9f0d1b4de6f8d4ecc17a6b5d7ee3db0b63929a26a94b5df4331110d5961a72dc

Analysis

max time kernel
149s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/04/2026, 07:46

Target
2026-04-19_bf1bebe28cb54f2341feaac24a2d8131_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 5.3MB
Sample260419-jmdynsbs3x
SHA256 9f0d1b4de6f8d4ecc17a6b5d7ee3db0b63929a26a94b5df4331110d5961a72dc
MD5 bf1bebe28cb54f2341feaac24a2d8131
SHA1 c32ea72960271da8c05de70f14f854ca77e4dc0e
SHA512 3773f9bc311b551a838e9d515d2e2f47cded80496a9dfbc15c45726dbb8f1807efe3782a38e3c227469314f4d0714b44ec581151ff1d095a8ae0f00dab2e23a8
SSDEEP 49152:nlDrshnM1N9W48999999FI399+F7GJ+596ApYH8ZaJlwsOFkUFAI08KNE9b43OkH:lDal999999Fb9byJ5E9Viz5iMTls0d
TLSH
T1DF466C59B3EA00D6C576C0B4CD569222E371B45803E24EDBB2A417FD6E37AE07E39724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 4816	1784	2026-04-19_bf1bebe28cb54f2341feaac24a2d8131_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	86
PID 4816 wrote to memory of 2036	4816	cmd.exe	87
PID 1784 wrote to memory of 5068	1784	2026-04-19_bf1bebe28cb54f2341feaac24a2d8131_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-04-19_bf1bebe28cb54f2341feaac24a2d8131_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_bf1bebe28cb54f2341feaac24a2d8131_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c chcp 65001
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:5068