8dfcca93187f9495fdd02d155711b5c701e6e3fcd8a3f9851f2ab6b517a5162b

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260805-3ra75aydja
SHA256 8dfcca93187f9495fdd02d155711b5c701e6e3fcd8a3f9851f2ab6b517a5162b
MD5 ea85b1af552ef9391c0fd090c3653da7
SHA1 a8e5b725759f6a5702969325cf51266278d6659f
SHA512 9cbe4365eb09b8b3c61da981d0ab646100ca90a6a61109769d6e7e2d06ee7261217081bc5b8eb5ddc341ef3257e84dc65489256e271e1cdf7c2f6e4159597114
SSDEEP 393216:jGmf7Zb3+iQbqUmspUbX0O+XMCHWUjJcuI3/PGTAI:jGwZjC+UNUAO+XMb8+H/O7
TLSH
T17CE6331CA7C101B8EBB3947D8FE115A1F274F8262376C5EB87E846956C575F04A3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3088	powershell.exe
240	powershell.exe
3792	powershell.exe
5700	powershell.exe
3336	powershell.exe
3808	powershell.exe
3112	powershell.exe
4788	powershell.exe
4688	powershell.exe
2036	powershell.exe
3252	powershell.exe
5072	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5488	cmd.exe
5504	cmd.exe
2112	cmd.exe
5756	cmd.exe
5500	cmd.exe
2568	cmd.exe
2704	cmd.exe
4884	cmd.exe
3524	cmd.exe
5924	cmd.exe
2104	cmd.exe
4296	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3088	powershell.exe
3088	powershell.exe
240	powershell.exe
240	powershell.exe
3792	powershell.exe
3792	powershell.exe
4688	powershell.exe
4688	powershell.exe
5700	powershell.exe
5700	powershell.exe
2036	powershell.exe
2036	powershell.exe
3252	powershell.exe
3252	powershell.exe
3336	powershell.exe
3336	powershell.exe
3808	powershell.exe
3808	powershell.exe
3112	powershell.exe
3112	powershell.exe
5072	powershell.exe
5072	powershell.exe
4788	powershell.exe
4788	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeIncreaseQuotaPrivilege	3088	powershell.exe
Token: SeSecurityPrivilege	3088	powershell.exe
Token: SeTakeOwnershipPrivilege	3088	powershell.exe
Token: SeLoadDriverPrivilege	3088	powershell.exe
Token: SeSystemProfilePrivilege	3088	powershell.exe
Token: SeSystemtimePrivilege	3088	powershell.exe
Token: SeProfSingleProcessPrivilege	3088	powershell.exe
Token: SeIncBasePriorityPrivilege	3088	powershell.exe
Token: SeCreatePagefilePrivilege	3088	powershell.exe
Token: SeBackupPrivilege	3088	powershell.exe
Token: SeRestorePrivilege	3088	powershell.exe
Token: SeShutdownPrivilege	3088	powershell.exe
Token: SeDebugPrivilege	3088	powershell.exe
Token: SeSystemEnvironmentPrivilege	3088	powershell.exe
Token: SeRemoteShutdownPrivilege	3088	powershell.exe
Token: SeUndockPrivilege	3088	powershell.exe
Token: SeManageVolumePrivilege	3088	powershell.exe
Token: 33	3088	powershell.exe
Token: 34	3088	powershell.exe
Token: 35	3088	powershell.exe
Token: 36	3088	powershell.exe
Token: SeDebugPrivilege	240	powershell.exe
Token: SeIncreaseQuotaPrivilege	240	powershell.exe
Token: SeSecurityPrivilege	240	powershell.exe
Token: SeTakeOwnershipPrivilege	240	powershell.exe
Token: SeLoadDriverPrivilege	240	powershell.exe
Token: SeSystemProfilePrivilege	240	powershell.exe
Token: SeSystemtimePrivilege	240	powershell.exe
Token: SeProfSingleProcessPrivilege	240	powershell.exe
Token: SeIncBasePriorityPrivilege	240	powershell.exe
Token: SeCreatePagefilePrivilege	240	powershell.exe
Token: SeBackupPrivilege	240	powershell.exe
Token: SeRestorePrivilege	240	powershell.exe
Token: SeShutdownPrivilege	240	powershell.exe
Token: SeDebugPrivilege	240	powershell.exe
Token: SeSystemEnvironmentPrivilege	240	powershell.exe
Token: SeRemoteShutdownPrivilege	240	powershell.exe
Token: SeUndockPrivilege	240	powershell.exe
Token: SeManageVolumePrivilege	240	powershell.exe
Token: 33	240	powershell.exe
Token: 34	240	powershell.exe
Token: 35	240	powershell.exe
Token: 36	240	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeIncreaseQuotaPrivilege	3792	powershell.exe
Token: SeSecurityPrivilege	3792	powershell.exe
Token: SeTakeOwnershipPrivilege	3792	powershell.exe
Token: SeLoadDriverPrivilege	3792	powershell.exe
Token: SeSystemProfilePrivilege	3792	powershell.exe
Token: SeSystemtimePrivilege	3792	powershell.exe
Token: SeProfSingleProcessPrivilege	3792	powershell.exe
Token: SeIncBasePriorityPrivilege	3792	powershell.exe
Token: SeCreatePagefilePrivilege	3792	powershell.exe
Token: SeBackupPrivilege	3792	powershell.exe
Token: SeRestorePrivilege	3792	powershell.exe
Token: SeShutdownPrivilege	3792	powershell.exe
Token: SeDebugPrivilege	3792	powershell.exe
Token: SeSystemEnvironmentPrivilege	3792	powershell.exe
Token: SeRemoteShutdownPrivilege	3792	powershell.exe
Token: SeUndockPrivilege	3792	powershell.exe
Token: SeManageVolumePrivilege	3792	powershell.exe
Token: 33	3792	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 5092	4896	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 5092 wrote to memory of 5488	5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 5488 wrote to memory of 3088	5488	cmd.exe	92
PID 5092 wrote to memory of 2704	5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 2704 wrote to memory of 240	2704	cmd.exe	96
PID 5092 wrote to memory of 4884	5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 4884 wrote to memory of 3792	4884	cmd.exe	99
PID 5092 wrote to memory of 3524	5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 3524 wrote to memory of 4688	3524	cmd.exe	102
PID 5092 wrote to memory of 5924	5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 5924 wrote to memory of 5700	5924	cmd.exe	105
PID 5092 wrote to memory of 5504	5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 5504 wrote to memory of 2036	5504	cmd.exe	108
PID 5092 wrote to memory of 2112	5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 2112 wrote to memory of 3252	2112	cmd.exe	111
PID 5092 wrote to memory of 2104	5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 2104 wrote to memory of 3336	2104	cmd.exe	114
PID 5092 wrote to memory of 4296	5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 4296 wrote to memory of 3808	4296	cmd.exe	117
PID 5092 wrote to memory of 5756	5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 5756 wrote to memory of 3112	5756	cmd.exe	120
PID 5092 wrote to memory of 5500	5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 5500 wrote to memory of 5072	5500	cmd.exe	123
PID 5092 wrote to memory of 2568	5092	2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	124
PID 2568 wrote to memory of 4788	2568	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Users\Admin\AppData\Local\Temp\2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_ea85b1af552ef9391c0fd090c3653da7_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cimeqog'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cimeqog'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5756
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact