Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 03:47

General

  • Target
    2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 20.0MB
  • Sample260807-ecf8tswhrf
  • SHA256 a981716d812a82372fb7a5263b71e06d25f71e1a115fc2f2e9234a944ca2b695
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 14 IoCs
  • UPX packed file 30 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1160
    • C:\Users\Admin\AppData\Local\Temp\2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-07_ad0f33bae398f688b42a62cd754de44d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      PID:1384

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VCRUNTIME140_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _bz2.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\_bz2.pyd
        • Size 51KB
        • SHA256 cdc0bf280dad8ccf4de334f9c1428fcf4a4ddc02877d123b84155f5b23213465
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _ctypes.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\_ctypes.pyd
        • Size 67KB
        • SHA256 963263a9c9fa3eaaa71429000eee88fb5172aca521d1319e917dc3245e5ac105
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _lzma.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\_lzma.pyd
        • Size 88KB
        • SHA256 67e4a9e58fb9c73909b80d6e80abb11a82b39dba12fd759b05f3bd4b4cf3349f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _queue.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\_queue.pyd
        • Size 28KB
        • SHA256 182f3fb5d7bb863e9b222db905b2e48210b9a9e50ed521d0d9e2dffbd66c3de6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _socket.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\_socket.pyd
        • Size 46KB
        • SHA256 093a959826ebb3d0b682bcb6cf25d45faeada43f340560301a6f6dd7789b814f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _wmi.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\_wmi.pyd
        • Size 30KB
        • SHA256 6d4b27ac25a1ac09b71b4a96ddfe6f0b4e19457d600e083a3a9a887762f836d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _zstd.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\_zstd.pyd
        • Size 176KB
        • SHA256 a4ab7ff03b7b980d3d235efcf4630b607e157a66e6cc61e0aa416506dbe565e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base_library.zip

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\base_library.zip
        • Size 1.3MB
        • SHA256 091af87b59d23d103b776cc7af718d16c2be3fc59cde20f3f3763014a03366c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libffi-8.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\libffi-8.dll
        • Size 29KB
        • SHA256 7d08df2c496c32281bf9a010b62e8898b9743db8b95a7ebee12d746c2e95d676
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python3.DLL

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\python3.DLL
        • Size 72KB
        • SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python314.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\python314.dll
        • Size 1.9MB
        • SHA256 586f2e53001e52ffaa8791bf0a9e20f6f405d4e4b601aaeb2847070f7e3c01b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ucrtbase.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI11602\ucrtbase.dll
        • Size 1.1MB
        • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/1384-188-0x00007FFA4B4B0000-0x00007FFA4B4BF000-memory.dmp

        memory/1384-211-0x00007FFA451C0000-0x00007FFA451DA000-memory.dmp

        memory/1384-195-0x00007FFA44230000-0x00007FFA4425C000-memory.dmp

        memory/1384-200-0x00007FFA45000000-0x00007FFA4501A000-memory.dmp

        memory/1384-191-0x00007FFA451C0000-0x00007FFA451DA000-memory.dmp

        memory/1384-186-0x00007FFA45020000-0x00007FFA45049000-memory.dmp

        memory/1384-177-0x00007FFA31350000-0x00007FFA31A5D000-memory.dmp

        memory/1384-206-0x00007FFA447E0000-0x00007FFA447ED000-memory.dmp

        memory/1384-208-0x00007FFA44220000-0x00007FFA4422F000-memory.dmp

        memory/1384-209-0x00007FFA31350000-0x00007FFA31A5D000-memory.dmp

        memory/1384-210-0x00007FFA45020000-0x00007FFA45049000-memory.dmp

        memory/1384-197-0x00007FFA3CE40000-0x00007FFA3CEC0000-memory.dmp

        memory/1384-228-0x00007FFA447E0000-0x00007FFA447ED000-memory.dmp

        memory/1384-227-0x00007FFA45000000-0x00007FFA4501A000-memory.dmp

        memory/1384-226-0x00007FFA3CE40000-0x00007FFA3CEC0000-memory.dmp

        memory/1384-225-0x00007FFA44230000-0x00007FFA4425C000-memory.dmp

        memory/1384-229-0x00007FFA31350000-0x00007FFA31A5D000-memory.dmp

        memory/1384-223-0x00007FFA4B4B0000-0x00007FFA4B4BF000-memory.dmp

        memory/1384-221-0x00007FFA44220000-0x00007FFA4422F000-memory.dmp

        memory/1384-224-0x00007FFA451C0000-0x00007FFA451DA000-memory.dmp

        memory/1384-222-0x00007FFA45020000-0x00007FFA45049000-memory.dmp