36949ef5549bd8fc7b223933fac780475db87e66144f9a404fa70061e4a2916d

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260810-ya4e5aab63
SHA256 36949ef5549bd8fc7b223933fac780475db87e66144f9a404fa70061e4a2916d
MD5 d56a844710acf7ea3634f90aa5ef4d49
SHA1 74ff6429b527c1f028dd8cd11f35b9a499085d44
SHA512 d70981161487caa6cf6afd2cab694bdca9cac7a1e8b2196a289e9da9ce6ddb315aba36029316ef7d863417ae0c2e1189373e7b45acb67e647ea2ac1e31a5c269
SSDEEP 393216:HGmZHJMyUl+szQ1VCTaNnXMCHWUjecuI3/PGTAI:HGQCV+gQLJnXMb8TH/O7
TLSH
T14BE63388BAD411AEED6312BCC9D10512FBB5B8BE4730C4EB47FC57656D632A10C3A729
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2688	powershell.exe
1920	powershell.exe
5020	powershell.exe
5352	powershell.exe
1060	powershell.exe
1360	powershell.exe
2600	powershell.exe
252	powershell.exe
124	powershell.exe
1932	powershell.exe
4128	powershell.exe
5164	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4188	cmd.exe
1952	cmd.exe
988	cmd.exe
5928	cmd.exe
5524	cmd.exe
5656	cmd.exe
4468	cmd.exe
948	cmd.exe
2712	cmd.exe
4328	cmd.exe
3440	cmd.exe
3764	cmd.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
124	powershell.exe
124	powershell.exe
1932	powershell.exe
1932	powershell.exe
4128	powershell.exe
4128	powershell.exe
5164	powershell.exe
5164	powershell.exe
5164	powershell.exe
1060	powershell.exe
1060	powershell.exe
1360	powershell.exe
1360	powershell.exe
2688	powershell.exe
2688	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
5020	powershell.exe
5020	powershell.exe
5020	powershell.exe
5352	powershell.exe
5352	powershell.exe
5352	powershell.exe
2600	powershell.exe
2600	powershell.exe
2600	powershell.exe
252	powershell.exe
252	powershell.exe
252	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	124	powershell.exe
Token: SeIncreaseQuotaPrivilege	124	powershell.exe
Token: SeSecurityPrivilege	124	powershell.exe
Token: SeTakeOwnershipPrivilege	124	powershell.exe
Token: SeLoadDriverPrivilege	124	powershell.exe
Token: SeSystemProfilePrivilege	124	powershell.exe
Token: SeSystemtimePrivilege	124	powershell.exe
Token: SeProfSingleProcessPrivilege	124	powershell.exe
Token: SeIncBasePriorityPrivilege	124	powershell.exe
Token: SeCreatePagefilePrivilege	124	powershell.exe
Token: SeBackupPrivilege	124	powershell.exe
Token: SeRestorePrivilege	124	powershell.exe
Token: SeShutdownPrivilege	124	powershell.exe
Token: SeDebugPrivilege	124	powershell.exe
Token: SeSystemEnvironmentPrivilege	124	powershell.exe
Token: SeRemoteShutdownPrivilege	124	powershell.exe
Token: SeUndockPrivilege	124	powershell.exe
Token: SeManageVolumePrivilege	124	powershell.exe
Token: 33	124	powershell.exe
Token: 34	124	powershell.exe
Token: 35	124	powershell.exe
Token: 36	124	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeIncreaseQuotaPrivilege	1932	powershell.exe
Token: SeSecurityPrivilege	1932	powershell.exe
Token: SeTakeOwnershipPrivilege	1932	powershell.exe
Token: SeLoadDriverPrivilege	1932	powershell.exe
Token: SeSystemProfilePrivilege	1932	powershell.exe
Token: SeSystemtimePrivilege	1932	powershell.exe
Token: SeProfSingleProcessPrivilege	1932	powershell.exe
Token: SeIncBasePriorityPrivilege	1932	powershell.exe
Token: SeCreatePagefilePrivilege	1932	powershell.exe
Token: SeBackupPrivilege	1932	powershell.exe
Token: SeRestorePrivilege	1932	powershell.exe
Token: SeShutdownPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeSystemEnvironmentPrivilege	1932	powershell.exe
Token: SeRemoteShutdownPrivilege	1932	powershell.exe
Token: SeUndockPrivilege	1932	powershell.exe
Token: SeManageVolumePrivilege	1932	powershell.exe
Token: 33	1932	powershell.exe
Token: 34	1932	powershell.exe
Token: 35	1932	powershell.exe
Token: 36	1932	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeIncreaseQuotaPrivilege	4128	powershell.exe
Token: SeSecurityPrivilege	4128	powershell.exe
Token: SeTakeOwnershipPrivilege	4128	powershell.exe
Token: SeLoadDriverPrivilege	4128	powershell.exe
Token: SeSystemProfilePrivilege	4128	powershell.exe
Token: SeSystemtimePrivilege	4128	powershell.exe
Token: SeProfSingleProcessPrivilege	4128	powershell.exe
Token: SeIncBasePriorityPrivilege	4128	powershell.exe
Token: SeCreatePagefilePrivilege	4128	powershell.exe
Token: SeBackupPrivilege	4128	powershell.exe
Token: SeRestorePrivilege	4128	powershell.exe
Token: SeShutdownPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeSystemEnvironmentPrivilege	4128	powershell.exe
Token: SeRemoteShutdownPrivilege	4128	powershell.exe
Token: SeUndockPrivilege	4128	powershell.exe
Token: SeManageVolumePrivilege	4128	powershell.exe
Token: 33	4128	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 4740	3328	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 4740 wrote to memory of 5656	4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 5656 wrote to memory of 124	5656	cmd.exe	92
PID 4740 wrote to memory of 3764	4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 3764 wrote to memory of 1932	3764	cmd.exe	96
PID 4740 wrote to memory of 4188	4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 4188 wrote to memory of 4128	4188	cmd.exe	99
PID 4740 wrote to memory of 4468	4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 4468 wrote to memory of 5164	4468	cmd.exe	102
PID 4740 wrote to memory of 948	4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 948 wrote to memory of 1060	948	cmd.exe	105
PID 4740 wrote to memory of 1952	4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 1952 wrote to memory of 1360	1952	cmd.exe	108
PID 4740 wrote to memory of 2712	4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 2712 wrote to memory of 2688	2712	cmd.exe	111
PID 4740 wrote to memory of 4328	4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 4328 wrote to memory of 1920	4328	cmd.exe	114
PID 4740 wrote to memory of 988	4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 988 wrote to memory of 5020	988	cmd.exe	117
PID 4740 wrote to memory of 5928	4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 5928 wrote to memory of 5352	5928	cmd.exe	120
PID 4740 wrote to memory of 5524	4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 5524 wrote to memory of 2600	5524	cmd.exe	123
PID 4740 wrote to memory of 3440	4740	2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	124
PID 3440 wrote to memory of 252	3440	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Users\Admin\AppData\Local\Temp\2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-10_d56a844710acf7ea3634f90aa5ef4d49_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\xunikaq'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3764
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\xunikaq'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4188
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5928
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact