8949d5d7b38b8ad3596bb2898cc875fb1cf76033092cbfce4fae89347d9f2bf7

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Size 3.6MB
Sample260729-mszzwasale
SHA256 8949d5d7b38b8ad3596bb2898cc875fb1cf76033092cbfce4fae89347d9f2bf7
MD5 a1cf7d01f3bfd1ebd37754abf4f5f2bb
SHA1 881f849c36c102a9921f6960e7f5f580b353e39d
SHA512 b4516b50f6b7327299cf325b3c91c3154a13f43af1354ef44314790ccd9a14f6fd4355cfcc4ca92e7b852261ba8ccd8c85cdff179f7ccb61f1f3b03fa7d21770
SSDEEP 49152:ThbT3yXYVDorosZCjqvEgdAUb8wgh7fbwlLNHrSpNLS3SZlf1kmRwpfezhDeft/t:dVporfHEyV4bILZrQXZl9LRhAf
TLSH
T190062310F6E008FED5A3E23D8A531A26F572BC2113D586DF13506A65AF637D09E37B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence privilege_escalation

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
4164	2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
4164	2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
4164	2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
4164	2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
4164	2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
4164	2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
4164	2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1164	cmd.exe
6032	cmd.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 4164	4200	2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe	90
PID 4164 wrote to memory of 6032	4164	2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe	91
PID 6032 wrote to memory of 2108	6032	cmd.exe	92
PID 4164 wrote to memory of 1164	4164	2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe	93
PID 1164 wrote to memory of 4116	1164	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Users\Admin\AppData\Local\Temp\2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-29_a1cf7d01f3bfd1ebd37754abf4f5f2bb_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6032
  - - C:\Windows\system32\netsh.exe
      netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:2108
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Windows\system32\netsh.exe
      netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4200_134975_lErH1FMhVLo\_ctypes.pyd
Size 117KB
SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
MD5 79f339753dc8954b8eb45fe70910937e
SHA1 3ad1bf9872dc779f32795988eb85c81fe47b3dd4
SHA512 21e567e813180ed0480c4b21be3e2e67974d8d787e663275be054cee0a3f5161fc39034704dbd25f1412feb021d6a21b300a32d1747dee072820be81b9d9b753
SSDEEP 3072:SHcKPoHQUCFN1KQDCVPJGltBfrShpl7PFIABPI:ShP0ChjCxJGl3frSVzo
TLSH
T1A8C34A1B635400EAEA63407CC5B35E87DB71B859172183DF02A4C69E2F637E26E7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4200_134975_lErH1FMhVLo\_socket.pyd
Size 72KB
SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
MD5 5dd51579fa9b6a06336854889562bec0
SHA1 99c0ed0a15ed450279b01d95b75c162628c9be1d
SHA512 7aa6c6587890ae8c3f9a5e97ebde689243ac5b9abb9b1e887f29c53eef99a53e4b4ec100c03e1c043e2f0d330e7af444c3ca886c9a5e338c2ea42aaacae09f3e
SSDEEP 1536:LmtpT7zWHzDfLrAe9/s+S+pBm/es6FIABwNyi:qTnzWzrAe9/sT+pBm/X6FIABwp
TLSH
T147735A11A79051FAE673817AC1635F23F7B0F480139593CF4664DA6E1F63782AE3AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-7.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4200_134975_lErH1FMhVLo\libffi-7.dll
Size 32KB
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
SSDEEP 384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
TLSH
T1CFE26B0B665059F0FA57C43A9766DE2AD73676301350A2CF02F5C2A62F5BBE0A63D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python310.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4200_134975_lErH1FMhVLo\python310.dll
Size 4.2MB
SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
MD5 384349987b60775d6fc3a6d202c3e1bd
SHA1 701cb80c55f859ad4a31c53aa744a00d61e467e5
SHA512 6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5
SSDEEP 49152:+RYsIZfypUacEN7z1NR6JYL911cdl40pPQKE30tBuQS6BqL902zJAysI6maHmbM9:YYsI5xKZ4JxsvAI6xHEMb5Hs9d
TLSH
T1A1267C22A35401A4DAB78477C5278747DBF2FC552F20D34A41A4BAD92F73BA316EE702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

redirector.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4200_134975_lErH1FMhVLo\redirector.dll
Size 3.6MB
SHA256 53360c607cbce13e6867ec3ed36cc68b62a4a73f9cc6dafcb92161d0aad0cd97
MD5 05c0cd6b0454dc4aad24beb0bc7d5c5a
SHA1 da1e232ab6fcf44cfbaff9120e20cad25a321e18
SHA512 bbd25fcf10a6c2ed766532ada222c7d15fb4ca013c74ea5f30399718598553613751a6ea2aff20f185d5837af210c2dab80a2f113ac6d83b2ec86d19cbcd0a0d
SSDEEP 49152:F4Uq+Ms5IepsEgKL3Sxyc6+ae4Gc4caM6ej79Wa2i2cztVic1uerwLofxbGwERrS:F5d59Z2czx1uerwLofxbGwERrKtfLL
TLSH
T163065CD176B01A9BFD66F1B880CA46209763F27B1F08AD93F04DC2993F46AD41EB558C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_4200_134975_lErH1FMhVLo\select.pyd
Size 25KB
SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
MD5 78d421a4e6b06b5561c45b9a5c6f86b1
SHA1 c70747d3f2d26a92a0fe0b353f1d1d01693929ac
SHA512 83e02963c9726a40cd4608b69b4cdf697e41c9eedfb2d48f3c02c91500e212e7e0ab03e6b3f70f42e16e734e572593f27b016b901c8aa75f674b6e0fbb735012
SSDEEP 384:XPjk/7e12hwheCZHqh1BeshphFIAmGcDG4y8JAgwhp:fUC2hwh9Hq3rHhFIAmGcDG4yMwh
TLSH
T1DDC26E46EB505CC2E8238171B5E1CF06FE31B6514761C1EF7268C2692F57B8231BEB29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4164-10-0x0000000140000000-0x000000014038E000-memory.dmp

Download

memory/4164-24-0x0000000140000000-0x000000014038E000-memory.dmp

Download

memory/4164-23-0x000000000A280000-0x000000000A6D0000-memory.dmp

Download

memory/4200-0-0x0000000140000000-0x000000014038E000-memory.dmp

Download

memory/4200-27-0x0000000140000000-0x000000014038E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads