8ad8dfa6a9f98192d789ec823e33c912bc0f83c71a4bee3a8e3379e6d08aafa0

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 06:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260810-hjev5aef24
SHA256 8ad8dfa6a9f98192d789ec823e33c912bc0f83c71a4bee3a8e3379e6d08aafa0
MD5 164a1f7b8fb7c804dc5bdaf55ddb6217
SHA1 7bc9a17531824ac8158a2434e01cdb0edae650d5
SHA512 58528da63601ba6eb81838218d34cace5c7ce5bbdd2f3fbf1761582ca7cfa88591f3335503903572c46973a34f36e86c50d544b36e6742141b89e15ce2dc7d7f
SSDEEP 393216:yGmUplwqGJ8idWSwOER6T8A86XMCHWUj6cuI3/PGTAI:yG7x48idtwTRj6XMb83H/O7
TLSH
T18AE633586AC102ADF6F3867CBED09591E0B6B8660731CDEF93B843796D231C0583DA67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4640	powershell.exe
4720	powershell.exe
1844	powershell.exe
4972	powershell.exe
2900	powershell.exe
2972	powershell.exe
2912	powershell.exe
4852	powershell.exe
4400	powershell.exe
3724	powershell.exe
6064	powershell.exe
1604	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5588	cmd.exe
4164	cmd.exe
5116	cmd.exe
3284	cmd.exe
2924	cmd.exe
2976	cmd.exe
2120	cmd.exe
5484	cmd.exe
2676	cmd.exe
3248	cmd.exe
3352	cmd.exe
5848	cmd.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4400	powershell.exe
4400	powershell.exe
4400	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
2900	powershell.exe
2900	powershell.exe
2900	powershell.exe
6064	powershell.exe
6064	powershell.exe
6064	powershell.exe
1604	powershell.exe
1604	powershell.exe
1604	powershell.exe
2972	powershell.exe
2972	powershell.exe
2972	powershell.exe
4640	powershell.exe
4640	powershell.exe
4640	powershell.exe
2912	powershell.exe
2912	powershell.exe
2912	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4720	powershell.exe
4720	powershell.exe
4720	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
4972	powershell.exe
4972	powershell.exe
4972	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeIncreaseQuotaPrivilege	4400	powershell.exe
Token: SeSecurityPrivilege	4400	powershell.exe
Token: SeTakeOwnershipPrivilege	4400	powershell.exe
Token: SeLoadDriverPrivilege	4400	powershell.exe
Token: SeSystemProfilePrivilege	4400	powershell.exe
Token: SeSystemtimePrivilege	4400	powershell.exe
Token: SeProfSingleProcessPrivilege	4400	powershell.exe
Token: SeIncBasePriorityPrivilege	4400	powershell.exe
Token: SeCreatePagefilePrivilege	4400	powershell.exe
Token: SeBackupPrivilege	4400	powershell.exe
Token: SeRestorePrivilege	4400	powershell.exe
Token: SeShutdownPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeSystemEnvironmentPrivilege	4400	powershell.exe
Token: SeRemoteShutdownPrivilege	4400	powershell.exe
Token: SeUndockPrivilege	4400	powershell.exe
Token: SeManageVolumePrivilege	4400	powershell.exe
Token: 33	4400	powershell.exe
Token: 34	4400	powershell.exe
Token: 35	4400	powershell.exe
Token: 36	4400	powershell.exe
Token: SeDebugPrivilege	3724	powershell.exe
Token: SeIncreaseQuotaPrivilege	3724	powershell.exe
Token: SeSecurityPrivilege	3724	powershell.exe
Token: SeTakeOwnershipPrivilege	3724	powershell.exe
Token: SeLoadDriverPrivilege	3724	powershell.exe
Token: SeSystemProfilePrivilege	3724	powershell.exe
Token: SeSystemtimePrivilege	3724	powershell.exe
Token: SeProfSingleProcessPrivilege	3724	powershell.exe
Token: SeIncBasePriorityPrivilege	3724	powershell.exe
Token: SeCreatePagefilePrivilege	3724	powershell.exe
Token: SeBackupPrivilege	3724	powershell.exe
Token: SeRestorePrivilege	3724	powershell.exe
Token: SeShutdownPrivilege	3724	powershell.exe
Token: SeDebugPrivilege	3724	powershell.exe
Token: SeSystemEnvironmentPrivilege	3724	powershell.exe
Token: SeRemoteShutdownPrivilege	3724	powershell.exe
Token: SeUndockPrivilege	3724	powershell.exe
Token: SeManageVolumePrivilege	3724	powershell.exe
Token: 33	3724	powershell.exe
Token: 34	3724	powershell.exe
Token: 35	3724	powershell.exe
Token: 36	3724	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeIncreaseQuotaPrivilege	2900	powershell.exe
Token: SeSecurityPrivilege	2900	powershell.exe
Token: SeTakeOwnershipPrivilege	2900	powershell.exe
Token: SeLoadDriverPrivilege	2900	powershell.exe
Token: SeSystemProfilePrivilege	2900	powershell.exe
Token: SeSystemtimePrivilege	2900	powershell.exe
Token: SeProfSingleProcessPrivilege	2900	powershell.exe
Token: SeIncBasePriorityPrivilege	2900	powershell.exe
Token: SeCreatePagefilePrivilege	2900	powershell.exe
Token: SeBackupPrivilege	2900	powershell.exe
Token: SeRestorePrivilege	2900	powershell.exe
Token: SeShutdownPrivilege	2900	powershell.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeSystemEnvironmentPrivilege	2900	powershell.exe
Token: SeRemoteShutdownPrivilege	2900	powershell.exe
Token: SeUndockPrivilege	2900	powershell.exe
Token: SeManageVolumePrivilege	2900	powershell.exe
Token: 33	2900	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 404	4676	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 404 wrote to memory of 2924	404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	91
PID 2924 wrote to memory of 4400	2924	cmd.exe	93
PID 404 wrote to memory of 3352	404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	95
PID 3352 wrote to memory of 3724	3352	cmd.exe	97
PID 404 wrote to memory of 2976	404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	98
PID 2976 wrote to memory of 2900	2976	cmd.exe	100
PID 404 wrote to memory of 5848	404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	101
PID 5848 wrote to memory of 6064	5848	cmd.exe	103
PID 404 wrote to memory of 2120	404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	104
PID 2120 wrote to memory of 1604	2120	cmd.exe	106
PID 404 wrote to memory of 5588	404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	107
PID 5588 wrote to memory of 2972	5588	cmd.exe	109
PID 404 wrote to memory of 4164	404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	110
PID 4164 wrote to memory of 4640	4164	cmd.exe	112
PID 404 wrote to memory of 5116	404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	113
PID 5116 wrote to memory of 2912	5116	cmd.exe	115
PID 404 wrote to memory of 5484	404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	116
PID 5484 wrote to memory of 4852	5484	cmd.exe	118
PID 404 wrote to memory of 2676	404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	119
PID 2676 wrote to memory of 4720	2676	cmd.exe	121
PID 404 wrote to memory of 3248	404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	123
PID 3248 wrote to memory of 1844	3248	cmd.exe	125
PID 404 wrote to memory of 3284	404	2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	126
PID 3284 wrote to memory of 4972	3284	cmd.exe	128

C:\Users\Admin\AppData\Local\Temp\2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Users\Admin\AppData\Local\Temp\2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-10_164a1f7b8fb7c804dc5bdaf55ddb6217_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\xunikaq'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\xunikaq'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:6064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5484
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4720
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact