f7a5a8053c29252ae6d1e898a93b4f73363768a23a5b779952fc71a1ca3f2e44

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.7MB
Sample260801-rawxqabe79
SHA256 f7a5a8053c29252ae6d1e898a93b4f73363768a23a5b779952fc71a1ca3f2e44
MD5 412bf948c841cf5a9bfc8380afa91cd5
SHA1 f792f223f9b0e7e37c010ae4ab823a94dfb99a3f
SHA512 47cf2fd2c0f5aa13e2be34ccec0ea27b3efcc45dd8a0bc14584ed970df740d8afbb495797727934f974624ed9f0ead1793be238d36dea9900d28145bebb7ea1f
SSDEEP 393216:iRChsFD5je9yfX97ZfxCmvoRzDXMCHWUjXVcuI3/PGTAI:iBje9y17jBoVDXMb8XiH/O7
TLSH
T1D3E6330CA6D541DFEA634138DEE39AD5E658F431A3F0C8CF8798C3A56F531E0897A612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1876	powershell.exe
3280	powershell.exe
4956	powershell.exe
4348	powershell.exe
4440	powershell.exe
3056	powershell.exe
1048	powershell.exe
4164	powershell.exe
4260	powershell.exe
256	powershell.exe
5876	powershell.exe
4792	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
352	cmd.exe
3524	cmd.exe
3068	cmd.exe
1872	cmd.exe
5848	cmd.exe
1464	cmd.exe
3896	cmd.exe
5884	cmd.exe
6028	cmd.exe
3272	cmd.exe
2040	cmd.exe
480	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5876	powershell.exe
5876	powershell.exe
4792	powershell.exe
4792	powershell.exe
4792	powershell.exe
4440	powershell.exe
4440	powershell.exe
4440	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
3056	powershell.exe
3056	powershell.exe
3056	powershell.exe
3280	powershell.exe
3280	powershell.exe
3280	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
4164	powershell.exe
4164	powershell.exe
4164	powershell.exe
4956	powershell.exe
4956	powershell.exe
4956	powershell.exe
4348	powershell.exe
4348	powershell.exe
4348	powershell.exe
4260	powershell.exe
4260	powershell.exe
4260	powershell.exe
256	powershell.exe
256	powershell.exe
256	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	5876	powershell.exe
Token: SeIncreaseQuotaPrivilege	5876	powershell.exe
Token: SeSecurityPrivilege	5876	powershell.exe
Token: SeTakeOwnershipPrivilege	5876	powershell.exe
Token: SeLoadDriverPrivilege	5876	powershell.exe
Token: SeSystemProfilePrivilege	5876	powershell.exe
Token: SeSystemtimePrivilege	5876	powershell.exe
Token: SeProfSingleProcessPrivilege	5876	powershell.exe
Token: SeIncBasePriorityPrivilege	5876	powershell.exe
Token: SeCreatePagefilePrivilege	5876	powershell.exe
Token: SeBackupPrivilege	5876	powershell.exe
Token: SeRestorePrivilege	5876	powershell.exe
Token: SeShutdownPrivilege	5876	powershell.exe
Token: SeDebugPrivilege	5876	powershell.exe
Token: SeSystemEnvironmentPrivilege	5876	powershell.exe
Token: SeRemoteShutdownPrivilege	5876	powershell.exe
Token: SeUndockPrivilege	5876	powershell.exe
Token: SeManageVolumePrivilege	5876	powershell.exe
Token: 33	5876	powershell.exe
Token: 34	5876	powershell.exe
Token: 35	5876	powershell.exe
Token: 36	5876	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeIncreaseQuotaPrivilege	4792	powershell.exe
Token: SeSecurityPrivilege	4792	powershell.exe
Token: SeTakeOwnershipPrivilege	4792	powershell.exe
Token: SeLoadDriverPrivilege	4792	powershell.exe
Token: SeSystemProfilePrivilege	4792	powershell.exe
Token: SeSystemtimePrivilege	4792	powershell.exe
Token: SeProfSingleProcessPrivilege	4792	powershell.exe
Token: SeIncBasePriorityPrivilege	4792	powershell.exe
Token: SeCreatePagefilePrivilege	4792	powershell.exe
Token: SeBackupPrivilege	4792	powershell.exe
Token: SeRestorePrivilege	4792	powershell.exe
Token: SeShutdownPrivilege	4792	powershell.exe
Token: SeDebugPrivilege	4792	powershell.exe
Token: SeSystemEnvironmentPrivilege	4792	powershell.exe
Token: SeRemoteShutdownPrivilege	4792	powershell.exe
Token: SeUndockPrivilege	4792	powershell.exe
Token: SeManageVolumePrivilege	4792	powershell.exe
Token: 33	4792	powershell.exe
Token: 34	4792	powershell.exe
Token: 35	4792	powershell.exe
Token: 36	4792	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeIncreaseQuotaPrivilege	4440	powershell.exe
Token: SeSecurityPrivilege	4440	powershell.exe
Token: SeTakeOwnershipPrivilege	4440	powershell.exe
Token: SeLoadDriverPrivilege	4440	powershell.exe
Token: SeSystemProfilePrivilege	4440	powershell.exe
Token: SeSystemtimePrivilege	4440	powershell.exe
Token: SeProfSingleProcessPrivilege	4440	powershell.exe
Token: SeIncBasePriorityPrivilege	4440	powershell.exe
Token: SeCreatePagefilePrivilege	4440	powershell.exe
Token: SeBackupPrivilege	4440	powershell.exe
Token: SeRestorePrivilege	4440	powershell.exe
Token: SeShutdownPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeSystemEnvironmentPrivilege	4440	powershell.exe
Token: SeRemoteShutdownPrivilege	4440	powershell.exe
Token: SeUndockPrivilege	4440	powershell.exe
Token: SeManageVolumePrivilege	4440	powershell.exe
Token: 33	4440	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 4080	4064	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 4080 wrote to memory of 352	4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 352 wrote to memory of 5876	352	cmd.exe	92
PID 4080 wrote to memory of 3524	4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 3524 wrote to memory of 4792	3524	cmd.exe	96
PID 4080 wrote to memory of 1464	4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 1464 wrote to memory of 4440	1464	cmd.exe	99
PID 4080 wrote to memory of 3068	4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 3068 wrote to memory of 1876	3068	cmd.exe	102
PID 4080 wrote to memory of 3896	4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 3896 wrote to memory of 3056	3896	cmd.exe	105
PID 4080 wrote to memory of 5884	4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 5884 wrote to memory of 3280	5884	cmd.exe	108
PID 4080 wrote to memory of 6028	4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 6028 wrote to memory of 1048	6028	cmd.exe	111
PID 4080 wrote to memory of 3272	4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 3272 wrote to memory of 4164	3272	cmd.exe	114
PID 4080 wrote to memory of 1872	4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 1872 wrote to memory of 4956	1872	cmd.exe	117
PID 4080 wrote to memory of 5848	4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	119
PID 5848 wrote to memory of 4348	5848	cmd.exe	121
PID 4080 wrote to memory of 2040	4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	122
PID 2040 wrote to memory of 4260	2040	cmd.exe	124
PID 4080 wrote to memory of 480	4080	2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	125
PID 480 wrote to memory of 256	480	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-01_412bf948c841cf5a9bfc8380afa91cd5_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\sikikaj'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\sikikaj'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact