edd1b8df7634a080287cb27975259afa7be21811c2f6e33487ca79bf5d9b97bf

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 6.8MB
Sample260730-ejezcabd36
SHA256 edd1b8df7634a080287cb27975259afa7be21811c2f6e33487ca79bf5d9b97bf
MD5 08bbf37bd0db054e4f12e1f28da3bf9b
SHA1 9b2678668905d79441a480618182c94085f871d6
SHA512 ce3cc1e5e088e0ac39acb73fb130568a37299e3aa9a4ef568e375a332de7ce75667f96a46e9e120154832d6bc4a4231a4212514ed66da8873993183803f16372
SSDEEP 98304:lyznxTPkALGl1W903AE4V4QKUUyJl6bxGvwxiVIRFngXw5i5LmLyHaSvPUMNBS:A1kFl1W903eV4QK993iObMGuLmGHrP
TLSH
T14A763384E3B54AF6F863813E4293C544EA72741B07B891CB93A9CA553F333D25A3AF54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery evasion execution impact persistence privilege_escalation pyinstaller ransomware spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (123) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4264	netsh.exe
5508	netsh.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Loads dropped DLL 17 IoCs

pid	Process
4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\_MEI12402\\virus.py\""	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdateService = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\_MEI11962\\virus.py\""	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops autorun.inf file 1 TTPs 5 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\autorun.inf	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	F:\autorun.inf	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened for modification	F:\autorun.inf	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File opened for modification	F:\autorun.inf	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\System32\lsass.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Windows\System32\services.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Windows\System32\csrss.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Windows\System32\winlogon.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Windows\System32\lsass.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Windows\System32\services.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Windows\System32\csrss.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Windows\System32\winlogon.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\explorer.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
File created	C:\Windows\explorer.exe	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x000100000000002d-420.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 36 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4644	cmd.exe
3476	cmd.exe
4024	cmd.exe
3152	cmd.exe
4960	cmd.exe
5764	cmd.exe
1076	cmd.exe
476	cmd.exe
5988	cmd.exe
1244	cmd.exe
5148	cmd.exe
3028	cmd.exe
4916	cmd.exe
3012	cmd.exe
5656	cmd.exe
2880	cmd.exe
1436	cmd.exe
1624	cmd.exe
4156	cmd.exe
2984	cmd.exe
2520	cmd.exe
4684	cmd.exe
3692	cmd.exe
2004	cmd.exe
6012	cmd.exe
3144	cmd.exe
3384	cmd.exe
2828	cmd.exe
4548	cmd.exe
5320	cmd.exe
4268	cmd.exe
612	cmd.exe
3548	cmd.exe
1444	cmd.exe
2612	cmd.exe
4968	cmd.exe

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
5768	net.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2292	vssadmin.exe
1320	vssadmin.exe

Kills process with taskkill 30 IoCs

defense_evasion

pid	Process
3468	taskkill.exe
3152	taskkill.exe
1504	taskkill.exe
4952	taskkill.exe
4188	taskkill.exe
5664	taskkill.exe
4480	taskkill.exe
5628	taskkill.exe
2124	taskkill.exe
3456	taskkill.exe
4792	taskkill.exe
5612	taskkill.exe
1356	taskkill.exe
5204	taskkill.exe
6100	taskkill.exe
2680	taskkill.exe
2136	taskkill.exe
2548	taskkill.exe
3296	taskkill.exe
1420	taskkill.exe
3164	taskkill.exe
3616	taskkill.exe
4272	taskkill.exe
5852	taskkill.exe
5284	taskkill.exe
1808	taskkill.exe
928	taskkill.exe
3460	taskkill.exe
2628	taskkill.exe
4616	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2672	schtasks.exe
4028	schtasks.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	1420	taskkill.exe
Token: SeDebugPrivilege	5612	taskkill.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	2680	taskkill.exe
Token: SeDebugPrivilege	2136	taskkill.exe
Token: SeDebugPrivilege	3468	taskkill.exe
Token: SeDebugPrivilege	3152	taskkill.exe
Token: SeDebugPrivilege	2548	taskkill.exe
Token: SeDebugPrivilege	3296	taskkill.exe
Token: SeDebugPrivilege	928	taskkill.exe
Token: SeDebugPrivilege	4616	taskkill.exe
Token: SeDebugPrivilege	1504	taskkill.exe
Token: SeDebugPrivilege	5284	taskkill.exe
Token: SeDebugPrivilege	3164	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	3460	taskkill.exe
Token: SeDebugPrivilege	1356	taskkill.exe
Token: SeDebugPrivilege	5204	taskkill.exe
Token: SeDebugPrivilege	3616	taskkill.exe
Token: SeDebugPrivilege	4480	taskkill.exe
Token: SeDebugPrivilege	2628	taskkill.exe
Token: SeDebugPrivilege	5852	taskkill.exe
Token: SeDebugPrivilege	5628	taskkill.exe
Token: SeDebugPrivilege	2124	taskkill.exe
Token: SeDebugPrivilege	6100	taskkill.exe
Token: SeDebugPrivilege	3456	taskkill.exe
Token: SeDebugPrivilege	4792	taskkill.exe
Token: SeBackupPrivilege	2496	vssvc.exe
Token: SeRestorePrivilege	2496	vssvc.exe
Token: SeAuditPrivilege	2496	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 4880	1240	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 4880 wrote to memory of 4644	4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 4644 wrote to memory of 2672	4644	cmd.exe	92
PID 1196 wrote to memory of 2932	1196	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	96
PID 4880 wrote to memory of 1624	4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 1624 wrote to memory of 1420	1624	cmd.exe	99
PID 2932 wrote to memory of 5148	2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	101
PID 5148 wrote to memory of 4028	5148	cmd.exe	104
PID 4880 wrote to memory of 4156	4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 4156 wrote to memory of 5612	4156	cmd.exe	107
PID 4880 wrote to memory of 5764	4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	108
PID 2932 wrote to memory of 2984	2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	110
PID 5764 wrote to memory of 4952	5764	cmd.exe	112
PID 2984 wrote to memory of 2680	2984	cmd.exe	113
PID 4880 wrote to memory of 4268	4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	114
PID 2932 wrote to memory of 3028	2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	116
PID 4268 wrote to memory of 2136	4268	cmd.exe	118
PID 3028 wrote to memory of 3468	3028	cmd.exe	119
PID 4880 wrote to memory of 1444	4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	120
PID 2932 wrote to memory of 2520	2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	122
PID 1444 wrote to memory of 3152	1444	cmd.exe	188
PID 2520 wrote to memory of 2548	2520	cmd.exe	125
PID 4880 wrote to memory of 3144	4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	126
PID 2932 wrote to memory of 1076	2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	128
PID 3144 wrote to memory of 3296	3144	cmd.exe	130
PID 1076 wrote to memory of 928	1076	cmd.exe	131
PID 4880 wrote to memory of 476	4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	132
PID 2932 wrote to memory of 5988	2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	134
PID 476 wrote to memory of 4616	476	cmd.exe	136
PID 5988 wrote to memory of 1504	5988	cmd.exe	137
PID 4880 wrote to memory of 4548	4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	138
PID 2932 wrote to memory of 4684	2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	140
PID 4548 wrote to memory of 5284	4548	cmd.exe	142
PID 4684 wrote to memory of 3164	4684	cmd.exe	143
PID 4880 wrote to memory of 4916	4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	144
PID 2932 wrote to memory of 3012	2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	146
PID 4916 wrote to memory of 4188	4916	cmd.exe	148
PID 3012 wrote to memory of 1808	3012	cmd.exe	149
PID 4880 wrote to memory of 5656	4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	150
PID 2932 wrote to memory of 612	2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	152
PID 5656 wrote to memory of 5664	5656	cmd.exe	154
PID 612 wrote to memory of 3460	612	cmd.exe	155
PID 4880 wrote to memory of 3548	4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	156
PID 3548 wrote to memory of 1356	3548	cmd.exe	158
PID 2932 wrote to memory of 3384	2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	159
PID 4880 wrote to memory of 3476	4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	161
PID 3384 wrote to memory of 5204	3384	cmd.exe	163
PID 3476 wrote to memory of 3616	3476	cmd.exe	164
PID 2932 wrote to memory of 1244	2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	165
PID 4880 wrote to memory of 3692	4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	167
PID 1244 wrote to memory of 4272	1244	cmd.exe	169
PID 2932 wrote to memory of 2004	2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	170
PID 3692 wrote to memory of 4480	3692	cmd.exe	172
PID 2004 wrote to memory of 2628	2004	cmd.exe	173
PID 4880 wrote to memory of 4024	4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	174
PID 2932 wrote to memory of 6012	2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	176
PID 4024 wrote to memory of 5852	4024	cmd.exe	178
PID 6012 wrote to memory of 5628	6012	cmd.exe	179
PID 4880 wrote to memory of 2612	4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	180
PID 2932 wrote to memory of 2828	2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	182
PID 2612 wrote to memory of 2124	2612	cmd.exe	184
PID 2828 wrote to memory of 6100	2828	cmd.exe	185
PID 4880 wrote to memory of 5320	4880	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	186
PID 2932 wrote to memory of 3152	2932	2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	188

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe C:\Users\Admin\AppData\Local\Temp\_MEI12402\virus.py" /sc onlogon /f >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe C:\Users\Admin\AppData\Local\Temp\_MEI12402\virus.py" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *avast* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1624
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *avast*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *avg* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4156
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *avg*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *avira* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5764
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *avira*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *bitdefender* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *bitdefender*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *kaspersky* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *kaspersky*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *norton* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3144
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *norton*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *mcafee* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:476
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *mcafee*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *trend* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *trend*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *symantec* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *symantec*
      4⤵
      Kills process with taskkill
      PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *windows defender* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5656
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *windows defender*
      4⤵
      Kills process with taskkill
      PID:5664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *malwarebytes* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *malwarebytes*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *eset* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3476
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *eset*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *sophos* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3692
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *sophos*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *panda* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *panda*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *comodo* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *comodo*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:5320
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4960
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net view > C:\net_share.txt 2>nul
    3⤵
    PID:1888

C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe C:\Users\Admin\AppData\Local\Temp\_MEI11962\virus.py" /sc onlogon /f >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5148
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-30_08bbf37bd0db054e4f12e1f28da3bf9b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe C:\Users\Admin\AppData\Local\Temp\_MEI11962\virus.py" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *avast* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *avast*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *avg* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *avg*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *avira* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2520
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *avira*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *bitdefender* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *bitdefender*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *kaspersky* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5988
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *kaspersky*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *norton* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *norton*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *mcafee* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *mcafee*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *trend* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:612
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *trend*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3460
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *symantec* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *symantec*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *windows defender* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1244
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *windows defender*
      4⤵
      Kills process with taskkill
      PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *malwarebytes* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *malwarebytes*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *eset* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6012
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *eset*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *sophos* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *sophos*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:6100
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *panda* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:3152
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *panda*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /f /im *comodo* >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:2880
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /im *comodo*
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:1436
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /all /quiet >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    PID:4968
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:1320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c net view > C:\net_share.txt 2>nul
    3⤵
    PID:696
  - - C:\Windows\system32\net.exe
      net view
      4⤵
      Discovers systems in the same network
      PID:5768

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
TLSH
T1A0B37C4A72A441F7C5AAD274C2E38A06FB71B541877093CF03B19A690F63BE15E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_bz2.pyd
Size 82KB
SHA256 403e76fe18515a5ea3227cf5f919aa2f32ac3233853c9fb71627f2251c554d09
MD5 28ede9ce9484f078ac4e52592a8704c7
SHA1 bcf8d6fe9f42a68563b6ce964bdc615c119992d0
SHA512 8c372f9f6c4d27f7ca9028c6034c17deb6e98cfef690733465c1b44bd212f363625d9c768f8e0bd4c781ddde34ee4316256203ed18fa709d120f56df3cca108b
SSDEEP 1536:7/Uez7qlMjca6uPZLPYMPHn3m8bhztpIVCVC7SyhJDxhy:4ezGC4TM/3RbhhpIVCVCXpy
TLSH
T13D83AEA2F6A096B5F41B927A96B14393E331FE49035093EFF68483172F02F913C6535A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_ctypes.pyd
Size 120KB
SHA256 e28d4e46e5d10b5fdcf0292f91e8fd767e33473116247cd5d577e4554d7a4c0c
MD5 22c4892caf560a3ee28cf7f210711f9e
SHA1 b30520fadd882b667ecef3b4e5c05dc92e08b95a
SHA512 edb86b3694fff0b05318decf7fc42c20c348c1523892cce7b89cc9c5ab62925261d4dd72d9f46c9b2bda5ac1e6b53060b8701318b064a286e84f817813960b19
SSDEEP 3072:aS7u5LnIxdP3fPHW+QfLIrAYKpemW9IVLPjo:aSw+3FQfLIrIemW3
TLSH
T1C3C35B1B23541099EB67807CC5B35E17DBB1B859172087CF02A4CA9E2F637A36E7E712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_decimal.pyd
Size 247KB
SHA256 6cd52b65e11839f417b212ba5a39f182b0151a711ebc7629dc260b532391db72
MD5 baaa9067639597e63b55794a757ddeff
SHA1 e8dd6b03ebef0b0a709e6cccff0e9f33c5142304
SHA512 7995c3b818764ad88db82148ea0ce560a0bbe9594ca333671b4c5e5c949f5932210edbd63d4a0e0dc2daf24737b99318e3d5daaee32a5478399a6aa1b9ee3719
SSDEEP 6144:cjz3B48pj9aOtoQdpJOsoTiSi9qWM53pLW1Atp6tQh7:i94uj9afQVrom0bUQh7
TLSH
T155446C56A2490CA0DE778478D8979B47EBB278950360C3CF43A4CAA72F577A327BD344
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_hashlib.pyd
Size 63KB
SHA256 21d59958e2ad1b944c4811a71e88de08c05c5ca07945192ab93da5065fac8926
MD5 c888ecc8298c36d498ff8919cebdb4e6
SHA1 f904e1832b9d9614fa1b8f23853b3e8c878d649d
SHA512 7161065608f34d6de32f2c70b7485c4ee38cd3a41ef68a1beacee78e4c5b525d0c1347f148862cf59abd9a4ad0026c2c2939736f4fc4c93e6393b3b53aa7c377
SSDEEP 1536:jfKlbLgy209/MkZy6n23JZlnvy7OjZophIVOIi7SyMrxZR1:7Khgy+XZla7OjSphIVOIiKR1
TLSH
T172536C06F65544A8C97B81B9D9A34F57EAF2F1001B509BDF4368C18D2F233C396B6B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_lzma.pyd
Size 155KB
SHA256 ad0440ca6998e18f5cc917d088af3fea2c0ff0febce2b5e2b6c0f1370f6e87b1
MD5 d386b7c4dcf589e026abfc7196cf1c4c
SHA1 c07ce47ce0e69d233c5bdd0bcac507057d04b2d4
SHA512 78d79e2379761b054df1f9fd8c5b7de5c16b99af2d2de16a3d0ac5cb3f0bd522257579a49e91218b972a273db4981f046609fdcf2f31cf074724d544dac7d6c8
SSDEEP 3072:cNltLBrdV/REWa/g7Lznf49mNoiUMApqlpIVZ1SXW:cNltPpREgAYOicMI
TLSH
T1D0F33992A394F4D5F3228C78D6664F27D7F678490310929A02CCC36D2B2FB759A2E717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\_socket.pyd
Size 77KB
SHA256 301c47c4016dac27811f04f4d7232f24852ef7675e9a4500f0601703ed8f06af
MD5 2c0ec225e35a0377ac1d0777631bffe4
SHA1 7e5d81a06ff8317af52284aedccac6ebace5c390
SHA512 aea9d34d9e93622b01e702defd437d397f0e7642bc5f9829754d59860b345bbde2dd6d7fe21cc1d0397ff0a9db4ecfe7c38b649d33c5c6f0ead233cb201a73e0
SSDEEP 1536:YJlhpHrTT9r3ujE9/s+S+pzpCoiTFVf7p9IVLwg7SyLxU:Y7hpL13ujE9/sT+pz4oYFVTp9IVLwgo
TLSH
T176735B12A29060A9D273C07AC1635F23EB74F4C117D5A7CF5260C96E5F23782AE7ABD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\base_library.zip
Size 1.4MB
SHA256 257dea7ca2396f2a3ac4760d353248512f6f76ccd6e0e48b1705be959d67e423
MD5 58fe56947a111997711741c2e48617b9
SHA1 2e30a6cb119e9bc9641f4697aeb7dae6d411c0b8
SHA512 2190d3eb127f5c84596f86954f7f0d7252a28e8352e119dfff4c9cd5856f15795b84a303be03b28eb2b4617751cb458937345309a54efa0b164e6ae24acb8c91
SSDEEP 24576:VvHHWeIPAdYf9TN3cnz/bucEvUFigiQR5pqfRru0iwhw:V6QR5pqfRkF
TLSH
T1A86509817982B5F7F804F3BB4026090DB328C5B4BB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\libcrypto-3.dll
Size 4.9MB
SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
MD5 51e8a5281c2092e45d8c97fbdbf39560
SHA1 c499c810ed83aaadce3b267807e593ec6b121211
SHA512 98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
SSDEEP 98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
TLSH
T1DE367A6AA7A81189E4BAC13CC9534617E6F1F81A177097CF14A1567D0F33BDA2B3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\python311.dll
Size 5.5MB
SHA256 53a969094231b9032abe4148939ce08a3a4e4b30b0459fc7d90c89f65e8dcd4a
MD5 65e381a0b1bc05f71c139b0c7a5b8eb2
SHA1 7c4a3adf21ebcee5405288fc81fc4be75019d472
SHA512 4db465ef927dfb019ab6faec3a3538b0c3a8693ea3c2148fd16163bf31c03c899dfdf350c31457edf64e671e3cc3e46851f32f0f84b267535bebc4768ef53d39
SSDEEP 98304:CdT9zf0+IXY3qd4biqm46oWHrMGYPtA81:CdT9zflIXgq/epGWAs
TLSH
T18F467C22B26594A0C97B8076EA2F8647D7B27C505F20CB0B5164B7992F33B531EEF346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\select.pyd
Size 29KB
SHA256 8a9a103bc417dede9f6946d9033487c410937e1761d93c358c1600b82f0a711f
MD5 8472d39b9ee6051c961021d664c7447e
SHA1 b284e3566889359576d43e2e0e99d4acf068e4fb
SHA512 309f1ec491d9c39f4b319e7ce1abdedf11924301e4582d122e261e948705fb71a453fec34f63df9f9abe7f8cc2063a56cd2c2935418ab54be5596aadc2e90ad3
SSDEEP 768:neUeJhHq2GD9IVQGA5YiSyv3g+AMxkEdC:neUeJhK2GD9IVQGS7SyfgMxRC
TLSH
T1BDD29F976F545C89E823C572A8E64E16EA35B6A24710C2DF3354C16C1F327C27BBB364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12402\unicodedata.pyd
Size 1.1MB
SHA256 1a965c1904da88989468852fdc749b520cce46617b9190163c8df19345b59560
MD5 57f8f40cf955561a5044ddffa4f2e144
SHA1 19218025bcae076529e49dde8c74f12e1b779279
SHA512 db2a7a32e0b5bf0684a8c4d57a1d7df411d8eb1bc3828f44c95235dd3af40e50a198427350161dff2e79c07a82ef98e1536e0e013030a15bdf1116154f1d8338
SSDEEP 12288:C3kYbfjwR6nbVonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD1Ji:CUYbM40IDJcjEwPgPOG6Xyd461Ji
TLSH
T121355BC9BB828D66D87B31B944D2212F1361C273475B233BB65513285C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autorun.inf

Path C:\autorun.inf
Size 75B
SHA256 faa53f3396daff0f109a6de804de9ba800b8b5fa9c5428951680b8589c20cefa
MD5 c1f9154591a450c6f99e4f60238ab84c
SHA1 1a6949cd425110b697145ac6d7b3e73bef4e532b
SHA512 aae1c1317539f1a4282903d9f0533051f811dfe4c5e7326a6340d87258a32c7c84ddfcd550c96fc76de332c1da5efa379aac23931d4d4f79f67f4ceb9aaa72dd
TLSH
T1B4A022A0FEF02028202BB0828203E0B8C3AEE00CC330C02A80C88002A8082CA0F2BC03
MD5 SHA1 SHA512 TLSH

Submit Download

Backup_Helper.exe

Path F:\Backup_Helper.exe
Size 6.8MB
SHA256 edd1b8df7634a080287cb27975259afa7be21811c2f6e33487ca79bf5d9b97bf
MD5 08bbf37bd0db054e4f12e1f28da3bf9b
SHA1 9b2678668905d79441a480618182c94085f871d6
SHA512 ce3cc1e5e088e0ac39acb73fb130568a37299e3aa9a4ef568e375a332de7ce75667f96a46e9e120154832d6bc4a4231a4212514ed66da8873993183803f16372
SSDEEP 98304:lyznxTPkALGl1W903AE4V4QKUUyJl6bxGvwxiVIRFngXw5i5LmLyHaSvPUMNBS:A1kFl1W903eV4QK993iObMGuLmGHrP
TLSH
T14A763384E3B54AF6F863813E4293C544EA72741B07B891CB93A9CA553F333D25A3AF54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autorun.inf

Path F:\autorun.inf
Size 35B
SHA256 693e4c15c88802a709cbb0674b531214dabab27bb1228a9c7f589aa6b99e23eb
MD5 3e99474a6dd273ad433f05f6823de42e
SHA1 896a7106645c97cf14f3d39c115277fdc94de039
SHA512 de1b238b859fb9d3cb873dd5123adcc5eb90867c41e1871aae9bcce5d842aa25784fc53181205e2958382d9d863ae9d029011f41e4de204588edea0b0cca9764
MD5 SHA1 SHA512

Submit Download

memory/4880-80-0x0000022A6CA10000-0x0000022A6CFDD000-memory.dmp

Download

memory/4880-326-0x0000022A6CA10000-0x0000022A6CFDD000-memory.dmp

Download

memory/4880-122-0x0000022A6CA10000-0x0000022A6CFDD000-memory.dmp

Download

memory/4880-441-0x0000022A6CA10000-0x0000022A6CFDD000-memory.dmp

Download

memory/4880-446-0x0000022A6CA10000-0x0000022A6CFDD000-memory.dmp

Download

memory/4880-69-0x0000022A6CA10000-0x0000022A6CFDD000-memory.dmp

Download

memory/4880-451-0x0000022A6CA10000-0x0000022A6CFDD000-memory.dmp

Download

memory/4880-456-0x0000022A6CA10000-0x0000022A6CFDD000-memory.dmp

Download

memory/4880-461-0x0000022A6CA10000-0x0000022A6CFDD000-memory.dmp

Download

memory/4880-466-0x0000022A6CA10000-0x0000022A6CFDD000-memory.dmp

Download

memory/4880-471-0x0000022A6CA10000-0x0000022A6CFDD000-memory.dmp

Download

memory/4880-476-0x0000022A6CA10000-0x0000022A6CFDD000-memory.dmp

Download

memory/4880-481-0x0000022A6CA10000-0x0000022A6CFDD000-memory.dmp

Download

memory/4880-484-0x0000022A6CA10000-0x0000022A6CFDD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads