Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 20:57
General
- Target 2026-08-04_22465de719e76f465593b7221e7d9f77_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 19.7MB
- Sample260804-zrmdlszemb
- SHA256 0c17a1ff7897b7baec747f26eaa83bb50be08ac2910a6b26616fdc18200cbe3c
Malware Config
Signatures
- Detects executables packed with ConfuserEx Mod 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 34 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_22465de719e76f465593b7221e7d9f77_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_22465de719e76f465593b7221e7d9f77_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_22465de719e76f465593b7221e7d9f77_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_22465de719e76f465593b7221e7d9f77_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\tasklist.exetasklist /FO CSV /NH3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\_b1d7025f9.exeC:\Users\Admin\AppData\Local\Temp\_b1d7025f9.exe3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_raw_aes.pyd
_raw_aesni.pyd
_BLAKE2s.pyd
_ghash_clmul.pyd
_ghash_portable.pyd
_cpuid_c.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_brotli.cp314-win_amd64.pyd
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
_zstd.pyd
ada92cb5d92a588d1b93__mypyc.cp314-win_amd64.pyd
base_library.zip
cd.cp314-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python3.DLL
python314.dll
select.pyd
Lorem ipsum.txt
sqlite3.dll
ucrtbase.dll
unicodedata.pyd
wppassw.txt
memory/5756-221-0x00000167FD470000-0x00000167FD48A000-memory.dmp
memory/5756-228-0x00007FFCFE2C0000-0x00007FFCFEC64000-memory.dmp
memory/5756-219-0x00000167FF610000-0x00000167FF6D8000-memory.dmp
memory/5756-217-0x00007FFCFE44F000-0x00007FFCFE450000-memory.dmp
memory/5756-220-0x00007FFCFE2C0000-0x00007FFCFEC64000-memory.dmp
memory/5756-222-0x00000167FD450000-0x00000167FD458000-memory.dmp
memory/5756-223-0x00000167FECB0000-0x00000167FECB8000-memory.dmp
memory/5756-225-0x00007FFCFE2C0000-0x00007FFCFEC64000-memory.dmp
memory/5756-226-0x00000167FECC0000-0x00000167FECC8000-memory.dmp
memory/5756-224-0x00000167FF4F0000-0x00000167FF518000-memory.dmp
memory/5756-227-0x00000167FEE00000-0x00000167FEE1E000-memory.dmp
memory/5756-218-0x00000167FCF40000-0x00000167FCFCA000-memory.dmp
memory/5756-229-0x00007FFCFE2C0000-0x00007FFCFEC64000-memory.dmp
memory/5756-230-0x00007FFCFE2C0000-0x00007FFCFEC64000-memory.dmp
memory/5756-231-0x00007FFCFE2C0000-0x00007FFCFEC64000-memory.dmp
memory/5756-232-0x00007FFCFE2C0000-0x00007FFCFEC64000-memory.dmp
memory/5756-233-0x00007FFCFE2C0000-0x00007FFCFEC64000-memory.dmp
memory/5756-234-0x00007FFCFE2C0000-0x00007FFCFEC64000-memory.dmp
memory/5756-235-0x00007FFCFE2C0000-0x00007FFCFEC64000-memory.dmp
memory/5756-236-0x00007FFCFE2C0000-0x00007FFCFEC64000-memory.dmp
memory/5756-237-0x00007FFCFE2C0000-0x00007FFCFEC64000-memory.dmp
memory/5756-238-0x00007FFCFE2C0000-0x00007FFCFEC64000-memory.dmp