Analysis
- max time kernel
57s - max time network
120s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 02:43
General
- Target 2026-07-06_7e26dc0e8a03da3fcac7956577eccf71_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 8.1MB
- Sample260707-c71vlsgt5x
- SHA256 614d235c49f256333d468b7bf2471d481b730387b0d9366a8ad3378eda7384c5
Malware Config
Signatures
- Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
- Possible privilege escalation attempt 4 IoCs
- Loads dropped DLL 7 IoCs
- Modifies file permissions 1 TTPs 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Delays execution with timeout.exe 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_7e26dc0e8a03da3fcac7956577eccf71_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_7e26dc0e8a03da3fcac7956577eccf71_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_7e26dc0e8a03da3fcac7956577eccf71_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_7e26dc0e8a03da3fcac7956577eccf71_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fk12_launch.cmd"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout /t 2 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\timeout.exetimeout /t 5 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\timeout.exetimeout /t 20 /nobreak4⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32 /r /d y4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32 /grant administrators:F /t4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
-
-
C:\Windows\System32\timeout.exetimeout /t 2 /nobreak1⤵
- Delays execution with timeout.exe
-
C:\Windows\System32\timeout.exetimeout /t 5 /nobreak1⤵
- Delays execution with timeout.exe
-
C:\Windows\System32\timeout.exetimeout /t 20 /nobreak1⤵
- Delays execution with timeout.exe
-
C:\Windows\System32\bcdedit.exebcdedit /set {default} recoveryenabled No1⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\System32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures1⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\System32\takeown.exetakeown /f C:\Windows\System32 /r /d y1⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\icacls.exeicacls C:\Windows\System32 /grant administrators:F /t1⤵
- Possible privilege escalation attempt
- Modifies file permissions
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_zstd.pyd
base_library.zip
libffi-8.dll
python314.dll
fk12_launch.cmd
fk12_trigger.bat
memory/5084-60-0x00007FF64E3F0000-0x00007FF64E3FF000-memory.dmp
memory/5084-65-0x00007FFD15720000-0x00007FFD157D2000-memory.dmp
memory/5084-61-0x00007FFD16560000-0x00007FFD167C3000-memory.dmp
memory/5084-63-0x00007FFD13BF0000-0x00007FFD13F91000-memory.dmp
memory/5084-62-0x00007FFD15480000-0x00007FFD15547000-memory.dmp
memory/5084-67-0x00007FFD15D20000-0x00007FFD15E36000-memory.dmp
memory/5084-69-0x00007FFD13AA0000-0x00007FFD13BEB000-memory.dmp
memory/5084-66-0x00007FFD15B90000-0x00007FFD15C37000-memory.dmp
memory/5084-68-0x00007FFD128F0000-0x00007FFD12925000-memory.dmp
memory/5084-64-0x00007FFD14540000-0x00007FFD145E9000-memory.dmp
memory/6100-45-0x00007FFD0C400000-0x00007FFD0C416000-memory.dmp
memory/6100-40-0x00007FFD0C420000-0x00007FFD0C431000-memory.dmp
memory/6100-59-0x00007FFD13050000-0x00007FFD130AF000-memory.dmp
memory/6100-55-0x00007FFD14280000-0x00007FFD143A1000-memory.dmp
memory/6100-56-0x00007FFD139F0000-0x00007FFD13A93000-memory.dmp
memory/6100-52-0x00007FFD15EC0000-0x00007FFD16083000-memory.dmp
memory/6100-54-0x00007FFD14600000-0x00007FFD1462A000-memory.dmp
memory/6100-53-0x00007FFD143B0000-0x00007FFD143D7000-memory.dmp
memory/6100-51-0x00007FFD14060000-0x00007FFD140F9000-memory.dmp
memory/6100-50-0x00007FFD131C0000-0x00007FFD131E6000-memory.dmp
memory/6100-49-0x00007FFCF84C0000-0x00007FFCF84F0000-memory.dmp
memory/6100-46-0x00007FFD15AB0000-0x00007FFD15B83000-memory.dmp
memory/6100-57-0x00007FFD158E0000-0x00007FFD1590F000-memory.dmp
memory/6100-38-0x00007FFD13BF0000-0x00007FFD13F91000-memory.dmp
memory/6100-48-0x00007FFD14100000-0x00007FFD14276000-memory.dmp
memory/6100-44-0x00007FFD15D20000-0x00007FFD15E36000-memory.dmp
memory/6100-47-0x00007FFD14870000-0x00007FFD14BEC000-memory.dmp
memory/6100-43-0x00007FFD15B90000-0x00007FFD15C37000-memory.dmp
memory/6100-42-0x00007FFD15720000-0x00007FFD157D2000-memory.dmp
memory/6100-39-0x00007FFD13AA0000-0x00007FFD13BEB000-memory.dmp
memory/6100-41-0x00007FFD14540000-0x00007FFD145E9000-memory.dmp
memory/6100-37-0x00007FFD15480000-0x00007FFD15547000-memory.dmp
memory/6100-36-0x00007FFD16560000-0x00007FFD167C3000-memory.dmp
memory/6100-58-0x00007FFD109F0000-0x00007FFD10A9D000-memory.dmp
memory/6100-94-0x00007FFD158E0000-0x00007FFD1590F000-memory.dmp
memory/6100-89-0x00007FFD15EC0000-0x00007FFD16083000-memory.dmp
memory/6100-92-0x00007FFD14280000-0x00007FFD143A1000-memory.dmp
memory/6100-85-0x00007FFD14100000-0x00007FFD14276000-memory.dmp
memory/6100-84-0x00007FFD14870000-0x00007FFD14BEC000-memory.dmp
memory/6100-81-0x00007FFD15D20000-0x00007FFD15E36000-memory.dmp
memory/6100-76-0x00007FFD13AA0000-0x00007FFD13BEB000-memory.dmp
memory/6100-75-0x00007FFD13BF0000-0x00007FFD13F91000-memory.dmp
memory/6100-96-0x00007FFD13050000-0x00007FFD130AF000-memory.dmp
memory/6100-95-0x00007FFD109F0000-0x00007FFD10A9D000-memory.dmp
memory/6100-93-0x00007FFD139F0000-0x00007FFD13A93000-memory.dmp
memory/6100-91-0x00007FFD14600000-0x00007FFD1462A000-memory.dmp
memory/6100-88-0x00007FFD14060000-0x00007FFD140F9000-memory.dmp
memory/6100-87-0x00007FFD131C0000-0x00007FFD131E6000-memory.dmp
memory/6100-83-0x00007FFD15AB0000-0x00007FFD15B83000-memory.dmp
memory/6100-82-0x00007FFD0C400000-0x00007FFD0C416000-memory.dmp
memory/6100-79-0x00007FFD15720000-0x00007FFD157D2000-memory.dmp
memory/6100-78-0x00007FFD14540000-0x00007FFD145E9000-memory.dmp
memory/6100-77-0x00007FFD0C420000-0x00007FFD0C431000-memory.dmp
memory/6100-73-0x00007FFD16560000-0x00007FFD167C3000-memory.dmp
memory/6100-72-0x00007FF77FB00000-0x00007FF77FB6F000-memory.dmp
memory/6100-86-0x00007FFCF84C0000-0x00007FFCF84F0000-memory.dmp
memory/6100-80-0x00007FFD15B90000-0x00007FFD15C37000-memory.dmp