Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
23/07/2026, 22:09
General
- Target 2026-07-23_68a0595d0c4663f49a6eb1a89f21d140_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 9.4MB
- Sample260723-12yp3acl21
- SHA256 1eab04a4f110a296d680dbcb59ff939e71e33c9355031fd38285a3c9bb63ea7d
Malware Config
Signatures
- Drops startup file 2 IoCs
- Loads dropped DLL 15 IoCs
- UPX packed file 55 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_68a0595d0c4663f49a6eb1a89f21d140_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_68a0595d0c4663f49a6eb1a89f21d140_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_68a0595d0c4663f49a6eb1a89f21d140_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_68a0595d0c4663f49a6eb1a89f21d140_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Drops startup file
- Loads dropped DLL
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
81d243bd2c585b0f4821__mypyc.cp312-win_amd64.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python312.dll
select.pyd
Lorem ipsum.txt
unicodedata.pyd
memory/4044-84-0x00007FFD5E0F0000-0x00007FFD5E115000-memory.dmp
memory/4044-93-0x00007FFD50E90000-0x00007FFD513B9000-memory.dmp
memory/4044-71-0x00007FFD60CE0000-0x00007FFD60CEF000-memory.dmp
memory/4044-81-0x00007FFD5DD10000-0x00007FFD5DD29000-memory.dmp
memory/4044-82-0x00007FFD5DB70000-0x00007FFD5DBA3000-memory.dmp
memory/4044-83-0x00007FFD5D9F0000-0x00007FFD5DABD000-memory.dmp
memory/4044-85-0x00007FFD5E230000-0x00007FFD5E23D000-memory.dmp
memory/4044-80-0x00007FFD513C0000-0x00007FFD51A84000-memory.dmp
memory/4044-75-0x00007FFD50E90000-0x00007FFD513B9000-memory.dmp
memory/4044-73-0x00007FFD5DD40000-0x00007FFD5DD54000-memory.dmp
memory/4044-49-0x00007FFD5E0D0000-0x00007FFD5E0EA000-memory.dmp
memory/4044-44-0x00007FFD62DB0000-0x00007FFD62DBF000-memory.dmp
memory/4044-43-0x00007FFD5E0F0000-0x00007FFD5E115000-memory.dmp
memory/4044-50-0x00007FFD5DAC0000-0x00007FFD5DAED000-memory.dmp
memory/4044-37-0x00007FFD513C0000-0x00007FFD51A84000-memory.dmp
memory/4044-91-0x00007FFD60CE0000-0x00007FFD60CEF000-memory.dmp
memory/4044-92-0x00007FFD5DD40000-0x00007FFD5DD54000-memory.dmp
memory/4044-68-0x00007FFD62AD0000-0x00007FFD62ADD000-memory.dmp
memory/4044-94-0x00007FFD5DB70000-0x00007FFD5DBA3000-memory.dmp
memory/4044-95-0x00007FFD5D9F0000-0x00007FFD5DABD000-memory.dmp
memory/4044-96-0x00007FFD513C0000-0x00007FFD51A84000-memory.dmp
memory/4044-97-0x00007FFD5E0F0000-0x00007FFD5E115000-memory.dmp
memory/4044-109-0x00007FFD513C0000-0x00007FFD51A84000-memory.dmp
memory/4044-122-0x00007FFD513C0000-0x00007FFD51A84000-memory.dmp
memory/4044-135-0x00007FFD513C0000-0x00007FFD51A84000-memory.dmp
memory/4044-148-0x00007FFD513C0000-0x00007FFD51A84000-memory.dmp
memory/4044-161-0x00007FFD513C0000-0x00007FFD51A84000-memory.dmp
memory/4044-174-0x00007FFD513C0000-0x00007FFD51A84000-memory.dmp
memory/4044-187-0x00007FFD513C0000-0x00007FFD51A84000-memory.dmp
memory/4044-200-0x00007FFD513C0000-0x00007FFD51A84000-memory.dmp
memory/4044-213-0x00007FFD513C0000-0x00007FFD51A84000-memory.dmp
memory/4044-226-0x00007FFD513C0000-0x00007FFD51A84000-memory.dmp
memory/4044-239-0x00007FFD513C0000-0x00007FFD51A84000-memory.dmp
memory/4044-252-0x00007FFD513C0000-0x00007FFD51A84000-memory.dmp
memory/4044-265-0x00007FFD513C0000-0x00007FFD51A84000-memory.dmp