1e7b81bdbf126727fa8fd61049f68025deede33c2204c2fb8af9465cee9cbd82

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260808-rm2zhasvht
SHA256 1e7b81bdbf126727fa8fd61049f68025deede33c2204c2fb8af9465cee9cbd82
MD5 a9c6b8aa8dcad8c23bbafd75f9874231
SHA1 8b3d1515aa4c139e5e49e1d855f19b2e363dc07a
SHA512 e8803b8cd4180bcf92417f8534f451eca42a92de395b275df268d65d9523db15bf9d50b085d6d6bbd94b3c54717099e0f8d5137ea5f1b882544b27394509dbe0
SSDEEP 393216:mcmGmUVUqgdwjiPKeQbQaCH6qZuVXMCHWUjacuI3/PGTAI:0GXyc2QbRCaCuVXMb8XH/O7
TLSH
T1BFE6334CA1E002EDE6B3123DFDD11E45E5B0B867A7B0C9DB17A493E42E272E09C39657
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4544	powershell.exe
5048	powershell.exe
2952	powershell.exe
884	powershell.exe
1068	powershell.exe
1524	powershell.exe
4340	powershell.exe
5096	powershell.exe
1100	powershell.exe
5584	powershell.exe
3252	powershell.exe
4172	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1924	cmd.exe
4352	cmd.exe
732	cmd.exe
4860	cmd.exe
2208	cmd.exe
2256	cmd.exe
1864	cmd.exe
3396	cmd.exe
5864	cmd.exe
4220	cmd.exe
4908	cmd.exe
3284	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5096	powershell.exe
5096	powershell.exe
1100	powershell.exe
1100	powershell.exe
1100	powershell.exe
5584	powershell.exe
5584	powershell.exe
5584	powershell.exe
5048	powershell.exe
5048	powershell.exe
5048	powershell.exe
2952	powershell.exe
2952	powershell.exe
2952	powershell.exe
3252	powershell.exe
3252	powershell.exe
3252	powershell.exe
884	powershell.exe
884	powershell.exe
884	powershell.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
1524	powershell.exe
1524	powershell.exe
1524	powershell.exe
4172	powershell.exe
4172	powershell.exe
4172	powershell.exe
4340	powershell.exe
4340	powershell.exe
4340	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeIncreaseQuotaPrivilege	5096	powershell.exe
Token: SeSecurityPrivilege	5096	powershell.exe
Token: SeTakeOwnershipPrivilege	5096	powershell.exe
Token: SeLoadDriverPrivilege	5096	powershell.exe
Token: SeSystemProfilePrivilege	5096	powershell.exe
Token: SeSystemtimePrivilege	5096	powershell.exe
Token: SeProfSingleProcessPrivilege	5096	powershell.exe
Token: SeIncBasePriorityPrivilege	5096	powershell.exe
Token: SeCreatePagefilePrivilege	5096	powershell.exe
Token: SeBackupPrivilege	5096	powershell.exe
Token: SeRestorePrivilege	5096	powershell.exe
Token: SeShutdownPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeSystemEnvironmentPrivilege	5096	powershell.exe
Token: SeRemoteShutdownPrivilege	5096	powershell.exe
Token: SeUndockPrivilege	5096	powershell.exe
Token: SeManageVolumePrivilege	5096	powershell.exe
Token: 33	5096	powershell.exe
Token: 34	5096	powershell.exe
Token: 35	5096	powershell.exe
Token: 36	5096	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeIncreaseQuotaPrivilege	1100	powershell.exe
Token: SeSecurityPrivilege	1100	powershell.exe
Token: SeTakeOwnershipPrivilege	1100	powershell.exe
Token: SeLoadDriverPrivilege	1100	powershell.exe
Token: SeSystemProfilePrivilege	1100	powershell.exe
Token: SeSystemtimePrivilege	1100	powershell.exe
Token: SeProfSingleProcessPrivilege	1100	powershell.exe
Token: SeIncBasePriorityPrivilege	1100	powershell.exe
Token: SeCreatePagefilePrivilege	1100	powershell.exe
Token: SeBackupPrivilege	1100	powershell.exe
Token: SeRestorePrivilege	1100	powershell.exe
Token: SeShutdownPrivilege	1100	powershell.exe
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeSystemEnvironmentPrivilege	1100	powershell.exe
Token: SeRemoteShutdownPrivilege	1100	powershell.exe
Token: SeUndockPrivilege	1100	powershell.exe
Token: SeManageVolumePrivilege	1100	powershell.exe
Token: 33	1100	powershell.exe
Token: 34	1100	powershell.exe
Token: 35	1100	powershell.exe
Token: 36	1100	powershell.exe
Token: SeDebugPrivilege	5584	powershell.exe
Token: SeIncreaseQuotaPrivilege	5584	powershell.exe
Token: SeSecurityPrivilege	5584	powershell.exe
Token: SeTakeOwnershipPrivilege	5584	powershell.exe
Token: SeLoadDriverPrivilege	5584	powershell.exe
Token: SeSystemProfilePrivilege	5584	powershell.exe
Token: SeSystemtimePrivilege	5584	powershell.exe
Token: SeProfSingleProcessPrivilege	5584	powershell.exe
Token: SeIncBasePriorityPrivilege	5584	powershell.exe
Token: SeCreatePagefilePrivilege	5584	powershell.exe
Token: SeBackupPrivilege	5584	powershell.exe
Token: SeRestorePrivilege	5584	powershell.exe
Token: SeShutdownPrivilege	5584	powershell.exe
Token: SeDebugPrivilege	5584	powershell.exe
Token: SeSystemEnvironmentPrivilege	5584	powershell.exe
Token: SeRemoteShutdownPrivilege	5584	powershell.exe
Token: SeUndockPrivilege	5584	powershell.exe
Token: SeManageVolumePrivilege	5584	powershell.exe
Token: 33	5584	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 244	3348	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 244 wrote to memory of 4860	244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 4860 wrote to memory of 5096	4860	cmd.exe	92
PID 244 wrote to memory of 2208	244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 2208 wrote to memory of 1100	2208	cmd.exe	96
PID 244 wrote to memory of 3284	244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 3284 wrote to memory of 5584	3284	cmd.exe	99
PID 244 wrote to memory of 2256	244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 2256 wrote to memory of 5048	2256	cmd.exe	102
PID 244 wrote to memory of 1864	244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 1864 wrote to memory of 2952	1864	cmd.exe	105
PID 244 wrote to memory of 3396	244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 3396 wrote to memory of 3252	3396	cmd.exe	108
PID 244 wrote to memory of 5864	244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 5864 wrote to memory of 884	5864	cmd.exe	111
PID 244 wrote to memory of 1924	244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 1924 wrote to memory of 1068	1924	cmd.exe	114
PID 244 wrote to memory of 4220	244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 4220 wrote to memory of 1524	4220	cmd.exe	117
PID 244 wrote to memory of 4908	244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 4908 wrote to memory of 4172	4908	cmd.exe	120
PID 244 wrote to memory of 4352	244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 4352 wrote to memory of 4340	4352	cmd.exe	123
PID 244 wrote to memory of 732	244	2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	124
PID 732 wrote to memory of 4544	732	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Users\Admin\AppData\Local\Temp\2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_a9c6b8aa8dcad8c23bbafd75f9874231_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\tegiheh'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\tegiheh'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2256
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:884
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:732
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact