Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 03:47
Behavioral task
behavioral1
Sample
2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target 2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 20.0MB
- Sample260807-ecf8tswhrf
- SHA256 a981716d812a82372fb7a5263b71e06d25f71e1a115fc2f2e9234a944ca2b695
- MD5 ad0f33bae398f688b42a62cd754de44d
- SHA1 a1949d8ba4ab0f83d578e218436bddb8ed547900
- SHA512 b802f7141fd8018b4fe6111b2c019691d400577696f2c28152f3328e1a2b011a8fb6f98c6a4644ce146275f750f71bff3172ec83a9c42b7b553a735a3c9b8430
- SSDEEP 393216:eAyFAyQ9yDUkLVS9cFL9eHl25R84A/st2Ej7dopll:eAyFAyQgAkLVS9NH0R2st2E7e
- TLSH T1032733287BD985D7C9E6633E58A3D609DDA07C92073092AF43106B953F1B8D48D3E3B9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 14 IoCs
pid Process 1384 2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe 1384 2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe 1384 2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe 1384 2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe 1384 2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe 1384 2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe 1384 2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe 1384 2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe 1384 2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe 1384 2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe 1384 2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe 1384 2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe 1384 2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe 1384 2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe -
resource yara_rule behavioral2/files/0x000c00000001c650-174.dat upx behavioral2/memory/1384-177-0x00007FFA31350000-0x00007FFA31A5D000-memory.dmp upx behavioral2/files/0x000c00000001c5f7-183.dat upx behavioral2/files/0x000c00000001c64b-187.dat upx behavioral2/memory/1384-188-0x00007FFA4B4B0000-0x00007FFA4B4BF000-memory.dmp upx behavioral2/memory/1384-186-0x00007FFA45020000-0x00007FFA45049000-memory.dmp upx behavioral2/files/0x000c00000001c5f5-189.dat upx behavioral2/memory/1384-191-0x00007FFA451C0000-0x00007FFA451DA000-memory.dmp upx behavioral2/files/0x000c00000001c5fa-192.dat upx behavioral2/files/0x000c00000001c602-194.dat upx behavioral2/memory/1384-195-0x00007FFA44230000-0x00007FFA4425C000-memory.dmp upx behavioral2/memory/1384-197-0x00007FFA3CE40000-0x00007FFA3CEC0000-memory.dmp upx behavioral2/files/0x000c00000001c5fe-198.dat upx behavioral2/memory/1384-200-0x00007FFA45000000-0x00007FFA4501A000-memory.dmp upx behavioral2/files/0x000c00000001c5fc-201.dat upx behavioral2/files/0x000c00000001c601-203.dat upx behavioral2/memory/1384-206-0x00007FFA447E0000-0x00007FFA447ED000-memory.dmp upx behavioral2/memory/1384-208-0x00007FFA44220000-0x00007FFA4422F000-memory.dmp upx behavioral2/memory/1384-209-0x00007FFA31350000-0x00007FFA31A5D000-memory.dmp upx behavioral2/memory/1384-210-0x00007FFA45020000-0x00007FFA45049000-memory.dmp upx behavioral2/memory/1384-211-0x00007FFA451C0000-0x00007FFA451DA000-memory.dmp upx behavioral2/memory/1384-228-0x00007FFA447E0000-0x00007FFA447ED000-memory.dmp upx behavioral2/memory/1384-227-0x00007FFA45000000-0x00007FFA4501A000-memory.dmp upx behavioral2/memory/1384-226-0x00007FFA3CE40000-0x00007FFA3CEC0000-memory.dmp upx behavioral2/memory/1384-225-0x00007FFA44230000-0x00007FFA4425C000-memory.dmp upx behavioral2/memory/1384-229-0x00007FFA31350000-0x00007FFA31A5D000-memory.dmp upx behavioral2/memory/1384-223-0x00007FFA4B4B0000-0x00007FFA4B4BF000-memory.dmp upx behavioral2/memory/1384-221-0x00007FFA44220000-0x00007FFA4422F000-memory.dmp upx behavioral2/memory/1384-224-0x00007FFA451C0000-0x00007FFA451DA000-memory.dmp upx behavioral2/memory/1384-222-0x00007FFA45020000-0x00007FFA45049000-memory.dmp upx - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1160 wrote to memory of 1384 1160 2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Loads dropped DLL
PID:1384
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\VCRUNTIME140_1.dll
- Size 48KB
- SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
- MD5 c0c0b4c611561f94798b62eb43097722
- SHA1 523f515eed3af6d50e57a3eaeb906f4ccc1865fe
- SHA512 35db454dbcc7ed89842c0440b92ce0b0b0db41dbd5432a36a0b7e1eddf51704b1f0d6cff5e3a3b0c3ff5db3d8632fed000471180ad72e39d8dbe68a757ccdfb0
- SSDEEP 768:vzzO6ujT3MbR3v0Cz6Sz5q83ywug1HDV9zxfYbK9z:mq/oMx3hXHDnzxfYiz
- TLSH T1AE236BA453784486D4AB99B0C0DAEE577D7CFA964B10928F0BA0D15C1F637D0EB3D21B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\_bz2.pyd
- Size 51KB
- SHA256 cdc0bf280dad8ccf4de334f9c1428fcf4a4ddc02877d123b84155f5b23213465
- MD5 9b684b1cfcbe38bafe89feefcea91198
- SHA1 ca5d0088ed37cb336c70986d7c58e4c68339f18b
- SHA512 349ff598a76b9208e94215508595cbb524749b49b692ad41f82da23cf3a7ef51729208737aed4234cbc5b1c31de6f849de4c4d1948211059ae2b687d95cc611c
- SSDEEP 1536:BU3AbrYSflL4ncPAQ7/oZLIG3VYey1Ni9QfIY6utw:yPcL4nc5EIG3VYYKtw
- TLSH T12733D0CB83794012E767597161E8DD86FA3A6BD34011879A34DEF29A0F533D16F2332A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\_ctypes.pyd
- Size 67KB
- SHA256 963263a9c9fa3eaaa71429000eee88fb5172aca521d1319e917dc3245e5ac105
- MD5 49f14dd727fbc6e42a2abb86fbfc24ed
- SHA1 45968bf527dd80f2a3816f05360d5638f6aa0514
- SHA512 35fe02167bc2fef57604591004571d2b9c3507cbd9cae52fe7f465e15a2e4069b4d75bc8e55b5dce6a3cd544e437d8c6acd7320df85ac2b7b8836622189211f1
- SSDEEP 1536:RGsidR9UsGWPmlmCzZ/wsVW6uyaIj4pfoti7+IGGPPty1Ni9nvfIL3qc:R/IPGW/C1Ys86VUpWiSIGGPPpoGc
- TLSH T14863F1CB00F58057EE939D709794E956BB35F7D32A24CE6E30CDE1620E1A7C2A356234
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\_lzma.pyd
- Size 88KB
- SHA256 67e4a9e58fb9c73909b80d6e80abb11a82b39dba12fd759b05f3bd4b4cf3349f
- MD5 7a5e79ddb8af204efbdc003a936c304e
- SHA1 94d240af433bd63c0d5ab4375df5cc0cb402bd4e
- SHA512 b5332e9713b380366bf0d38e6c2d189d7f2cd508aa5c5a088c675c66ad0fff3a1e14ec66cc385bce51d8c6c96fbba1bfb960552e6077762d37728d53bb7b9067
- SSDEEP 1536:DbCORtk/GFJL/D1c0VkwjHnOFm9b/uko4J3b4ohwTmZ2ywBIGI1P0y1Ni9efIYCk:qORuGFt/HkG/G4J3b4GwTm8tIGI1Pwk
- TLSH T1039302DFD7B88063EEB32D3052F6C6427934A7EB512596A724DF71920E233C4A393225
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\_queue.pyd
- Size 28KB
- SHA256 182f3fb5d7bb863e9b222db905b2e48210b9a9e50ed521d0d9e2dffbd66c3de6
- MD5 040ea0df0bd68918aa7fcd559f7160cf
- SHA1 1eba0305dfda1cb751bf2fffc219d47982ce0097
- SHA512 0585987a5e7d465e8f2e821802760320a40b9928e73a5ab328f39d551df28c470051dad17b842961db8d119e4713ed5c04cca740878cb5d831b2fa9be1e36a56
- SSDEEP 768:Y2YI3si/fuHLhpSDIGRUtzy1KPuBL2Ip4FTxf1mlIJdpS:YpHKDIGRUtzy1Ni9/fIkdo
- TLSH T101D29FCB46789067EAB37E7152E4DD82FA35BBE35811972B30EC61A60E633C19313275
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\_socket.pyd
- Size 46KB
- SHA256 093a959826ebb3d0b682bcb6cf25d45faeada43f340560301a6f6dd7789b814f
- MD5 943644a11f2d78ef5351e986c93f204b
- SHA1 c39f47d5181b63a62660435a3c2ff601142eb3c0
- SHA512 cc9f16fd6df91b4f7a9ba3dbc14c2cccbed8045c0c01df784c54d5ed2440c6110f77e52d83ac37afe98f46014570919e4bf36b546ce950caabafd5d0b14b22e8
- SSDEEP 768:YlRvR/zcKTGGtU7gujesZiZJx2u/Y6wOEJPuEGptayIGGwYYtky1KPuBL2Ip4D/6:gvRYKTGooe4ifT/h7uGdayIGGwYAky1/
- TLSH T17523DFE70268E053EEB79A70A290D9C2F6797FA31056972B30DDA1960E733C1DF06325
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\_wmi.pyd
- Size 30KB
- SHA256 6d4b27ac25a1ac09b71b4a96ddfe6f0b4e19457d600e083a3a9a887762f836d2
- MD5 4bba3e011a97424c46a64b974f8faf33
- SHA1 164a493b6258979574d0a735235fe4c91d8bdff2
- SHA512 206c0b8ecbebe005f4f92cd6f96b2144b647153eb5584975fa3c8213f5e860ef0a6e84c87a834131b2d8de13b7b8507bbc87f142de1bed6baaf5eaf04d8a1340
- SSDEEP 768:O+So74TudMdaHYOe0vpLbBIG3iNGFy1KPuBL2Ip4FTxf1ml6Z+7UlFg5yK:XSoUfcYVKbBIG3iNGFy1Ni9/fILKq1
- TLSH T114E29EC7457C826AFE73A93092D4DD83FA34BBE744268B27309952A60E633C1E303365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\_zstd.pyd
- Size 176KB
- SHA256 a4ab7ff03b7b980d3d235efcf4630b607e157a66e6cc61e0aa416506dbe565e6
- MD5 1ef9b685c404a0d94e23f63d85c07a42
- SHA1 192b33983aa35c64e72d58aa98b39203223638eb
- SHA512 65d542b3b3f3e3d63d94cb5c62a2c992be8389c3a592701de8d2f06694b33ae1665a641d76f635efbefe659b4ed651b211366db4e8fe7a8e1913c2aabf8e2220
- SSDEEP 3072:ehpoyewfJKn+G206ETjJIiMdzVe67MALvIGIMW5yp:e/opwxe+GP6E/JMdHicp
- TLSH T15D0412C741F85256C727493173A4F8899739BBE36C98C72270A13A356FEFB81432719A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\base_library.zip
- Size 1.3MB
- SHA256 091af87b59d23d103b776cc7af718d16c2be3fc59cde20f3f3763014a03366c4
- MD5 3a065441c4310c4d733af1a77b721ed9
- SHA1 9cb23c65bd356c9b55fe80918631bea09e77cad7
- SHA512 f2691cafd283d751fa08193fdcbd42ed981dd4258773403364dc6300af649cf4ed1a2d804654fe55e4b4f58da00de132b7f1cba94835e4c1f9345c45043b3351
- SSDEEP 24576:xnHlb4IYOQZKuUF2dF6QeOdP2m2dfKRplLYA:PYOBuUF2dI/iRl
- TLSH T1EC552BA1B9917967FEC9F37A35B75A0CA715C0109B10D303B4A88DAC6FDF260AE558CC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\libffi-8.dll
- Size 29KB
- SHA256 7d08df2c496c32281bf9a010b62e8898b9743db8b95a7ebee12d746c2e95d676
- MD5 be8ceb4f7cb0782322f0eb52bc217797
- SHA1 280a7cc8d297697f7f818e4274a7edd3b53f1e4d
- SHA512 07318c71c3137114e0cfec7d8b4815fd6efa51ce70b377121f26dc469cefe041d5098e1c92af8ed0c53b21e9c845fddee4d6646d5bd8395a3f1370ba56a59571
- SSDEEP 768:Pp/6aepjG56w24Up3p45YiSyvkIPxWEqG:1A154spK7SytPxF
- TLSH T153D2CFF34521FC39DD53EC7238D88434FB31BA8655A142E3521AD1BA4FA47822BA52FD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\python3.DLL
- Size 72KB
- SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
- MD5 a5495a547b4218148914469f1ee65d47
- SHA1 91632b2965ae22db25edce6971cf59c0a3a00bba
- SHA512 ab1fe6ec0b21fdac78b17afc0fd3a7573b89647a3e4af846448e285a7989342f4a8eaf191a4e90e81a990f10ff1364dd941a0c7f80c108224d8f6c7cf6bb49d1
- SSDEEP 768:xHQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKp:0bTrnXngXMu8IGG0ly1Ni94fIk0h4
- TLSH T168735D4E6B54F8A2DAB629FC78D199CE242B12FC5F2584DFA47CD3D20D1A310A22735D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\python314.dll
- Size 1.9MB
- SHA256 586f2e53001e52ffaa8791bf0a9e20f6f405d4e4b601aaeb2847070f7e3c01b7
- MD5 516dc8b2dfff1fd68b67db514004f841
- SHA1 7154f5e6672858e105a4f01c893dcfe28c63b88d
- SHA512 ca7e474783834649db2fdacd50f21af1c2d9d1f44989cae064425e5033b0873464374df2bdf4e0450cd66c30326e98b41509b05639bcd7baa20eb833102ab4e1
- SSDEEP 49152:6My2faTCo0YnFx47dAevr8t41sdjQdCke3Yh6wGvNfdnJz:Ryeuf4yy8Km8eo6wsf7
- TLSH T18F9533326EDAC2F7D9E2FCF24D91D70B6A5D260CC72522D6E528C3C2490BE528D1B257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\ucrtbase.dll
- Size 1.1MB
- SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
- MD5 3b337c2d41069b0a1e43e30f891c3813
- SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
- SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
- SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
- TLSH T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
- MD5 SHA1 SHA512 SSDEEP TLSH