9b4aae3aa40c356b3ffdea2ad694da6e72c6d9efba317c8891a83e953ccb8cef

Analysis

max time kernel
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Size 13.6MB
Sample260820-s2ctlazfnh
SHA256 9b4aae3aa40c356b3ffdea2ad694da6e72c6d9efba317c8891a83e953ccb8cef
MD5 4afceb77ed5811758f00785a4e851f0b
SHA1 38ac2d02dac760a3ea9185eccd25d9b9c84da7c2
SHA512 75bf220efc1cfc87003db41825c2751e4fb76dd6d2c8dd09fb58458a38916fc6b22bf9abae22bc90e6f35fa899c89eb4fe0e840c9daff457e5e7fe39c8d3dd44
SSDEEP 393216:dGm7UodlYKUirHkFm8Nf7iXMCHWUjwcuI3/PGTAI:dGeUKlYPirHkFm8NeXMb8lH/O7
TLSH
T150E633185BC511EEE9A3D17CD6D19E59DA7078AB1B30C9EB0BA847A26E031F08C3D717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
300	powershell.exe
3592	powershell.exe
5656	powershell.exe
2056	powershell.exe
4744	powershell.exe
5992	powershell.exe
1532	powershell.exe
4104	powershell.exe
2172	powershell.exe
3416	powershell.exe
3340	powershell.exe
3404	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4628	cmd.exe
4108	cmd.exe
6048	cmd.exe
6024	cmd.exe
5660	cmd.exe
5584	cmd.exe
4620	cmd.exe
4944	cmd.exe
3236	cmd.exe
4536	cmd.exe
4436	cmd.exe
2924	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
5992	powershell.exe
5992	powershell.exe
1532	powershell.exe
1532	powershell.exe
1532	powershell.exe
4104	powershell.exe
4104	powershell.exe
4104	powershell.exe
2172	powershell.exe
2172	powershell.exe
2172	powershell.exe
3416	powershell.exe
3416	powershell.exe
3416	powershell.exe
3592	powershell.exe
3592	powershell.exe
3592	powershell.exe
3340	powershell.exe
3340	powershell.exe
3340	powershell.exe
3404	powershell.exe
3404	powershell.exe
3404	powershell.exe
5656	powershell.exe
5656	powershell.exe
5656	powershell.exe
300	powershell.exe
300	powershell.exe
300	powershell.exe
2056	powershell.exe
2056	powershell.exe
2056	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
Token: SeDebugPrivilege	5992	powershell.exe
Token: SeIncreaseQuotaPrivilege	5992	powershell.exe
Token: SeSecurityPrivilege	5992	powershell.exe
Token: SeTakeOwnershipPrivilege	5992	powershell.exe
Token: SeLoadDriverPrivilege	5992	powershell.exe
Token: SeSystemProfilePrivilege	5992	powershell.exe
Token: SeSystemtimePrivilege	5992	powershell.exe
Token: SeProfSingleProcessPrivilege	5992	powershell.exe
Token: SeIncBasePriorityPrivilege	5992	powershell.exe
Token: SeCreatePagefilePrivilege	5992	powershell.exe
Token: SeBackupPrivilege	5992	powershell.exe
Token: SeRestorePrivilege	5992	powershell.exe
Token: SeShutdownPrivilege	5992	powershell.exe
Token: SeDebugPrivilege	5992	powershell.exe
Token: SeSystemEnvironmentPrivilege	5992	powershell.exe
Token: SeRemoteShutdownPrivilege	5992	powershell.exe
Token: SeUndockPrivilege	5992	powershell.exe
Token: SeManageVolumePrivilege	5992	powershell.exe
Token: 33	5992	powershell.exe
Token: 34	5992	powershell.exe
Token: 35	5992	powershell.exe
Token: 36	5992	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeIncreaseQuotaPrivilege	1532	powershell.exe
Token: SeSecurityPrivilege	1532	powershell.exe
Token: SeTakeOwnershipPrivilege	1532	powershell.exe
Token: SeLoadDriverPrivilege	1532	powershell.exe
Token: SeSystemProfilePrivilege	1532	powershell.exe
Token: SeSystemtimePrivilege	1532	powershell.exe
Token: SeProfSingleProcessPrivilege	1532	powershell.exe
Token: SeIncBasePriorityPrivilege	1532	powershell.exe
Token: SeCreatePagefilePrivilege	1532	powershell.exe
Token: SeBackupPrivilege	1532	powershell.exe
Token: SeRestorePrivilege	1532	powershell.exe
Token: SeShutdownPrivilege	1532	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe
Token: SeSystemEnvironmentPrivilege	1532	powershell.exe
Token: SeRemoteShutdownPrivilege	1532	powershell.exe
Token: SeUndockPrivilege	1532	powershell.exe
Token: SeManageVolumePrivilege	1532	powershell.exe
Token: 33	1532	powershell.exe
Token: 34	1532	powershell.exe
Token: 35	1532	powershell.exe
Token: 36	1532	powershell.exe
Token: SeDebugPrivilege	4104	powershell.exe
Token: SeIncreaseQuotaPrivilege	4104	powershell.exe
Token: SeSecurityPrivilege	4104	powershell.exe
Token: SeTakeOwnershipPrivilege	4104	powershell.exe
Token: SeLoadDriverPrivilege	4104	powershell.exe
Token: SeSystemProfilePrivilege	4104	powershell.exe
Token: SeSystemtimePrivilege	4104	powershell.exe
Token: SeProfSingleProcessPrivilege	4104	powershell.exe
Token: SeIncBasePriorityPrivilege	4104	powershell.exe
Token: SeCreatePagefilePrivilege	4104	powershell.exe
Token: SeBackupPrivilege	4104	powershell.exe
Token: SeRestorePrivilege	4104	powershell.exe
Token: SeShutdownPrivilege	4104	powershell.exe
Token: SeDebugPrivilege	4104	powershell.exe
Token: SeSystemEnvironmentPrivilege	4104	powershell.exe
Token: SeRemoteShutdownPrivilege	4104	powershell.exe
Token: SeUndockPrivilege	4104	powershell.exe
Token: SeManageVolumePrivilege	4104	powershell.exe
Token: 33	4104	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 3844	6124	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	89
PID 3844 wrote to memory of 5584	3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	90
PID 5584 wrote to memory of 5992	5584	cmd.exe	92
PID 3844 wrote to memory of 2924	3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	94
PID 2924 wrote to memory of 1532	2924	cmd.exe	96
PID 3844 wrote to memory of 4620	3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	97
PID 4620 wrote to memory of 4104	4620	cmd.exe	99
PID 3844 wrote to memory of 4628	3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	100
PID 4628 wrote to memory of 2172	4628	cmd.exe	102
PID 3844 wrote to memory of 4108	3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	103
PID 4108 wrote to memory of 3416	4108	cmd.exe	105
PID 3844 wrote to memory of 6048	3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	106
PID 6048 wrote to memory of 3592	6048	cmd.exe	108
PID 3844 wrote to memory of 6024	3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	109
PID 6024 wrote to memory of 3340	6024	cmd.exe	111
PID 3844 wrote to memory of 4944	3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	112
PID 4944 wrote to memory of 3404	4944	cmd.exe	114
PID 3844 wrote to memory of 5660	3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	115
PID 5660 wrote to memory of 5656	5660	cmd.exe	117
PID 3844 wrote to memory of 3236	3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	118
PID 3236 wrote to memory of 300	3236	cmd.exe	120
PID 3844 wrote to memory of 4536	3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	121
PID 4536 wrote to memory of 2056	4536	cmd.exe	123
PID 3844 wrote to memory of 4436	3844	2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe	124
PID 4436 wrote to memory of 4744	4436	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Users\Admin\AppData\Local\Temp\2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-20_4afceb77ed5811758f00785a4e851f0b_blankgrabber_glassworm_icedid_luca-stealer_njrat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5584
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\jilusol'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\jilusol'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6024
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:300
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact