a8076f07b1b39d3b8d58483ff081d96437ebccdad20605a126424dbe8f2cf1ee

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 18:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_ea270e33c111ae373cdfe51bf5efc8e0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 14.1MB
Sample260809-wpflhawvbz
SHA256 a8076f07b1b39d3b8d58483ff081d96437ebccdad20605a126424dbe8f2cf1ee
MD5 ea270e33c111ae373cdfe51bf5efc8e0
SHA1 0c122f9dc7f7ea3dfef47172053343bdd83b1770
SHA512 a0fcfa411577bf5324ee329f51e266448f0969aa1e099640e4ca92804312a6cff1d77c9689e3ead10eb520ccfe2ad34fe784ae53a170b261b46161937c405734
SSDEEP 393216:1dCQAroEAmURLAD1idq1B7wgqHsoq5bpin:15UodmUJAD1ig1knEbp
TLSH
T150E6336A02E105D7E99BF33D42F79457D772B4091720CCCF07A482B96EA72E24D39E92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c60e-90.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c60e-90.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Executes dropped EXE 1 IoCs

pid	Process
4900	tmpw98rf7yd.exe

Loads dropped DLL 10 IoCs

pid	Process
6360	2026-08-09_ea270e33c111ae373cdfe51bf5efc8e0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6360	2026-08-09_ea270e33c111ae373cdfe51bf5efc8e0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6360	2026-08-09_ea270e33c111ae373cdfe51bf5efc8e0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6360	2026-08-09_ea270e33c111ae373cdfe51bf5efc8e0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6360	2026-08-09_ea270e33c111ae373cdfe51bf5efc8e0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6360	2026-08-09_ea270e33c111ae373cdfe51bf5efc8e0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6360	2026-08-09_ea270e33c111ae373cdfe51bf5efc8e0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6360	2026-08-09_ea270e33c111ae373cdfe51bf5efc8e0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6360	2026-08-09_ea270e33c111ae373cdfe51bf5efc8e0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
6360	2026-08-09_ea270e33c111ae373cdfe51bf5efc8e0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1816	tasklist.exe
5548	tasklist.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1952	cmd.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6392	wmic.exe
6392	wmic.exe
6392	wmic.exe
6392	wmic.exe
5452	wmic.exe
5452	wmic.exe
5452	wmic.exe
5452	wmic.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	6392	wmic.exe
Token: SeSecurityPrivilege	6392	wmic.exe
Token: SeTakeOwnershipPrivilege	6392	wmic.exe
Token: SeLoadDriverPrivilege	6392	wmic.exe
Token: SeSystemProfilePrivilege	6392	wmic.exe
Token: SeSystemtimePrivilege	6392	wmic.exe
Token: SeProfSingleProcessPrivilege	6392	wmic.exe
Token: SeIncBasePriorityPrivilege	6392	wmic.exe
Token: SeCreatePagefilePrivilege	6392	wmic.exe
Token: SeBackupPrivilege	6392	wmic.exe
Token: SeRestorePrivilege	6392	wmic.exe
Token: SeShutdownPrivilege	6392	wmic.exe
Token: SeDebugPrivilege	6392	wmic.exe
Token: SeSystemEnvironmentPrivilege	6392	wmic.exe
Token: SeRemoteShutdownPrivilege	6392	wmic.exe
Token: SeUndockPrivilege	6392	wmic.exe
Token: SeManageVolumePrivilege	6392	wmic.exe
Token: 33	6392	wmic.exe
Token: 34	6392	wmic.exe
Token: 35	6392	wmic.exe
Token: 36	6392	wmic.exe
Token: SeIncreaseQuotaPrivilege	6392	wmic.exe
Token: SeSecurityPrivilege	6392	wmic.exe
Token: SeTakeOwnershipPrivilege	6392	wmic.exe
Token: SeLoadDriverPrivilege	6392	wmic.exe
Token: SeSystemProfilePrivilege	6392	wmic.exe
Token: SeSystemtimePrivilege	6392	wmic.exe
Token: SeProfSingleProcessPrivilege	6392	wmic.exe
Token: SeIncBasePriorityPrivilege	6392	wmic.exe
Token: SeCreatePagefilePrivilege	6392	wmic.exe
Token: SeBackupPrivilege	6392	wmic.exe
Token: SeRestorePrivilege	6392	wmic.exe
Token: SeShutdownPrivilege	6392	wmic.exe
Token: SeDebugPrivilege	6392	wmic.exe
Token: SeSystemEnvironmentPrivilege	6392	wmic.exe
Token: SeRemoteShutdownPrivilege	6392	wmic.exe
Token: SeUndockPrivilege	6392	wmic.exe
Token: SeManageVolumePrivilege	6392	wmic.exe
Token: 33	6392	wmic.exe
Token: 34	6392	wmic.exe
Token: 35	6392	wmic.exe
Token: 36	6392	wmic.exe
Token: SeDebugPrivilege	5548	tasklist.exe
Token: SeDebugPrivilege	1816	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5452	wmic.exe
Token: SeSecurityPrivilege	5452	wmic.exe
Token: SeTakeOwnershipPrivilege	5452	wmic.exe
Token: SeLoadDriverPrivilege	5452	wmic.exe
Token: SeSystemProfilePrivilege	5452	wmic.exe
Token: SeSystemtimePrivilege	5452	wmic.exe
Token: SeProfSingleProcessPrivilege	5452	wmic.exe
Token: SeIncBasePriorityPrivilege	5452	wmic.exe
Token: SeCreatePagefilePrivilege	5452	wmic.exe
Token: SeBackupPrivilege	5452	wmic.exe
Token: SeRestorePrivilege	5452	wmic.exe
Token: SeShutdownPrivilege	5452	wmic.exe
Token: SeDebugPrivilege	5452	wmic.exe
Token: SeSystemEnvironmentPrivilege	5452	wmic.exe
Token: SeRemoteShutdownPrivilege	5452	wmic.exe
Token: SeUndockPrivilege	5452	wmic.exe
Token: SeManageVolumePrivilege	5452	wmic.exe
Token: 33	5452	wmic.exe
Token: 34	5452	wmic.exe
Token: 35	5452	wmic.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 6360	848	2026-08-09_ea270e33c111ae373cdfe51bf5efc8e0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 6360 wrote to memory of 1952	6360	2026-08-09_ea270e33c111ae373cdfe51bf5efc8e0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	91
PID 1952 wrote to memory of 4900	1952	cmd.exe	93
PID 4900 wrote to memory of 6392	4900	tmpw98rf7yd.exe	94
PID 4900 wrote to memory of 5548	4900	tmpw98rf7yd.exe	96
PID 4900 wrote to memory of 1816	4900	tmpw98rf7yd.exe	97
PID 4900 wrote to memory of 5452	4900	tmpw98rf7yd.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-08-09_ea270e33c111ae373cdfe51bf5efc8e0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_ea270e33c111ae373cdfe51bf5efc8e0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\2026-08-09_ea270e33c111ae373cdfe51bf5efc8e0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-09_ea270e33c111ae373cdfe51bf5efc8e0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:6360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmpw98rf7yd.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\tmpw98rf7yd.exe
      C:\Users\Admin\AppData\Local\Temp\tmpw98rf7yd.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4900
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" nic where NetEnabled=true get MACAddress
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6392
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:5548
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1816
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" ComputerSystem get TotalPhysicalMemory
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\_bz2.pyd
Size 85KB
SHA256 a4be36fffeefa8b24c1234d548da8f05558aba53c2ea7d1d2614776eaad8fbf4
MD5 a0946ac3236b70d27de6046ccc467977
SHA1 84f2aa56e58849cf30e632e7eaab4901a681f08c
SHA512 02429781f017b534918657e5c152ea022b52bcddd15ecca7f8b4629940dd4367a09af4d86a1f05d946ca97f2709718b136003693088c480d9b791e4d18361174
SSDEEP 1536:vZAVNz7DkEvkmFfR/l/kM4KPkM/gg8IWRbG3II13VAyvcvR9qfIk2:vGVNzUERn9R4KRg7NlSII13Vk
TLSH
T1A2838E96F3B552B6F59B91B886840793F730BB860750A3AFF14882853F13BD06E5C369
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cffi_backend.cp314-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\_cffi_backend.cp314-win_amd64.pyd
Size 177KB
SHA256 58bbe1eb15f9ab8e9ea45715a8311e2366b360d910a4685448bdd728d5177a01
MD5 6b28010dc48e5ea1fad1c9ce83cf8dac
SHA1 5239488b539fd8f5887ab766b368e0c305c3805a
SHA512 db867424841c37e55d6aedbde6acc88b8b8e2806cd8619dc76cb33f949ffecf1a5869a7a4ab145743a00fe20da4ff0ac07350ddfb1245d8441b69bd1d97af8f6
SSDEEP 3072:jpx2gGxvaAuzyJ4vSBGqNX2LstgUzBwDc34YLn+Sz4u6H+S7wxSTL7KDYRepDfH:jpD5yJ4vSBjmstgUzBAc34YL+vbepxSQ
TLSH
T1A6045D5A329C10B2D5A64178CA679B83E7B3B461171097CF0160C6B62F1FBE67A7FB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\_lzma.pyd
Size 157KB
SHA256 f7ad11fbbb7aeaf7b6566a532a3243e3ae5f92bac480dbe5c2ef300fe2c1dabe
MD5 1dfaf924b4576f551f6dfe3cae50b230
SHA1 ef19846989f337e600c8f9ccacbd4276cc4d35f0
SHA512 2df6a600ecd03de76f066f87a8dd13bf138a51f89fe745813d7a00418fb716c670cb04a9b5573d2b852fc8885acac8b960ba4c42d38fcb7e9a1d2aa2e84f90a9
SSDEEP 3072:z+0m6DKDYtwipfxAbDcoAL+Uznfx9mNoV+dREOII1I1+ZgTT:iTCKDYvNoopYOyGOjeT
TLSH
T182F34C86B794F0D6F3628C78D6618F53E7F5781A0320929A01CC976D2B1FB759A2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\_zstd.pyd
Size 491KB
SHA256 536a3b521a3c42d2827ece0ccfbe40b83a2fd96a0f5496cd60b943b10e1266d4
MD5 b89f5d1345ef95f80ddcbe5b3e4e5bb3
SHA1 2daee236009cc3efe02dc9bbbd8c6faa8ac56478
SHA512 fc925424ad4bd8bdfae04b95fdadfcdbffcac76270997b4ce365be8a47d4c636b7e0b31e78d785a3dc6c9b2dd0f108aa716a92ee4f0506f3a0329e4a424b48e9
SSDEEP 12288:X/WcJlzAwk9mH+65GRRfODoHWDTrWl93mFgR:X/WcJywk9mH+KGRRf2o2YR
TLSH
T1A5B48D43F29983EDE17BC4B8CF465A53FBB1780B1214565B93A5CB943F07B309A6A308
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\base_library.zip
Size 1.3MB
SHA256 1adfccc020613929765ef3c21da39c4c46fa1de818a40a98d290fca35e9900cf
MD5 24aa419d0266730a3b5e3a49e2382d12
SHA1 235f168d520062c250806af7a80a9fc6aeca2cc6
SHA512 2b559ae1af61990b622fef9985dfe0994d46273b2463a3f6c274f0367384c856e4e5d793597af07df60189acb20652c9577ed15d73c7c00c419d726369bbba94
SSDEEP 24576:7drRQeOdP2m2dfTlblLpuUFsxRp5OnT3F2:7drR/NuUF0RG30
TLSH
T133552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_rust.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\cryptography\hazmat\bindings\_rust.pyd
Size 9.5MB
SHA256 05fefb14b1cb1c90bcccce87e82d205f5f2396977bf911243972790ba2376849
MD5 cec66bee731cbd60c31138fed67f6e92
SHA1 7cbfaa92d129f3fcf61f6cb1236ce8490ae5e023
SHA512 790522a4a30cd2ce83162655a425bc57e712dbd18136aea284950cf7cc0a9fbca8dbf1401c91581545f85eca17d45432b61d67cd40b934495d9acc284c20d3ee
SSDEEP 98304:LAadJbjXC6tI8uaQlpC4tRoNKraZkEHs5KBMU3Y+zWW35I7kgni+LBl:J3k6QKBMU3Y+zD35KkgiM
TLSH
T108A66B25BAA950A8D86AC4B8C34752339B3074DA1B747AFF49D486B52F36BF01B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\python3.DLL
Size 72KB
SHA256 be1017ca4ca8ff837efbb343d5c8f739bd67bd1c43fb41068a539b19357c0213
MD5 8d3d1ffbe3bb9539402e8bccb7fadcf8
SHA1 904397a69e08c93fc2080a3cdbf6810bc40313fc
SHA512 312fd7f95d2a76d9dd09336949d3b8ca9b53753a9f45da9d2fec128b2746f128fc1354693e0a995c1e1859a3d90497c8a4a8d4fedffc8bceee0392c456efc68a
SSDEEP 768:IQlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIU:xbTrnXngXMBEI1G0hyvcvR9NfIko
TLSH
T1C0734D5E6B54F8A2D6B629FC78D199CE242B12FC5F2984DFA47CD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\python314.dll
Size 6.4MB
SHA256 1ac15e2224581fc678bbd17728b9aa538d47b891b72c76499ef07e54cd74f151
MD5 5bc0adc1fed509f353832bde6b2add62
SHA1 b2204b0bc93877fcd186d72fbe5006130aa0fb88
SHA512 7b1e52aff81e5e79872d9a22c0218dd8fc46e99cb33adb69d277ea07b21eee0399f0a6a72d190b91f26a96e69aa63a23a06384b9d93db44355f3eb1d7f727650
SSDEEP 98304:YvvKimE4QWS5v+kr/YFboltx9E8rDvQHDMiE2hx0S:qdcQWS5v+kLMolGmidx0S
TLSH
T107668D26737505A5D8BB8076C9034647DBB1BC00AB30D34B49A4B6DA3F733635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI8482\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpw98rf7yd.exe

Path C:\Users\Admin\AppData\Local\Temp\tmpw98rf7yd.exe
Size 3.6MB
SHA256 86bc1d8487f4c48e917af8a25427192a4fea7a77aa9780fc8c15faabbd77f78c
MD5 3b0783f76056bc9f89ad6f7cd1ebe411
SHA1 f4a51948ff8eacc47d2df0e265b4567a98ef0f12
SHA512 42a7a1f1fa820d7d21fd1f9a9ec451cde8d530db4d1960bb9d93dd57187e6dcd9bb28303908bfdaf7796eebb61af16839e7940b049099d18e94c355d4df68ef6
SSDEEP 49152:zS+rD23AG4UqWfCTaBWbv/bUR7aveBZzCLduSKR7Op8COhTGL0rIXfq6B7qOr:zSE2CrbOmoNnhsB7/
TLSH
T18A067D43F79581E9D0AEC178C71A9323EB72B88D2720A6AB27D48A313F53B605F5D354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download