Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/07/2026, 03:08

General

  • Target
    2026-07-03_4699fe0747bc56e89c0c45e84615fce1_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 120.0MB
  • Sample260703-dndfmsay2w
  • SHA256 80ce14058b847e53fa19f8958824dceb821b214ebd85e054f2710e98f6ae3f45
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-03_4699fe0747bc56e89c0c45e84615fce1_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-03_4699fe0747bc56e89c0c45e84615fce1_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Users\Admin\AppData\Local\Temp\2026-07-03_4699fe0747bc56e89c0c45e84615fce1_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-03_4699fe0747bc56e89c0c45e84615fce1_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5692
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:2928
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x00000000000004D8
      1⤵
        PID:3148

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            VCRUNTIME140.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\VCRUNTIME140.dll
            • Size 116KB
            • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
            • MD5 SHA1 SHA512 SSDEEP TLSH

            _bz2.pyd

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\_bz2.pyd
            • Size 82KB
            • SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
            • MD5 SHA1 SHA512 SSDEEP TLSH

            _ctypes.pyd

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\_ctypes.pyd
            • Size 121KB
            • SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
            • MD5 SHA1 SHA512 SSDEEP TLSH

            _lzma.pyd

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\_lzma.pyd
            • Size 155KB
            • SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-console-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-console-l1-1-0.dll
            • Size 22KB
            • SHA256 4745f2d84cd3783f43759946ed61faa99b4590b8f9d3e2ef509891ea224348ce
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-datetime-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-datetime-l1-1-0.dll
            • Size 22KB
            • SHA256 33333762b0705fa862f2c69ae6700d95dd2120fdb858557f7236c8565a6f3376
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-debug-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-debug-l1-1-0.dll
            • Size 22KB
            • SHA256 bafd1ad4846317028ffb8edc6da6f05cb3905cfa6d8af8b9f9dfcd916d64f568
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-errorhandling-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-errorhandling-l1-1-0.dll
            • Size 22KB
            • SHA256 e4c1d9c242c90aff70365b49addf90f7ca81a7f774fdad7513806d4746ba1240
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-fibers-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-fibers-l1-1-0.dll
            • Size 22KB
            • SHA256 c43b6924586e222352bf4ef87fd5967cfc8108c44ac403c61e10bd58ac2d12d0
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-file-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-file-l1-1-0.dll
            • Size 26KB
            • SHA256 25785794eae17261f71ff91452bd84304e47e0c8faf93acacfa7e948cdad39f8
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-file-l1-2-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-file-l1-2-0.dll
            • Size 22KB
            • SHA256 99388fc5699811f380183653ebb4be903634ae6a1e0858fe73d6fa8bdebf6ca3
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-file-l2-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-file-l2-1-0.dll
            • Size 20KB
            • SHA256 f957a4c261506484b53534a9be8931c02ec1a349b3f431a858f8215cecfec3f7
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-handle-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-handle-l1-1-0.dll
            • Size 22KB
            • SHA256 afcf3780cfb7142a00b43b753a5491354ace8c2361fbcb966792fec48d271971
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-heap-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-heap-l1-1-0.dll
            • Size 22KB
            • SHA256 698b1ca3145740f17b09d0bb834b191826d04e2b80508563c69bd5b6418bc265
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-interlocked-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-interlocked-l1-1-0.dll
            • Size 22KB
            • SHA256 23ca56b5511cbcb93fcba8ef2f68be8944a54f712e69e29cac6852a3452f0a92
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-libraryloader-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-libraryloader-l1-1-0.dll
            • Size 22KB
            • SHA256 36645500fa7e88d5f5682f39ff8ec9eba845c376c77b87a8706a89d47ded9cf1
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-localization-l1-2-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-localization-l1-2-0.dll
            • Size 22KB
            • SHA256 1671ae25449e6f8e0efba5d6e71ca189f8b6281353d3a9e3fbf75f44a681912e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-memory-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-memory-l1-1-0.dll
            • Size 22KB
            • SHA256 2c1c0eb7d1ebc63c50c7188798229244a11ac18396afa1ace427cc5651f0156c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-namedpipe-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-namedpipe-l1-1-0.dll
            • Size 22KB
            • SHA256 a78ab5d0dad8486a17d2ee799b41b82e21a4ec8a0c16c28ff6272b5adc9ff267
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-processenvironment-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-processenvironment-l1-1-0.dll
            • Size 22KB
            • SHA256 3fc9bf9f63f8be1638b06dfe477f3134cf4a4db7b399a5910b1db381ac470389
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-processthreads-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-processthreads-l1-1-0.dll
            • Size 22KB
            • SHA256 53d06d7159faacfc684401c2e7024120a6fb2e49e495d9ba306917c04e519b92
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-processthreads-l1-1-1.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-processthreads-l1-1-1.dll
            • Size 22KB
            • SHA256 32dc2061365b39ee3967765ecc4fd53e62264e997962f9f6153e9fcd11e1b62c
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-profile-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-profile-l1-1-0.dll
            • Size 22KB
            • SHA256 4e9549166af0b097f1cd992655617420dc475491f30e9245354d7ed7023feb43
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-rtlsupport-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-rtlsupport-l1-1-0.dll
            • Size 22KB
            • SHA256 8e7e7681173377a989057731eaa971b947ab877bb82865585a48a2020f3e0991
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-string-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-string-l1-1-0.dll
            • Size 22KB
            • SHA256 15793160c84c7b39dbf7b33fa6b4c0294489ff45e084725d769ee7d07794d972
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-synch-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-synch-l1-1-0.dll
            • Size 22KB
            • SHA256 11d136d4fec342089fa8e43216f1272ca87432c7658a01fb85b219c5327b74a6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-synch-l1-2-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-synch-l1-2-0.dll
            • Size 22KB
            • SHA256 f80455cc6bbd29c2c735d74b6740c6977c536508c3466dc2b535401e8e6142f4
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-sysinfo-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-sysinfo-l1-1-0.dll
            • Size 22KB
            • SHA256 cfdfcda8044e4e8af1c558574c0dfb6cb8eed375848897abaffb9bbd482c7925
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-timezone-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-timezone-l1-1-0.dll
            • Size 22KB
            • SHA256 d8414b7c1412d7192b9d3a786df3d977cb4bf817d4e1a7fc3a37764d42afa4a1
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-core-util-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-core-util-l1-1-0.dll
            • Size 22KB
            • SHA256 aab3485f2ddd4911d57c26dd7b29db640dc0091f203813c48f424f01d28c3308
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-crt-conio-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-crt-conio-l1-1-0.dll
            • Size 22KB
            • SHA256 f4f6d6327e19515ed1725e45bcea92d451d0ec6d14f7485b72f2393f815ec21e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-crt-convert-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-crt-convert-l1-1-0.dll
            • Size 26KB
            • SHA256 a6db9646bfe20b9bfa729bde2524a509c4a10f0b982927d2618673b61435cc4d
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-crt-environment-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-crt-environment-l1-1-0.dll
            • Size 22KB
            • SHA256 68c3235afacab672777da49158f3e5dabe5d30c677c2fa8ed0c2f09481a16d3e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-crt-filesystem-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-crt-filesystem-l1-1-0.dll
            • Size 22KB
            • SHA256 0b50842eec6e4a1098627799abb4c7410836304077ff631ce661e3b5e3c10931
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-crt-heap-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-crt-heap-l1-1-0.dll
            • Size 22KB
            • SHA256 7e0428d958b5b1ae972cd8fb174b393cd1342998e24faf98d23bc9001b1e1796
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-crt-locale-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-crt-locale-l1-1-0.dll
            • Size 22KB
            • SHA256 359c27d9a06a97d3f58ab15bd23c8aef64273623b418a8365eab8b7d98362d62
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-crt-math-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-crt-math-l1-1-0.dll
            • Size 30KB
            • SHA256 1017b3363f8796ce61ed6ee6e5645cb853d69a54f32683fc55c6cf0cbb9dde37
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-crt-multibyte-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-crt-multibyte-l1-1-0.dll
            • Size 30KB
            • SHA256 7db5aa0d8f9c1ed6cf2b5d531bee47256f66eb7576b12fa2bad561e4d2660e69
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-crt-private-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-crt-private-l1-1-0.dll
            • Size 74KB
            • SHA256 5389e5b4ff64ece5e6def8dbccef5e718e2c4461493862fe325e7fffd2ad5006
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-crt-process-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-crt-process-l1-1-0.dll
            • Size 22KB
            • SHA256 55670f0f6bdb7fd4222c7a7dfd2e383be7a48be529b2ea501f2327cc0b098ffe
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-crt-runtime-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-crt-runtime-l1-1-0.dll
            • Size 26KB
            • SHA256 8bdf3fe92340ba335488793b5e5d164b15ece06a6c361ccab7ac4a1bf6b06ff9
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-crt-stdio-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-crt-stdio-l1-1-0.dll
            • Size 26KB
            • SHA256 e52fc89df7c449ba61f30d859efea9e8c04edf0078dde6c5e41394a7487f5404
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-crt-string-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-crt-string-l1-1-0.dll
            • Size 26KB
            • SHA256 78477022e8f130912e2a8767be8fddb3963c429e9c67abd2f50cfdfae0ce5048
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-crt-time-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-crt-time-l1-1-0.dll
            • Size 22KB
            • SHA256 d39c5aea2f04a6eaa7ec84ad9c9162fd64a1545bcc41121368594f8a1db07550
            • MD5 SHA1 SHA512 SSDEEP TLSH

            api-ms-win-crt-utility-l1-1-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\api-ms-win-crt-utility-l1-1-0.dll
            • Size 22KB
            • SHA256 50966bb41ffc5c112bdf4e9717fbabd194f1843a84488dc229a71d3365ff45dd
            • MD5 SHA1 SHA512 SSDEEP TLSH

            base_library.zip

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\base_library.zip
            • Size 1.4MB
            • SHA256 c4ad1138057c9a8597f9dc9bad8135310d08fea5228d3ebd2d8af358064e3d65
            • MD5 SHA1 SHA512 SSDEEP TLSH

            freetype.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\freetype.dll
            • Size 639KB
            • SHA256 1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f
            • MD5 SHA1 SHA512 SSDEEP TLSH

            libcrypto-3.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\libcrypto-3.dll
            • Size 5.0MB
            • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
            • MD5 SHA1 SHA512 SSDEEP TLSH

            libffi-8.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH

            libjpeg-9.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\libjpeg-9.dll
            • Size 238KB
            • SHA256 3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
            • MD5 SHA1 SHA512 SSDEEP TLSH

            libmodplug-1.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\libmodplug-1.dll
            • Size 259KB
            • SHA256 0c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e
            • MD5 SHA1 SHA512 SSDEEP TLSH

            libogg-0.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\libogg-0.dll
            • Size 25KB
            • SHA256 57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe
            • MD5 SHA1 SHA512 SSDEEP TLSH

            python3.DLL

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\python3.DLL
            • Size 65KB
            • SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
            • MD5 SHA1 SHA512 SSDEEP TLSH

            python311.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\python311.dll
            • Size 5.5MB
            • SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
            • MD5 SHA1 SHA512 SSDEEP TLSH

            ucrtbase.dll

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\ucrtbase.dll
            • Size 1.1MB
            • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
            • MD5 SHA1 SHA512 SSDEEP TLSH

            INSTALLER

            • Path C:\Users\Admin\AppData\Local\Temp\_MEI10362\wheel-0.45.1.dist-info\INSTALLER
            • Size 4B
            • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
            • MD5 SHA1 SHA512

            memory/5692-1421-0x000002706F470000-0x000002706F491000-memory.dmp

            memory/5692-1420-0x000002706F450000-0x000002706F45F000-memory.dmp

            memory/5692-1419-0x000002706F470000-0x000002706F491000-memory.dmp

            memory/5692-1418-0x000002706F450000-0x000002706F45F000-memory.dmp

            memory/5692-1411-0x00007FFE12EC0000-0x00007FFE13123000-memory.dmp