Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 05:54
General
- Target 2026-07-30_21935c93beda1ecb30f36e47a3b52e11_blankgrabber_cobalt-strike_icedid_njrat_satacom_stealc.exe
- Size 6.0MB
- Sample260730-glw2racf92
- SHA256 5d9a72ab591a83c077643f5e4bc1c0141dd0561025e2026710629a0696095bf1
Malware Config
Signatures
- Detects executables packed with Enigma 16 IoCs
- Loads dropped DLL 3 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_21935c93beda1ecb30f36e47a3b52e11_blankgrabber_cobalt-strike_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_21935c93beda1ecb30f36e47a3b52e11_blankgrabber_cobalt-strike_icedid_njrat_satacom_stealc.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
custom.ini
settings.ini
evb9F64.tmp
evbA020.tmp
evbA0DD.tmp
memory/6396-154-0x00007FFB4B140000-0x00007FFB4B3A3000-memory.dmp
memory/6396-300-0x0000000010000000-0x0000000010021000-memory.dmp
memory/6396-17-0x0000000010000000-0x0000000010021000-memory.dmp
memory/6396-5-0x0000000180000000-0x0000000180087000-memory.dmp
memory/6396-13-0x00000000006E0000-0x00000000006FE000-memory.dmp
memory/6396-11-0x00000000006E0000-0x00000000006FE000-memory.dmp
memory/6396-153-0x00007FFB4B140000-0x00007FFB4B3A3000-memory.dmp
memory/6396-19-0x00007FFB4B140000-0x00007FFB4B3A3000-memory.dmp
memory/6396-3-0x00007FFB4B140000-0x00007FFB4B3A3000-memory.dmp
memory/6396-2-0x00007FFB4B29F000-0x00007FFB4B2A0000-memory.dmp
memory/6396-20-0x00007FFB4B140000-0x00007FFB4B3A3000-memory.dmp
memory/6396-156-0x0000000010000000-0x0000000010021000-memory.dmp
memory/6396-158-0x00000000006E0000-0x00000000006FE000-memory.dmp
memory/6396-157-0x0000000180000000-0x0000000180087000-memory.dmp
memory/6396-155-0x00007FFB4B140000-0x00007FFB4B3A3000-memory.dmp
memory/6396-0-0x0000000140000000-0x0000000140328000-memory.dmp
memory/6396-295-0x0000000140000000-0x0000000140328000-memory.dmp
memory/6396-296-0x00007FFB4B140000-0x00007FFB4B3A3000-memory.dmp
memory/6396-297-0x0000000140000000-0x0000000140328000-memory.dmp
memory/6396-9-0x00007FFB4B140000-0x00007FFB4B3A3000-memory.dmp
memory/6396-301-0x00007FFB4B140000-0x00007FFB4B3A3000-memory.dmp
memory/6396-305-0x0000000010000000-0x0000000010021000-memory.dmp
memory/6396-302-0x0000000140000000-0x0000000140328000-memory.dmp
memory/6396-306-0x0000000140000000-0x0000000140328000-memory.dmp
memory/6396-313-0x0000000010000000-0x0000000010021000-memory.dmp
memory/6396-310-0x0000000140000000-0x0000000140328000-memory.dmp
memory/6396-314-0x0000000140000000-0x0000000140328000-memory.dmp
memory/6396-318-0x0000000140000000-0x0000000140328000-memory.dmp
memory/6396-322-0x0000000140000000-0x0000000140328000-memory.dmp
memory/6396-326-0x0000000140000000-0x0000000140328000-memory.dmp
memory/6396-330-0x0000000140000000-0x0000000140328000-memory.dmp
memory/6396-334-0x0000000140000000-0x0000000140328000-memory.dmp
memory/6396-338-0x0000000140000000-0x0000000140328000-memory.dmp
memory/6396-342-0x0000000140000000-0x0000000140328000-memory.dmp
memory/6396-346-0x0000000140000000-0x0000000140328000-memory.dmp
memory/6396-353-0x0000000010000000-0x0000000010021000-memory.dmp
memory/6396-350-0x0000000140000000-0x0000000140328000-memory.dmp