Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 14:05
General
- Target 2026-08-02_89f695438eb2498335861d012c71207f_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 7.4MB
- Sample260802-rd6akavanb
- SHA256 bacde93d64d841916b1530f3031fdfcebfd2e1db051ecf8c654188e6c5b6e3a5
Malware Config
Signatures
- UPX dump on OEP (original entry point) 3 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 11 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_89f695438eb2498335861d012c71207f_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_89f695438eb2498335861d012c71207f_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_89f695438eb2498335861d012c71207f_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_89f695438eb2498335861d012c71207f_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI43922\Firefox Installer.exe"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_MEI43922\Firefox Installer.exe"C:\Users\Admin\AppData\Local\Temp\_MEI43922\Firefox Installer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS46A125B9\setup-stub.exe.\setup-stub.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI43922\arip.exe"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_MEI43922\arip.exeC:\Users\Admin\AppData\Local\Temp\_MEI43922\arip.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
setup-stub.exe
Firefox Installer.exe
VCRUNTIME140.dll
_bz2.pyd
_lzma.pyd
arip.exe
base_library.zip
python312.dll
CityHash.dll
InetBgDL.dll
System.dll
UAC.dll
UserInfo.dll
WebBrowser.dll
bgstub.jpg
profile_cleanup.html
profile_cleanup.js
profile_cleanup_page.css
stub_common.css
stub_common.js
memory/2660-24-0x0000000000400000-0x0000000000446000-memory.dmp
memory/2660-109-0x0000000000400000-0x0000000000446000-memory.dmp