Analysis
- max time kernel
148s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/07/2026, 22:09
General
- Target 2026-07-23_68a0595d0c4663f49a6eb1a89f21d140_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 9.4MB
- Sample260723-12yp3acl21
- SHA256 1eab04a4f110a296d680dbcb59ff939e71e33c9355031fd38285a3c9bb63ea7d
Malware Config
Signatures
- Drops startup file 2 IoCs
- Loads dropped DLL 15 IoCs
- UPX packed file 49 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_68a0595d0c4663f49a6eb1a89f21d140_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_68a0595d0c4663f49a6eb1a89f21d140_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_68a0595d0c4663f49a6eb1a89f21d140_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_68a0595d0c4663f49a6eb1a89f21d140_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Drops startup file
- Loads dropped DLL
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python312.dll
select.pyd
Lorem ipsum.txt
memory/2816-76-0x00007FFD99890000-0x00007FFD998C3000-memory.dmp
memory/2816-85-0x00007FFDA2120000-0x00007FFDA212F000-memory.dmp
memory/2816-62-0x00007FFDA02F0000-0x00007FFDA0304000-memory.dmp
memory/2816-64-0x00007FFD8D470000-0x00007FFD8D999000-memory.dmp
memory/2816-54-0x00007FFDA2130000-0x00007FFDA213D000-memory.dmp
memory/2816-68-0x00007FFDA02D0000-0x00007FFDA02E9000-memory.dmp
memory/2816-50-0x00007FFDA0F20000-0x00007FFDA0F4D000-memory.dmp
memory/2816-78-0x00007FFD98C60000-0x00007FFD98D2D000-memory.dmp
memory/2816-47-0x00007FFDA5ED0000-0x00007FFDA5EEA000-memory.dmp
memory/2816-43-0x00007FFDA5FE0000-0x00007FFDA6005000-memory.dmp
memory/2816-73-0x00007FFDA0EB0000-0x00007FFDA0EBD000-memory.dmp
memory/2816-72-0x00007FFDA5FE0000-0x00007FFDA6005000-memory.dmp
memory/2816-71-0x00007FFD8D9A0000-0x00007FFD8E064000-memory.dmp
memory/2816-44-0x00007FFDA8280000-0x00007FFDA828F000-memory.dmp
memory/2816-36-0x00007FFD8D9A0000-0x00007FFD8E064000-memory.dmp
memory/2816-83-0x00007FFDA5ED0000-0x00007FFDA5EEA000-memory.dmp
memory/2816-84-0x00007FFDA0F20000-0x00007FFDA0F4D000-memory.dmp
memory/2816-58-0x00007FFDA2120000-0x00007FFDA212F000-memory.dmp
memory/2816-86-0x00007FFDA02F0000-0x00007FFDA0304000-memory.dmp
memory/2816-87-0x00007FFD8D470000-0x00007FFD8D999000-memory.dmp
memory/2816-89-0x00007FFDA5FE0000-0x00007FFDA6005000-memory.dmp
memory/2816-101-0x00007FFD99890000-0x00007FFD998C3000-memory.dmp
memory/2816-88-0x00007FFD8D9A0000-0x00007FFD8E064000-memory.dmp
memory/2816-102-0x00007FFD8D9A0000-0x00007FFD8E064000-memory.dmp
memory/2816-115-0x00007FFD8D9A0000-0x00007FFD8E064000-memory.dmp
memory/2816-128-0x00007FFD8D9A0000-0x00007FFD8E064000-memory.dmp
memory/2816-141-0x00007FFD8D9A0000-0x00007FFD8E064000-memory.dmp
memory/2816-154-0x00007FFD8D9A0000-0x00007FFD8E064000-memory.dmp
memory/2816-167-0x00007FFD8D9A0000-0x00007FFD8E064000-memory.dmp
memory/2816-180-0x00007FFD8D9A0000-0x00007FFD8E064000-memory.dmp
memory/2816-193-0x00007FFD8D9A0000-0x00007FFD8E064000-memory.dmp
memory/2816-206-0x00007FFD8D9A0000-0x00007FFD8E064000-memory.dmp
memory/2816-219-0x00007FFD8D9A0000-0x00007FFD8E064000-memory.dmp
memory/2816-232-0x00007FFD8D9A0000-0x00007FFD8E064000-memory.dmp
memory/2816-245-0x00007FFD8D9A0000-0x00007FFD8E064000-memory.dmp
memory/2816-258-0x00007FFD8D9A0000-0x00007FFD8E064000-memory.dmp