266ee21a6c9f3408e472b4f146db4d1c6e5b0775bd04bae92862023d6c1e95f8

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 12:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.7MB
Sample260802-pbxvasal4x
SHA256 266ee21a6c9f3408e472b4f146db4d1c6e5b0775bd04bae92862023d6c1e95f8
MD5 14b1eb938f22e162ec0c25c6d867fc1c
SHA1 f21f5abbf5874367e49b97177b4d0256f6d5ec20
SHA512 d2f093382cce85ff7179aca3b919a9d97f1c8d34c846241ddb8310b70acc32518ab6edee15746f822a3942cd0f2ce7e9956be2b7fce8b32a4f985cdfcd86a011
SSDEEP 393216:ffXPRUmFrJMJa0bKmUxNgVb0XMCHWUjLcuI3/PGTAI:fffXFNM4ZIV0XMb8oH/O7
TLSH
T1D9E63318AFE413AEE6E35139EFE20946E665B8744771CA9F17A8C2552D072F0CD3CB06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5848	powershell.exe
2788	powershell.exe
1132	powershell.exe
2708	powershell.exe
2016	powershell.exe
4176	powershell.exe
2056	powershell.exe
1512	powershell.exe
4220	powershell.exe
5668	powershell.exe
2940	powershell.exe
2704	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
436	cmd.exe
1536	cmd.exe
2344	cmd.exe
1956	cmd.exe
5336	cmd.exe
2136	cmd.exe
3420	cmd.exe
2876	cmd.exe
5344	cmd.exe
3284	cmd.exe
1032	cmd.exe
4564	cmd.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
4176	powershell.exe
4176	powershell.exe
4176	powershell.exe
2056	powershell.exe
2056	powershell.exe
2056	powershell.exe
5848	powershell.exe
5848	powershell.exe
5848	powershell.exe
1512	powershell.exe
1512	powershell.exe
1512	powershell.exe
2788	powershell.exe
2788	powershell.exe
2788	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
5668	powershell.exe
5668	powershell.exe
5668	powershell.exe
2940	powershell.exe
2940	powershell.exe
2940	powershell.exe
2704	powershell.exe
2704	powershell.exe
2704	powershell.exe
1132	powershell.exe
1132	powershell.exe
1132	powershell.exe
2708	powershell.exe
2708	powershell.exe
2708	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeIncreaseQuotaPrivilege	2016	powershell.exe
Token: SeSecurityPrivilege	2016	powershell.exe
Token: SeTakeOwnershipPrivilege	2016	powershell.exe
Token: SeLoadDriverPrivilege	2016	powershell.exe
Token: SeSystemProfilePrivilege	2016	powershell.exe
Token: SeSystemtimePrivilege	2016	powershell.exe
Token: SeProfSingleProcessPrivilege	2016	powershell.exe
Token: SeIncBasePriorityPrivilege	2016	powershell.exe
Token: SeCreatePagefilePrivilege	2016	powershell.exe
Token: SeBackupPrivilege	2016	powershell.exe
Token: SeRestorePrivilege	2016	powershell.exe
Token: SeShutdownPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeSystemEnvironmentPrivilege	2016	powershell.exe
Token: SeRemoteShutdownPrivilege	2016	powershell.exe
Token: SeUndockPrivilege	2016	powershell.exe
Token: SeManageVolumePrivilege	2016	powershell.exe
Token: 33	2016	powershell.exe
Token: 34	2016	powershell.exe
Token: 35	2016	powershell.exe
Token: 36	2016	powershell.exe
Token: SeDebugPrivilege	4176	powershell.exe
Token: SeIncreaseQuotaPrivilege	4176	powershell.exe
Token: SeSecurityPrivilege	4176	powershell.exe
Token: SeTakeOwnershipPrivilege	4176	powershell.exe
Token: SeLoadDriverPrivilege	4176	powershell.exe
Token: SeSystemProfilePrivilege	4176	powershell.exe
Token: SeSystemtimePrivilege	4176	powershell.exe
Token: SeProfSingleProcessPrivilege	4176	powershell.exe
Token: SeIncBasePriorityPrivilege	4176	powershell.exe
Token: SeCreatePagefilePrivilege	4176	powershell.exe
Token: SeBackupPrivilege	4176	powershell.exe
Token: SeRestorePrivilege	4176	powershell.exe
Token: SeShutdownPrivilege	4176	powershell.exe
Token: SeDebugPrivilege	4176	powershell.exe
Token: SeSystemEnvironmentPrivilege	4176	powershell.exe
Token: SeRemoteShutdownPrivilege	4176	powershell.exe
Token: SeUndockPrivilege	4176	powershell.exe
Token: SeManageVolumePrivilege	4176	powershell.exe
Token: 33	4176	powershell.exe
Token: 34	4176	powershell.exe
Token: 35	4176	powershell.exe
Token: 36	4176	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeIncreaseQuotaPrivilege	2056	powershell.exe
Token: SeSecurityPrivilege	2056	powershell.exe
Token: SeTakeOwnershipPrivilege	2056	powershell.exe
Token: SeLoadDriverPrivilege	2056	powershell.exe
Token: SeSystemProfilePrivilege	2056	powershell.exe
Token: SeSystemtimePrivilege	2056	powershell.exe
Token: SeProfSingleProcessPrivilege	2056	powershell.exe
Token: SeIncBasePriorityPrivilege	2056	powershell.exe
Token: SeCreatePagefilePrivilege	2056	powershell.exe
Token: SeBackupPrivilege	2056	powershell.exe
Token: SeRestorePrivilege	2056	powershell.exe
Token: SeShutdownPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeSystemEnvironmentPrivilege	2056	powershell.exe
Token: SeRemoteShutdownPrivilege	2056	powershell.exe
Token: SeUndockPrivilege	2056	powershell.exe
Token: SeManageVolumePrivilege	2056	powershell.exe
Token: 33	2056	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 108	1500	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 108 wrote to memory of 1956	108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	91
PID 1956 wrote to memory of 2016	1956	cmd.exe	93
PID 108 wrote to memory of 5336	108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	95
PID 5336 wrote to memory of 4176	5336	cmd.exe	97
PID 108 wrote to memory of 2136	108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	98
PID 2136 wrote to memory of 2056	2136	cmd.exe	100
PID 108 wrote to memory of 1032	108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	101
PID 1032 wrote to memory of 5848	1032	cmd.exe	103
PID 108 wrote to memory of 4564	108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	104
PID 4564 wrote to memory of 1512	4564	cmd.exe	106
PID 108 wrote to memory of 3420	108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	107
PID 3420 wrote to memory of 2788	3420	cmd.exe	109
PID 108 wrote to memory of 2876	108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	110
PID 2876 wrote to memory of 4220	2876	cmd.exe	112
PID 108 wrote to memory of 436	108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	113
PID 436 wrote to memory of 5668	436	cmd.exe	115
PID 108 wrote to memory of 5344	108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	116
PID 5344 wrote to memory of 2940	5344	cmd.exe	118
PID 108 wrote to memory of 1536	108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	119
PID 1536 wrote to memory of 2704	1536	cmd.exe	121
PID 108 wrote to memory of 2344	108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	122
PID 2344 wrote to memory of 1132	2344	cmd.exe	124
PID 108 wrote to memory of 3284	108	2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	125
PID 3284 wrote to memory of 2708	3284	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Local\Temp\2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-02_14b1eb938f22e162ec0c25c6d867fc1c_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1956
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\xixobak'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\xixobak'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1032
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact