Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/07/2026, 15:00
General
- Target 2026-07-17_9fd2e9a6bfd0aab7f61ed045d376b163_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 21.8MB
- Sample260717-sdn7qady8m
- SHA256 3823a959a2c62bac027362155b5f51bee205e803ee95f674cc79236043fd0c59
Malware Config
Signatures
- Loads dropped DLL 10 IoCs
- UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_9fd2e9a6bfd0aab7f61ed045d376b163_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_9fd2e9a6bfd0aab7f61ed045d376b163_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_9fd2e9a6bfd0aab7f61ed045d376b163_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_9fd2e9a6bfd0aab7f61ed045d376b163_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
python314.dll
ucrtbase.dll
memory/1620-125-0x00007FFEACE40000-0x00007FFEACE6C000-memory.dmp
memory/1620-134-0x00007FFE997E0000-0x00007FFE99D11000-memory.dmp
memory/1620-124-0x00007FFEB09F0000-0x00007FFEB0A0A000-memory.dmp
memory/1620-128-0x00007FFEAC710000-0x00007FFEAC790000-memory.dmp
memory/1620-117-0x00007FFEB2380000-0x00007FFEB23A9000-memory.dmp
memory/1620-132-0x00007FFEB09D0000-0x00007FFEB09E4000-memory.dmp
memory/1620-111-0x00007FFE99D20000-0x00007FFE9A426000-memory.dmp
memory/1620-119-0x00007FFEB0A10000-0x00007FFEB0A1F000-memory.dmp
memory/1620-141-0x00007FFEB09D0000-0x00007FFEB09E4000-memory.dmp
memory/1620-143-0x00007FFE99D20000-0x00007FFE9A426000-memory.dmp
memory/1620-144-0x00007FFE997E0000-0x00007FFE99D11000-memory.dmp
memory/1620-140-0x00007FFEAC710000-0x00007FFEAC790000-memory.dmp
memory/1620-139-0x00007FFEACE40000-0x00007FFEACE6C000-memory.dmp
memory/1620-138-0x00007FFEB09F0000-0x00007FFEB0A0A000-memory.dmp
memory/1620-137-0x00007FFEB0A10000-0x00007FFEB0A1F000-memory.dmp
memory/1620-136-0x00007FFEB2380000-0x00007FFEB23A9000-memory.dmp