c28a7bf288adab51e1371dddf98d10cd81c6099cd346e6093f50b367c2cd0b46

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 01:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 13.7MB
Sample260802-bq2vxabl3y
SHA256 c28a7bf288adab51e1371dddf98d10cd81c6099cd346e6093f50b367c2cd0b46
MD5 0b8921f4f4ce4e08916dc4a718038aee
SHA1 cf4605dfe70e8b4bded243ccea537b2a56fbcab7
SHA512 5f3801ec1b84dd8ff23d52842f7dcfe590282bc6302c7071853343d5b492c1588b8fa808b5d17deecfb47e1eba3516f49522c1d36b7e080adf653fa8294a44d4
SSDEEP 393216:FdqSWjy2RO26E3rZsul4Lvc1psXMCHWUjMcuI3/PGTAI:FkSey20EbZVrsXMb8ZH/O7
TLSH
T1E2E63308A8D012FDD563503CEEF251D5EAB9B8714776C2EF4BD4C6A2AE231E09439727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4872	powershell.exe
4900	powershell.exe
3604	powershell.exe
4304	powershell.exe
3772	powershell.exe
5480	powershell.exe
5472	powershell.exe
5560	powershell.exe
1576	powershell.exe
1556	powershell.exe
2016	powershell.exe
4700	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4204	cmd.exe
5500	cmd.exe
2828	cmd.exe
712	cmd.exe
5916	cmd.exe
3760	cmd.exe
2036	cmd.exe
2728	cmd.exe
4656	cmd.exe
4228	cmd.exe
1796	cmd.exe
4488	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4872	powershell.exe
4872	powershell.exe
1576	powershell.exe
1576	powershell.exe
1576	powershell.exe
4900	powershell.exe
4900	powershell.exe
4900	powershell.exe
1556	powershell.exe
1556	powershell.exe
1556	powershell.exe
3604	powershell.exe
3604	powershell.exe
3604	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
4304	powershell.exe
4304	powershell.exe
4304	powershell.exe
3772	powershell.exe
3772	powershell.exe
3772	powershell.exe
5480	powershell.exe
5480	powershell.exe
5480	powershell.exe
5472	powershell.exe
5472	powershell.exe
5472	powershell.exe
5560	powershell.exe
5560	powershell.exe
5560	powershell.exe
4700	powershell.exe
4700	powershell.exe
4700	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeIncreaseQuotaPrivilege	4872	powershell.exe
Token: SeSecurityPrivilege	4872	powershell.exe
Token: SeTakeOwnershipPrivilege	4872	powershell.exe
Token: SeLoadDriverPrivilege	4872	powershell.exe
Token: SeSystemProfilePrivilege	4872	powershell.exe
Token: SeSystemtimePrivilege	4872	powershell.exe
Token: SeProfSingleProcessPrivilege	4872	powershell.exe
Token: SeIncBasePriorityPrivilege	4872	powershell.exe
Token: SeCreatePagefilePrivilege	4872	powershell.exe
Token: SeBackupPrivilege	4872	powershell.exe
Token: SeRestorePrivilege	4872	powershell.exe
Token: SeShutdownPrivilege	4872	powershell.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeSystemEnvironmentPrivilege	4872	powershell.exe
Token: SeRemoteShutdownPrivilege	4872	powershell.exe
Token: SeUndockPrivilege	4872	powershell.exe
Token: SeManageVolumePrivilege	4872	powershell.exe
Token: 33	4872	powershell.exe
Token: 34	4872	powershell.exe
Token: 35	4872	powershell.exe
Token: 36	4872	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeIncreaseQuotaPrivilege	1576	powershell.exe
Token: SeSecurityPrivilege	1576	powershell.exe
Token: SeTakeOwnershipPrivilege	1576	powershell.exe
Token: SeLoadDriverPrivilege	1576	powershell.exe
Token: SeSystemProfilePrivilege	1576	powershell.exe
Token: SeSystemtimePrivilege	1576	powershell.exe
Token: SeProfSingleProcessPrivilege	1576	powershell.exe
Token: SeIncBasePriorityPrivilege	1576	powershell.exe
Token: SeCreatePagefilePrivilege	1576	powershell.exe
Token: SeBackupPrivilege	1576	powershell.exe
Token: SeRestorePrivilege	1576	powershell.exe
Token: SeShutdownPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeSystemEnvironmentPrivilege	1576	powershell.exe
Token: SeRemoteShutdownPrivilege	1576	powershell.exe
Token: SeUndockPrivilege	1576	powershell.exe
Token: SeManageVolumePrivilege	1576	powershell.exe
Token: 33	1576	powershell.exe
Token: 34	1576	powershell.exe
Token: 35	1576	powershell.exe
Token: 36	1576	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeIncreaseQuotaPrivilege	4900	powershell.exe
Token: SeSecurityPrivilege	4900	powershell.exe
Token: SeTakeOwnershipPrivilege	4900	powershell.exe
Token: SeLoadDriverPrivilege	4900	powershell.exe
Token: SeSystemProfilePrivilege	4900	powershell.exe
Token: SeSystemtimePrivilege	4900	powershell.exe
Token: SeProfSingleProcessPrivilege	4900	powershell.exe
Token: SeIncBasePriorityPrivilege	4900	powershell.exe
Token: SeCreatePagefilePrivilege	4900	powershell.exe
Token: SeBackupPrivilege	4900	powershell.exe
Token: SeRestorePrivilege	4900	powershell.exe
Token: SeShutdownPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeSystemEnvironmentPrivilege	4900	powershell.exe
Token: SeRemoteShutdownPrivilege	4900	powershell.exe
Token: SeUndockPrivilege	4900	powershell.exe
Token: SeManageVolumePrivilege	4900	powershell.exe
Token: 33	4900	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 5008	2736	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 5008 wrote to memory of 2036	5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 2036 wrote to memory of 4872	2036	cmd.exe	92
PID 5008 wrote to memory of 4204	5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 4204 wrote to memory of 1576	4204	cmd.exe	96
PID 5008 wrote to memory of 5500	5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	97
PID 5500 wrote to memory of 4900	5500	cmd.exe	99
PID 5008 wrote to memory of 2728	5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	100
PID 2728 wrote to memory of 1556	2728	cmd.exe	102
PID 5008 wrote to memory of 4656	5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	103
PID 4656 wrote to memory of 3604	4656	cmd.exe	105
PID 5008 wrote to memory of 2828	5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	106
PID 2828 wrote to memory of 2016	2828	cmd.exe	108
PID 5008 wrote to memory of 712	5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	109
PID 712 wrote to memory of 4304	712	cmd.exe	111
PID 5008 wrote to memory of 5916	5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	112
PID 5916 wrote to memory of 3772	5916	cmd.exe	114
PID 5008 wrote to memory of 4228	5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	115
PID 4228 wrote to memory of 5480	4228	cmd.exe	117
PID 5008 wrote to memory of 1796	5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	118
PID 1796 wrote to memory of 5472	1796	cmd.exe	120
PID 5008 wrote to memory of 4488	5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	121
PID 4488 wrote to memory of 5560	4488	cmd.exe	123
PID 5008 wrote to memory of 3760	5008	2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	124
PID 3760 wrote to memory of 4700	3760	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Users\Admin\AppData\Local\Temp\2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-01_0b8921f4f4ce4e08916dc4a718038aee_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\xixobak'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\xixobak'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5500
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact