4e396c767bf32a15d0169ce4e95809122bf0a60394e169eaaaa24ac9eaa9fd02

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_18c8dcced5b0562fea9f8e9c6c89c70c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 11.6MB
Sample260708-sqs2fahs8t
SHA256 4e396c767bf32a15d0169ce4e95809122bf0a60394e169eaaaa24ac9eaa9fd02
MD5 18c8dcced5b0562fea9f8e9c6c89c70c
SHA1 643ea2633cea27f508fe63fa3c2625f84c3ab0cc
SHA512 4f2d1d02897eabe7529c9203d8f52c695b151e5c8e6a37c18ae3591dec42e80ff2b41351e49e2a9bb43b34eb7dfa6253f5aabba918e5b5a7e5a2a4ba017cb06e
SSDEEP 196608:Gk6MotI9/ew+KjwuCBUGi5Pnwbe5fnGCxdGjP5Ui2bjKVPy2wE/HjEQOwuCFpAX:XCtaa5uCBU75fwbQfnGCnGjKi2bjRo/Y
TLSH
T12AC633D0F8E109DAE5B30A39CC82A131E259FD362F51DADF63A295552E279F16C3CB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence pyinstaller

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2068	ClientLicenseServiceHelper.exe
824	ClientLicenseServiceHelper.exe

Loads dropped DLL 14 IoCs

pid	Process
3036	2026-07-08_18c8dcced5b0562fea9f8e9c6c89c70c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3036	2026-07-08_18c8dcced5b0562fea9f8e9c6c89c70c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3036	2026-07-08_18c8dcced5b0562fea9f8e9c6c89c70c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3036	2026-07-08_18c8dcced5b0562fea9f8e9c6c89c70c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3036	2026-07-08_18c8dcced5b0562fea9f8e9c6c89c70c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3036	2026-07-08_18c8dcced5b0562fea9f8e9c6c89c70c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
3036	2026-07-08_18c8dcced5b0562fea9f8e9c6c89c70c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
824	ClientLicenseServiceHelper.exe
824	ClientLicenseServiceHelper.exe
824	ClientLicenseServiceHelper.exe
824	ClientLicenseServiceHelper.exe
824	ClientLicenseServiceHelper.exe
824	ClientLicenseServiceHelper.exe
824	ClientLicenseServiceHelper.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsLicenseManager = "C:\\Users\\Admin\\AppData\\Local\\wsappsx\\ClientLicenseServiceHelper.exe"	2026-07-08_18c8dcced5b0562fea9f8e9c6c89c70c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsLicenseManager = "C:\\Users\\Admin\\AppData\\Local\\wsappsx\\ClientLicenseServiceHelper.exe"	ClientLicenseServiceHelper.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000c00000001c5ac-71.dat	pyinstaller

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 3036	1884	2026-07-08_18c8dcced5b0562fea9f8e9c6c89c70c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	88
PID 2068 wrote to memory of 824	2068	ClientLicenseServiceHelper.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-08_18c8dcced5b0562fea9f8e9c6c89c70c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_18c8dcced5b0562fea9f8e9c6c89c70c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\2026-07-08_18c8dcced5b0562fea9f8e9c6c89c70c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-08_18c8dcced5b0562fea9f8e9c6c89c70c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  PID:3036

C:\Users\Admin\AppData\Local\wsappsx\ClientLicenseServiceHelper.exe
C:\Users\Admin\AppData\Local\wsappsx\ClientLicenseServiceHelper.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Users\Admin\AppData\Local\wsappsx\ClientLicenseServiceHelper.exe
  C:\Users\Admin\AppData\Local\wsappsx\ClientLicenseServiceHelper.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18842\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18842\_bz2.pyd
Size 84KB
SHA256 76a33e2baa3880aa46290cc7d5810b3155c5e2f5a1cc7d3f7b751f6434144ada
MD5 cf64abae18a5ce2c95b8e894fa5cfdc3
SHA1 76d87bef339e31af803a1a930b33a3e5dbc1c0cf
SHA512 7c4787b7cda291f49ce1bf9e1716ec5d50ae42a84425136c75c155c6fddbea00bc2900c6779f88f8d4cc47c0ed61f5f6c1caa433e660f0b8e5cb78e449ef35cf
SSDEEP 1536:NeFNPz7faNtxDCkrp43zOB2YHClj9l8sEsHiuP5IFLVAy1Ni9lfIL0qAO:4FVzzaww2DOsl9KsXCK5IFLV9dAO
TLSH
T1A4836D43B77461F6F9AF81B496810353F730BE960710A3AFB25482993F13B91EE68359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18842\_ctypes.pyd
Size 131KB
SHA256 75687620596877b0dde462e74ae12140d695b3c78df3c6c099d55717768dde42
MD5 744a8886e7187cb632da61e2d48ebafa
SHA1 e105fe498617813f2d34e578d48b82e23e56a972
SHA512 a362fc3eee1a7f71d9b82dc3b6b268e1d3115d20733b40e3891ab04469f9f8fbb1f6ee07d6a92a78cba82c7c53101bfde13c99f9a3feffa5430b94791ecae30c
SSDEEP 3072:/uZHKSoKYGYzZkdf/F2zy4PK8fUSlIFyPAT0:moZAf/F2zyIK+USC0
TLSH
T10DD37D0B736800AADAA79178C533AF47EFB1B453161057CF02A4C59A2F63B926E7F705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI18842\_lzma.pyd
Size 155KB
SHA256 f221ed5f1c2789aa357f3c2dc4cd22af134b4b91acb3fb78f9fa5f7f9a7b62e4
MD5 a6bd469ef44eb08284a417fd5aaa4096
SHA1 ca65c9e0ee9bfdd3e8abbe46eb78b6bba1d657a4
SHA512 85198fbfcf517a3da03e897333dc5af4deb3c8eceee61e172a3effe7e6f79de9c76e029049bd727aa782ac018feebcabef73804df9270c49a1b6e411f149cd59
SSDEEP 3072:vK1fxTOfpRnifp5/eNRFAznf59mNomURj5IF01SL5E:v6JTOjKsHWhYOXjQFE
TLSH
T17CF35B86B794F0E5F3328C38D6624F57E6F5795A0320929E01CC936D2B1FB659A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI18842\base_library.zip
Size 1.3MB
SHA256 f2a68acd856b57804474f533d00f589e8a0a3ef35d4132c3515a2765e03df1f3
MD5 e5512c4c5dddbf63460d222154ec4aa2
SHA1 4e371c947623841184affa76e64424199558d4aa
SHA512 5a1811bc291c53d30efc8a5c433b08eb9cdf6ce16f366fd4230d7a300a5742e49bb44ac1b47519cb4ec895a3c8c8766c9293dca79c334501b794bc1e67345ec6
SSDEEP 12288:lY++djdT6tYzGN8TxswsEruIva80201jwCVRDVoioSYo5CL+DN66W7WpZi2cPPdt:gdZbSuTxswnB7WpZ5cPPdxhYI3wpv3S
TLSH
T132651982B9527953FF54F37B80B7484CF31E86A2EF00C207255E466A1FFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18842\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18842\python313.dll
Size 5.8MB
SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
MD5 b0f3aa8a9fc7462f25b1f48f3174dfa5
SHA1 63243edfcf789b5fb9370e5baa27e9a07ba3ebaa
SHA512 07b83bd20ff501f4753273684e4e539a5722dd0eb2689c045665da12e5a1b0950c70ba9c8e4dd99be72057b9311ed4199b643639b8f49f1cba8c41c8c29bc57e
SSDEEP 49152:kYxOb4yPiEMqTGnJwYE2M8SMW+IC1f37M2nGyN7yd5va4ifhSBqVX0Yy13KR/x1n:gPzKWIHosdoBcqbei8I0CSvNHDMiEnsj
TLSH
T15D567C16729E40ACD97B8078CA17864BFBB27C013E60534B61E6BB5D2FB3362476E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI18842\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ClientLicenseServiceHelper.exe

Path C:\Users\Admin\AppData\Local\wsappsx\ClientLicenseServiceHelper.exe
Size 11.6MB
SHA256 4e396c767bf32a15d0169ce4e95809122bf0a60394e169eaaaa24ac9eaa9fd02
MD5 18c8dcced5b0562fea9f8e9c6c89c70c
SHA1 643ea2633cea27f508fe63fa3c2625f84c3ab0cc
SHA512 4f2d1d02897eabe7529c9203d8f52c695b151e5c8e6a37c18ae3591dec42e80ff2b41351e49e2a9bb43b34eb7dfa6253f5aabba918e5b5a7e5a2a4ba017cb06e
SSDEEP 196608:Gk6MotI9/ew+KjwuCBUGi5Pnwbe5fnGCxdGjP5Ui2bjKVPy2wE/HjEQOwuCFpAX:XCtaa5uCBU75fwbQfnGCnGjKi2bjRo/Y
TLSH
T12AC633D0F8E109DAE5B30A39CC82A131E259FD362F51DADF63A295552E279F16C3CB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads