2c1e9f98f14e8c2d456a3cc45f5167b196f61cc4523837668c41d9cf90b16137

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 03:36

Target
2026-08-13_c40df9b23ed8b748d208863954b589a4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 4.3MB
Sample260813-d5182a1cla
SHA256 2c1e9f98f14e8c2d456a3cc45f5167b196f61cc4523837668c41d9cf90b16137
MD5 c40df9b23ed8b748d208863954b589a4
SHA1 ab0c787e298c066d475fbdc6d6d6d740f9bc7f27
SHA512 ae7771c1a549a0630de1e94624db259bef2b1e1a98935dbb345c4f4f21fc231810309696f37ce34b4c362dba2a0451f32711bf8ee2c7cd32fd76e6150bdfdf09
SSDEEP 98304:wNYjb8uwDiXYthNyMq4xzSSNKJziiW2j:Rb8uwDiXYthV1uS0FiiW2j
TLSH
T1A2268C5AB29E04D5F523703886536E4BC13AB4192321A3DB768606192FFFBD0B77E349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

Disable or Modify System Firewall

pid	Process
3220	netsh.exe
1300	netsh.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
624	2026-08-13_c40df9b23ed8b748d208863954b589a4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
624	2026-08-13_c40df9b23ed8b748d208863954b589a4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 3220	624	2026-08-13_c40df9b23ed8b748d208863954b589a4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	89
PID 624 wrote to memory of 1300	624	2026-08-13_c40df9b23ed8b748d208863954b589a4_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	91