2204	powershell.exe
Token: SeSystemEnvironmentPrivilege	2204	powershell.exe
Token: SeRemoteShutdownPrivilege	2204	powershell.exe
Token: SeUndockPrivilege	2204	powershell.exe
Token: SeManageVolumePrivilege	2204	powershell.exe
Token: 33	2204	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 2320	4228	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 2320 wrote to memory of 4168	2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4168 wrote to memory of 5204	4168	cmd.exe	92
PID 2320 wrote to memory of 1488	2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 1488 wrote to memory of 4972	1488	cmd.exe	96
PID 2320 wrote to memory of 4944	2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 4944 wrote to memory of 2204	4944	cmd.exe	99
PID 2320 wrote to memory of 5616	2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 5616 wrote to memory of 4120	5616	cmd.exe	102
PID 2320 wrote to memory of 3944	2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 3944 wrote to memory of 436	3944	cmd.exe	105
PID 2320 wrote to memory of 4704	2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 4704 wrote to memory of 5044	4704	cmd.exe	108
PID 2320 wrote to memory of 5260	2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 5260 wrote to memory of 5220	5260	cmd.exe	111
PID 2320 wrote to memory of 5568	2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 5568 wrote to memory of 6072	5568	cmd.exe	114
PID 2320 wrote to memory of 3196	2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 3196 wrote to memory of 1480	3196	cmd.exe	117
PID 2320 wrote to memory of 4984	2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 4984 wrote to memory of 5276	4984	cmd.exe	120
PID 2320 wrote to memory of 1660	2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 1660 wrote to memory of 2816	1660	cmd.exe	123
PID 2320 wrote to memory of 1852	2320	2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	124
PID 1852 wrote to memory of 5108	1852	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-31_c3752c08eb40761569cc7c4a90485320_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\ceteqow'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\ceteqow'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5616
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact