599584e6e42436721a66c2d3fbc29fe0d9be0b0e3f9e0f5f0333293e293920fc

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260808-rh4yasyarc
SHA256 599584e6e42436721a66c2d3fbc29fe0d9be0b0e3f9e0f5f0333293e293920fc
MD5 cb7a54e77e833e0cfd984ef4a9c49a3a
SHA1 7277302b2aff555f45fa7839aef63797dfd958de
SHA512 f2ac700ad9074d8a88210a6eadbbc1981afb0d499ec219c2e75879b56bec240daaa1d1a65ab4edc6984f72d1ec82d98925dcec259668e28b22c40ba9453198f1
SSDEEP 393216:/GmlE2rAcCDTstHAXMCHWUjlcuI3/PGTAI:/GKhuXMb8SH/O7
TLSH
T1C8E63309B7D015FEE6A3923CEEE22224D4A674B42331C9CB53E846E26D573D05C7DB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
460	powershell.exe
4788	powershell.exe
4536	powershell.exe
1544	powershell.exe
4900	powershell.exe
264	powershell.exe
3380	powershell.exe
1336	powershell.exe
3140	powershell.exe
1428	powershell.exe
2192	powershell.exe
5028	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3932	cmd.exe
4276	cmd.exe
5624	cmd.exe
4872	cmd.exe
2156	cmd.exe
2800	cmd.exe
2832	cmd.exe
2880	cmd.exe
1564	cmd.exe
2808	cmd.exe
1932	cmd.exe
3952	cmd.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4536	powershell.exe
4536	powershell.exe
3380	powershell.exe
3380	powershell.exe
1336	powershell.exe
1336	powershell.exe
3140	powershell.exe
3140	powershell.exe
1428	powershell.exe
1428	powershell.exe
2192	powershell.exe
2192	powershell.exe
2192	powershell.exe
5028	powershell.exe
5028	powershell.exe
5028	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
460	powershell.exe
460	powershell.exe
460	powershell.exe
4788	powershell.exe
4788	powershell.exe
4788	powershell.exe
4900	powershell.exe
4900	powershell.exe
4900	powershell.exe
264	powershell.exe
264	powershell.exe
264	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeIncreaseQuotaPrivilege	4536	powershell.exe
Token: SeSecurityPrivilege	4536	powershell.exe
Token: SeTakeOwnershipPrivilege	4536	powershell.exe
Token: SeLoadDriverPrivilege	4536	powershell.exe
Token: SeSystemProfilePrivilege	4536	powershell.exe
Token: SeSystemtimePrivilege	4536	powershell.exe
Token: SeProfSingleProcessPrivilege	4536	powershell.exe
Token: SeIncBasePriorityPrivilege	4536	powershell.exe
Token: SeCreatePagefilePrivilege	4536	powershell.exe
Token: SeBackupPrivilege	4536	powershell.exe
Token: SeRestorePrivilege	4536	powershell.exe
Token: SeShutdownPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeSystemEnvironmentPrivilege	4536	powershell.exe
Token: SeRemoteShutdownPrivilege	4536	powershell.exe
Token: SeUndockPrivilege	4536	powershell.exe
Token: SeManageVolumePrivilege	4536	powershell.exe
Token: 33	4536	powershell.exe
Token: 34	4536	powershell.exe
Token: 35	4536	powershell.exe
Token: 36	4536	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeIncreaseQuotaPrivilege	3380	powershell.exe
Token: SeSecurityPrivilege	3380	powershell.exe
Token: SeTakeOwnershipPrivilege	3380	powershell.exe
Token: SeLoadDriverPrivilege	3380	powershell.exe
Token: SeSystemProfilePrivilege	3380	powershell.exe
Token: SeSystemtimePrivilege	3380	powershell.exe
Token: SeProfSingleProcessPrivilege	3380	powershell.exe
Token: SeIncBasePriorityPrivilege	3380	powershell.exe
Token: SeCreatePagefilePrivilege	3380	powershell.exe
Token: SeBackupPrivilege	3380	powershell.exe
Token: SeRestorePrivilege	3380	powershell.exe
Token: SeShutdownPrivilege	3380	powershell.exe
Token: SeDebugPrivilege	3380	powershell.exe
Token: SeSystemEnvironmentPrivilege	3380	powershell.exe
Token: SeRemoteShutdownPrivilege	3380	powershell.exe
Token: SeUndockPrivilege	3380	powershell.exe
Token: SeManageVolumePrivilege	3380	powershell.exe
Token: 33	3380	powershell.exe
Token: 34	3380	powershell.exe
Token: 35	3380	powershell.exe
Token: 36	3380	powershell.exe
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeIncreaseQuotaPrivilege	1336	powershell.exe
Token: SeSecurityPrivilege	1336	powershell.exe
Token: SeTakeOwnershipPrivilege	1336	powershell.exe
Token: SeLoadDriverPrivilege	1336	powershell.exe
Token: SeSystemProfilePrivilege	1336	powershell.exe
Token: SeSystemtimePrivilege	1336	powershell.exe
Token: SeProfSingleProcessPrivilege	1336	powershell.exe
Token: SeIncBasePriorityPrivilege	1336	powershell.exe
Token: SeCreatePagefilePrivilege	1336	powershell.exe
Token: SeBackupPrivilege	1336	powershell.exe
Token: SeRestorePrivilege	1336	powershell.exe
Token: SeShutdownPrivilege	1336	powershell.exe
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeSystemEnvironmentPrivilege	1336	powershell.exe
Token: SeRemoteShutdownPrivilege	1336	powershell.exe
Token: SeUndockPrivilege	1336	powershell.exe
Token: SeManageVolumePrivilege	1336	powershell.exe
Token: 33	1336	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 5184	6076	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 5184 wrote to memory of 4872	5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4872 wrote to memory of 4536	4872	cmd.exe	92
PID 5184 wrote to memory of 3952	5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 3952 wrote to memory of 3380	3952	cmd.exe	96
PID 5184 wrote to memory of 3932	5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 3932 wrote to memory of 1336	3932	cmd.exe	99
PID 5184 wrote to memory of 4276	5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 4276 wrote to memory of 3140	4276	cmd.exe	102
PID 5184 wrote to memory of 2156	5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 2156 wrote to memory of 1428	2156	cmd.exe	105
PID 5184 wrote to memory of 2800	5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 2800 wrote to memory of 2192	2800	cmd.exe	108
PID 5184 wrote to memory of 2832	5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 2832 wrote to memory of 5028	2832	cmd.exe	111
PID 5184 wrote to memory of 2880	5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 2880 wrote to memory of 1544	2880	cmd.exe	114
PID 5184 wrote to memory of 5624	5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 5624 wrote to memory of 460	5624	cmd.exe	117
PID 5184 wrote to memory of 1564	5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 1564 wrote to memory of 4788	1564	cmd.exe	120
PID 5184 wrote to memory of 2808	5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 2808 wrote to memory of 4900	2808	cmd.exe	123
PID 5184 wrote to memory of 1932	5184	2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	125
PID 1932 wrote to memory of 264	1932	cmd.exe	127

C:\Users\Admin\AppData\Local\Temp\2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Users\Admin\AppData\Local\Temp\2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_cb7a54e77e833e0cfd984ef4a9c49a3a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\tegiheh'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\tegiheh'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2832
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2880
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5624
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact