e615cc96f7eec986fe4c10b109739dfb9a4ceaa8d0df87ef03474cf46b71b19a

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260808-r56qeaea47
SHA256 e615cc96f7eec986fe4c10b109739dfb9a4ceaa8d0df87ef03474cf46b71b19a
MD5 1877ec10e90000f32f87a2c754fc028d
SHA1 d4afcca2b8e956a2a31d9e4d931f0d610e61aba3
SHA512 a80b6053604c2a2fa0ee8504647bbbc2cf3276566ad2573d6c137fc200e80acae544f5a66bf6290aadb25d49885d20ba18a269a5a68f177bc34989dfe084f17b
SSDEEP 393216:pGm2PWADMqqMDhFlP7XMCHWUjfcuI3/PGTAI:pGHvMqqMDNXMb80H/O7
TLSH
T1CFE633881AE413FEE273A23C9DD24156E571B87A1BA0C8DF4FE441665D232E0C97E727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6056	powershell.exe
5644	powershell.exe
2104	powershell.exe
5960	powershell.exe
3208	powershell.exe
752	powershell.exe
1272	powershell.exe
2572	powershell.exe
4304	powershell.exe
5780	powershell.exe
5304	powershell.exe
5800	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5884	cmd.exe
4024	cmd.exe
6124	cmd.exe
5764	cmd.exe
3532	cmd.exe
2172	cmd.exe
5992	cmd.exe
2328	cmd.exe
4916	cmd.exe
1280	cmd.exe
3356	cmd.exe
3872	cmd.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
752	powershell.exe
752	powershell.exe
1272	powershell.exe
1272	powershell.exe
1272	powershell.exe
2572	powershell.exe
2572	powershell.exe
2572	powershell.exe
4304	powershell.exe
4304	powershell.exe
5780	powershell.exe
5780	powershell.exe
5644	powershell.exe
5644	powershell.exe
5304	powershell.exe
5304	powershell.exe
5800	powershell.exe
5800	powershell.exe
6056	powershell.exe
6056	powershell.exe
2104	powershell.exe
2104	powershell.exe
5960	powershell.exe
5960	powershell.exe
3208	powershell.exe
3208	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeIncreaseQuotaPrivilege	752	powershell.exe
Token: SeSecurityPrivilege	752	powershell.exe
Token: SeTakeOwnershipPrivilege	752	powershell.exe
Token: SeLoadDriverPrivilege	752	powershell.exe
Token: SeSystemProfilePrivilege	752	powershell.exe
Token: SeSystemtimePrivilege	752	powershell.exe
Token: SeProfSingleProcessPrivilege	752	powershell.exe
Token: SeIncBasePriorityPrivilege	752	powershell.exe
Token: SeCreatePagefilePrivilege	752	powershell.exe
Token: SeBackupPrivilege	752	powershell.exe
Token: SeRestorePrivilege	752	powershell.exe
Token: SeShutdownPrivilege	752	powershell.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeSystemEnvironmentPrivilege	752	powershell.exe
Token: SeRemoteShutdownPrivilege	752	powershell.exe
Token: SeUndockPrivilege	752	powershell.exe
Token: SeManageVolumePrivilege	752	powershell.exe
Token: 33	752	powershell.exe
Token: 34	752	powershell.exe
Token: 35	752	powershell.exe
Token: 36	752	powershell.exe
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeIncreaseQuotaPrivilege	1272	powershell.exe
Token: SeSecurityPrivilege	1272	powershell.exe
Token: SeTakeOwnershipPrivilege	1272	powershell.exe
Token: SeLoadDriverPrivilege	1272	powershell.exe
Token: SeSystemProfilePrivilege	1272	powershell.exe
Token: SeSystemtimePrivilege	1272	powershell.exe
Token: SeProfSingleProcessPrivilege	1272	powershell.exe
Token: SeIncBasePriorityPrivilege	1272	powershell.exe
Token: SeCreatePagefilePrivilege	1272	powershell.exe
Token: SeBackupPrivilege	1272	powershell.exe
Token: SeRestorePrivilege	1272	powershell.exe
Token: SeShutdownPrivilege	1272	powershell.exe
Token: SeDebugPrivilege	1272	powershell.exe
Token: SeSystemEnvironmentPrivilege	1272	powershell.exe
Token: SeRemoteShutdownPrivilege	1272	powershell.exe
Token: SeUndockPrivilege	1272	powershell.exe
Token: SeManageVolumePrivilege	1272	powershell.exe
Token: 33	1272	powershell.exe
Token: 34	1272	powershell.exe
Token: 35	1272	powershell.exe
Token: 36	1272	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeIncreaseQuotaPrivilege	2572	powershell.exe
Token: SeSecurityPrivilege	2572	powershell.exe
Token: SeTakeOwnershipPrivilege	2572	powershell.exe
Token: SeLoadDriverPrivilege	2572	powershell.exe
Token: SeSystemProfilePrivilege	2572	powershell.exe
Token: SeSystemtimePrivilege	2572	powershell.exe
Token: SeProfSingleProcessPrivilege	2572	powershell.exe
Token: SeIncBasePriorityPrivilege	2572	powershell.exe
Token: SeCreatePagefilePrivilege	2572	powershell.exe
Token: SeBackupPrivilege	2572	powershell.exe
Token: SeRestorePrivilege	2572	powershell.exe
Token: SeShutdownPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeSystemEnvironmentPrivilege	2572	powershell.exe
Token: SeRemoteShutdownPrivilege	2572	powershell.exe
Token: SeUndockPrivilege	2572	powershell.exe
Token: SeManageVolumePrivilege	2572	powershell.exe
Token: 33	2572	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5696 wrote to memory of 5220	5696	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	88
PID 5220 wrote to memory of 4916	5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 4916 wrote to memory of 752	4916	cmd.exe	91
PID 5220 wrote to memory of 5764	5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	93
PID 5764 wrote to memory of 1272	5764	cmd.exe	95
PID 5220 wrote to memory of 1280	5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	96
PID 1280 wrote to memory of 2572	1280	cmd.exe	98
PID 5220 wrote to memory of 3532	5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	99
PID 3532 wrote to memory of 4304	3532	cmd.exe	101
PID 5220 wrote to memory of 3356	5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	102
PID 3356 wrote to memory of 5780	3356	cmd.exe	104
PID 5220 wrote to memory of 3872	5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	105
PID 3872 wrote to memory of 5644	3872	cmd.exe	107
PID 5220 wrote to memory of 2172	5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	108
PID 2172 wrote to memory of 5304	2172	cmd.exe	110
PID 5220 wrote to memory of 5884	5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	111
PID 5884 wrote to memory of 5800	5884	cmd.exe	113
PID 5220 wrote to memory of 4024	5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 4024 wrote to memory of 6056	4024	cmd.exe	117
PID 5220 wrote to memory of 5992	5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 5992 wrote to memory of 2104	5992	cmd.exe	120
PID 5220 wrote to memory of 6124	5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 6124 wrote to memory of 5960	6124	cmd.exe	123
PID 5220 wrote to memory of 2328	5220	2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	124
PID 2328 wrote to memory of 3208	2328	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Users\Admin\AppData\Local\Temp\2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_1877ec10e90000f32f87a2c754fc028d_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\tegiheh'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\tegiheh'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1280
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6124
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact