9380a826684800b25e62bedf5085506dc7cd5bdf7032102bb18259dd63f0a8a3

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260803-rbhfqa1fke
SHA256 9380a826684800b25e62bedf5085506dc7cd5bdf7032102bb18259dd63f0a8a3
MD5 c8cc26e9200efb6832b7d5f466159335
SHA1 5156c549b22223020b30a6f0296ad15fb11d7d23
SHA512 683ebcd318b220b7a27287e820cbce1786da95ef1e8020b8a79db01399b3026f62ccf4c7174cb441fa640fddcf590d709e49856e6b23aab1b9dbf3d4517c97e7
SSDEEP 393216:nGmLW1vxUHylguKmdedKlq2AdXMCHWUjIcuI3/PGTAI:nGb1qyloKlq2AdXMb89H/O7
TLSH
T1FEE63398BBD003FCFA73653CADD10264D16AB8B50770C59F5FA897A22C53BE10A39716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4404	powershell.exe
1956	powershell.exe
1428	powershell.exe
2652	powershell.exe
2876	powershell.exe
1084	powershell.exe
1784	powershell.exe
5092	powershell.exe
2220	powershell.exe
4828	powershell.exe
1680	powershell.exe
248	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4328	cmd.exe
1496	cmd.exe
2324	cmd.exe
4060	cmd.exe
4824	cmd.exe
4740	cmd.exe
5244	cmd.exe
4888	cmd.exe
3912	cmd.exe
5164	cmd.exe
4716	cmd.exe
4368	cmd.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4404	powershell.exe
4404	powershell.exe
1784	powershell.exe
1784	powershell.exe
1784	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
1956	powershell.exe
1956	powershell.exe
1956	powershell.exe
2220	powershell.exe
2220	powershell.exe
2220	powershell.exe
1428	powershell.exe
1428	powershell.exe
4828	powershell.exe
4828	powershell.exe
1680	powershell.exe
1680	powershell.exe
2652	powershell.exe
2652	powershell.exe
2876	powershell.exe
2876	powershell.exe
2876	powershell.exe
1084	powershell.exe
1084	powershell.exe
1084	powershell.exe
248	powershell.exe
248	powershell.exe
248	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeIncreaseQuotaPrivilege	4404	powershell.exe
Token: SeSecurityPrivilege	4404	powershell.exe
Token: SeTakeOwnershipPrivilege	4404	powershell.exe
Token: SeLoadDriverPrivilege	4404	powershell.exe
Token: SeSystemProfilePrivilege	4404	powershell.exe
Token: SeSystemtimePrivilege	4404	powershell.exe
Token: SeProfSingleProcessPrivilege	4404	powershell.exe
Token: SeIncBasePriorityPrivilege	4404	powershell.exe
Token: SeCreatePagefilePrivilege	4404	powershell.exe
Token: SeBackupPrivilege	4404	powershell.exe
Token: SeRestorePrivilege	4404	powershell.exe
Token: SeShutdownPrivilege	4404	powershell.exe
Token: SeDebugPrivilege	4404	powershell.exe
Token: SeSystemEnvironmentPrivilege	4404	powershell.exe
Token: SeRemoteShutdownPrivilege	4404	powershell.exe
Token: SeUndockPrivilege	4404	powershell.exe
Token: SeManageVolumePrivilege	4404	powershell.exe
Token: 33	4404	powershell.exe
Token: 34	4404	powershell.exe
Token: 35	4404	powershell.exe
Token: 36	4404	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeIncreaseQuotaPrivilege	1784	powershell.exe
Token: SeSecurityPrivilege	1784	powershell.exe
Token: SeTakeOwnershipPrivilege	1784	powershell.exe
Token: SeLoadDriverPrivilege	1784	powershell.exe
Token: SeSystemProfilePrivilege	1784	powershell.exe
Token: SeSystemtimePrivilege	1784	powershell.exe
Token: SeProfSingleProcessPrivilege	1784	powershell.exe
Token: SeIncBasePriorityPrivilege	1784	powershell.exe
Token: SeCreatePagefilePrivilege	1784	powershell.exe
Token: SeBackupPrivilege	1784	powershell.exe
Token: SeRestorePrivilege	1784	powershell.exe
Token: SeShutdownPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeSystemEnvironmentPrivilege	1784	powershell.exe
Token: SeRemoteShutdownPrivilege	1784	powershell.exe
Token: SeUndockPrivilege	1784	powershell.exe
Token: SeManageVolumePrivilege	1784	powershell.exe
Token: 33	1784	powershell.exe
Token: 34	1784	powershell.exe
Token: 35	1784	powershell.exe
Token: 36	1784	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeIncreaseQuotaPrivilege	5092	powershell.exe
Token: SeSecurityPrivilege	5092	powershell.exe
Token: SeTakeOwnershipPrivilege	5092	powershell.exe
Token: SeLoadDriverPrivilege	5092	powershell.exe
Token: SeSystemProfilePrivilege	5092	powershell.exe
Token: SeSystemtimePrivilege	5092	powershell.exe
Token: SeProfSingleProcessPrivilege	5092	powershell.exe
Token: SeIncBasePriorityPrivilege	5092	powershell.exe
Token: SeCreatePagefilePrivilege	5092	powershell.exe
Token: SeBackupPrivilege	5092	powershell.exe
Token: SeRestorePrivilege	5092	powershell.exe
Token: SeShutdownPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeSystemEnvironmentPrivilege	5092	powershell.exe
Token: SeRemoteShutdownPrivilege	5092	powershell.exe
Token: SeUndockPrivilege	5092	powershell.exe
Token: SeManageVolumePrivilege	5092	powershell.exe
Token: 33	5092	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 6004	2448	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 6004 wrote to memory of 4888	6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4888 wrote to memory of 4404	4888	cmd.exe	92
PID 6004 wrote to memory of 4328	6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 4328 wrote to memory of 1784	4328	cmd.exe	96
PID 6004 wrote to memory of 3912	6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 3912 wrote to memory of 5092	3912	cmd.exe	99
PID 6004 wrote to memory of 5164	6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 5164 wrote to memory of 1956	5164	cmd.exe	102
PID 6004 wrote to memory of 1496	6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 1496 wrote to memory of 2220	1496	cmd.exe	105
PID 6004 wrote to memory of 2324	6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 2324 wrote to memory of 1428	2324	cmd.exe	108
PID 6004 wrote to memory of 4060	6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 4060 wrote to memory of 4828	4060	cmd.exe	111
PID 6004 wrote to memory of 4716	6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 4716 wrote to memory of 1680	4716	cmd.exe	114
PID 6004 wrote to memory of 4368	6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 4368 wrote to memory of 2652	4368	cmd.exe	117
PID 6004 wrote to memory of 4824	6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 4824 wrote to memory of 2876	4824	cmd.exe	120
PID 6004 wrote to memory of 4740	6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 4740 wrote to memory of 1084	4740	cmd.exe	123
PID 6004 wrote to memory of 5244	6004	2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	124
PID 5244 wrote to memory of 248	5244	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-03_c8cc26e9200efb6832b7d5f466159335_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\giqikiq'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\giqikiq'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3912
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1496
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2324
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact