Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 17:17
General
- Target 2026-07-01_2fed50cd73934b5006355f7db86241ef_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 23.0MB
- Sample260701-vt8bmsa16k
- SHA256 fb1c054d0884a52a073f38dc148cf883f2fe06abe4c6313dbf2732d04ada1206
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 6 IoCs
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Detects Pyinstaller 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_2fed50cd73934b5006355f7db86241ef_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_2fed50cd73934b5006355f7db86241ef_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_2fed50cd73934b5006355f7db86241ef_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_2fed50cd73934b5006355f7db86241ef_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAGgAZQBsAGwAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AQwBvAG0ATwBiAGoAZQBjAHQAIABXAFMAYwByAGkAcAB0AC4AUwBoAGUAbABsADsAIAAkAGQAZQBzAGsAdABvAHAAIAA9ACAAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoARwBlAHQARgBvAGwAZABlAHIAUABhAHQAaAAoACcARABlAHMAawB0AG8AcABEAGkAcgBlAGMAdABvAHIAeQAnACkAOwAgACQAcAByAG8AZwByAGEAbQBzACAAPQAgAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEcAZQB0AEYAbwBsAGQAZQByAFAAYQB0AGgAKAAnAFAAcgBvAGcAcgBhAG0AcwAnACkAOwAgAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAZABlAHMAawB0AG8AcAApACkAIAB7ACAAdABoAHIAbwB3ACAAJwBEAGUAcwBrAHQAbwBwACAAbgBvAHQAIABmAG8AdQBuAGQAJwAgAH0AOwAgAGkAZgAgACgALQBuAG8AdAAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAEwAaQB0AGUAcgBhAGwAUABhAHQAaAAgACQAcAByAG8AZwByAGEAbQBzACkAKQAgAHsAIAB0AGgAcgBvAHcAIAAnAFMAdABhAHIAdAAgAG0AZQBuAHUAIABuAG8AdAAgAGYAbwB1AG4AZAAnACAAfQA7ACAAJABzAGgAbwByAHQAYwB1AHQAUABhAHQAaAAgAD0AIABKAG8AaQBuAC0AUABhAHQAaAAgACQAZABlAHMAawB0AG8AcAAgACcAaFRoVPSBzFt4kKGAXnloVi4AbABuAGsAJwA7ACAAJABzAHQAYQByAHQAUwBoAG8AcgB0AGMAdQB0AFAAYQB0AGgAIAA9ACAASgBvAGkAbgAtAFAAYQB0AGgAIAAkAHAAcgBvAGcAcgBhAG0AcwAgACcAaFRoVPSBzFt4kKGAXnloVi4AbABuAGsAJwA7ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAHMAaABvAHIAdABjAHUAdABQAGEAdABoACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABzAHQAYQByAHQAUwBoAG8AcgB0AGMAdQB0AFAAYQB0AGgAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAJABzAGgAbwByAHQAYwB1AHQAIAA9ACAAJABzAGgAZQBsAGwALgBDAHIAZQBhAHQAZQBTAGgAbwByAHQAYwB1AHQAKAAkAHMAaABvAHIAdABjAHUAdABQAGEAdABoACkAOwAgACQAcwBoAG8AcgB0AGMAdQB0AC4AVABhAHIAZwBlAHQAUABhAHQAaAAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABaAGgAbwB1AEEAbABwAGgAYQBcAGhUaFT0gcxbeJChgF55aFYuAGUAeABlACcAOwAgACQAcwBoAG8AcgB0AGMAdQB0AC4AVwBvAHIAawBpAG4AZwBEAGkAcgBlAGMAdABvAHIAeQAgAD0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABaAGgAbwB1AEEAbABwAGgAYQAnADsAIAAkAHMAaABvAHIAdABjAHUAdAAuAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAgAD0AIAAnAGhUaFT0gcxbeJChgF55aFYgAHYAMQAuADAALgAwAC0AUgBDACcAOwAgACQAcwBoAG8AcgB0AGMAdQB0AC4AUwBhAHYAZQAoACkAOwAgACQAcwB0AGEAcgB0AFMAaABvAHIAdABjAHUAdAAgAD0AIAAkAHMAaABlAGwAbAAuAEMAcgBlAGEAdABlAFMAaABvAHIAdABjAHUAdAAoACQAcwB0AGEAcgB0AFMAaABvAHIAdABjAHUAdABQAGEAdABoACkAOwAgACQAcwB0AGEAcgB0AFMAaABvAHIAdABjAHUAdAAuAFQAYQByAGcAZQB0AFAAYQB0AGgAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAWgBoAG8AdQBBAGwAcABoAGEAXABoVGhU9IHMW3iQoYBeeWhWLgBlAHgAZQAnADsAIAAkAHMAdABhAHIAdABTAGgAbwByAHQAYwB1AHQALgBXAG8AcgBrAGkAbgBnAEQAaQByAGUAYwB0AG8AcgB5ACAAPQAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFoAaABvAHUAQQBsAHAAaABhACcAOwAgACQAcwB0AGEAcgB0AFMAaABvAHIAdABjAHUAdAAuAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAgAD0AIAAnAGhUaFT0gcxbeJChgF55aFYgAHYAMQAuADAALgAwAC0AUgBDACcAOwAgACQAcwB0AGEAcgB0AFMAaABvAHIAdABjAHUAdAAuAFMAYQB2AGUAKAApADsAIAA=3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
base_library.zip
libffi-8.dll
README_USER.md
zhou_alpha_launcher.exe
python312.dll
memory/3732-33-0x00007FFB0A790000-0x00007FFB0B134000-memory.dmp
memory/3732-41-0x00007FFB0A790000-0x00007FFB0B134000-memory.dmp
memory/3732-34-0x00007FFB0A790000-0x00007FFB0B134000-memory.dmp
memory/3732-37-0x0000022728E40000-0x0000022728E62000-memory.dmp
memory/3732-38-0x00007FFB0A790000-0x00007FFB0B134000-memory.dmp
memory/3732-39-0x00007FFB0A790000-0x00007FFB0B134000-memory.dmp
memory/3732-40-0x00007FFB0A790000-0x00007FFB0B134000-memory.dmp
memory/3732-32-0x00007FFB0A91F000-0x00007FFB0A920000-memory.dmp
memory/3732-42-0x00007FFB0A790000-0x00007FFB0B134000-memory.dmp
memory/3732-43-0x00007FFB0A790000-0x00007FFB0B134000-memory.dmp
memory/3732-44-0x00007FFB0A790000-0x00007FFB0B134000-memory.dmp
memory/3732-45-0x00007FFB0A790000-0x00007FFB0B134000-memory.dmp
memory/3732-47-0x00007FFB0A790000-0x00007FFB0B134000-memory.dmp
memory/3732-48-0x00007FFB0A790000-0x00007FFB0B134000-memory.dmp