Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/08/2026, 03:54

General

  • Target
    2026-08-13_ad9417147f4394a3123ced9150f82e68_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 14.4MB
  • Sample260813-ef91ba1dpf
  • SHA256 9451ea3fd20a814147ac17147c28a917b3c3fcf55263debc96995220c1937602
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Outbound SSH connection to private host 3 TTPs 1 IoCs

    SSH is used for remote access. Internal traffic may indicate local host discovery or lateral movement.

  • Loads dropped DLL 27 IoCs
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_ad9417147f4394a3123ced9150f82e68_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_ad9417147f4394a3123ced9150f82e68_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1552
    • C:\Users\Admin\AppData\Local\Temp\2026-08-13_ad9417147f4394a3123ced9150f82e68_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-13_ad9417147f4394a3123ced9150f82e68_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Outbound SSH connection to private host
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:876
      • C:\Windows\SYSTEM32\arp.exe
        arp -a
        3⤵
        • Network Service Discovery
        PID:4816
      • C:\Windows\SYSTEM32\notepad.exe
        notepad.exe
        3⤵
          PID:4156

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\VCRUNTIME140.dll
          • Size 116KB
          • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
          • MD5 SHA1 SHA512 SSDEEP TLSH

          VCRUNTIME140_1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _asyncio.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_asyncio.pyd
          • Size 69KB
          • SHA256 3b46fa8f966288ead65465468c8e300b9179f5d7b39aa25d7231ff3702ca7887
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _brotli.cp312-win_amd64.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_brotli.cp312-win_amd64.pyd
          • Size 802KB
          • SHA256 788acbfd0edd6ca3ef3e97a9487eeaea86515642c71cb11bbcf25721e6573ec8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _bz2.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_bz2.pyd
          • Size 83KB
          • SHA256 cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _cffi_backend.cp312-win_amd64.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_cffi_backend.cp312-win_amd64.pyd
          • Size 177KB
          • SHA256 53de34afc3939d81bf2498b77425c52e2c3f3164f8cfe2543d3acc8f24134488
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _ctypes.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_ctypes.pyd
          • Size 122KB
          • SHA256 6c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _decimal.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_decimal.pyd
          • Size 251KB
          • SHA256 da8bb3d54bbba20d8fa6c2fd0a4389aec80ab6bd490b0abef5bd65097cbc0da4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _elementtree.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\_elementtree.pyd
          • Size 130KB
          • SHA256 798e8ddfc45495c26593a0550554e32a62cbdd9da5556e25da7231a0bf8fd274
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-console-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-console-l1-1-0.dll
          • Size 18KB
          • SHA256 4aaf273c4cb1d93b8c8686843ffbc577d31e1c010e02ae8e72478c5b52dda06d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-datetime-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-datetime-l1-1-0.dll
          • Size 18KB
          • SHA256 a580c502170462431a197954eada3a2b92cddda8e77d489475a8fa6da0000349
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-debug-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-debug-l1-1-0.dll
          • Size 18KB
          • SHA256 b83a794600a47be935cc562ace7a4d531083c76fcc8ac6424d008f1034eedf96
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-errorhandling-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-errorhandling-l1-1-0.dll
          • Size 18KB
          • SHA256 3975ca725ae8f6f635560329ee00e214f58d6a2c9e8d355756481f92c068cd43
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-file-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-file-l1-1-0.dll
          • Size 21KB
          • SHA256 d62e2dcb011f08b416addaa11d07fc295427f57ca31b0098a71cc7ed6fe2e95e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-file-l1-2-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-file-l1-2-0.dll
          • Size 18KB
          • SHA256 6b31a206c051815be9f7b366d2a9d2464747a56888a7307a924ecdac558271e1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-file-l2-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-file-l2-1-0.dll
          • Size 18KB
          • SHA256 6ba964ad55822f55eea14f73a48deb164b337639a82da677fc6efc1c539fe81e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-handle-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-handle-l1-1-0.dll
          • Size 18KB
          • SHA256 69ebc1072b678643a9e64ff6455cc02880da4b542e45f93d6d479fccfb73c07d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-heap-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-heap-l1-1-0.dll
          • Size 18KB
          • SHA256 b41e478248ff99012f2d67813c1ba1b7ca41890289bb9027181c1238f6472e51
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-interlocked-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-interlocked-l1-1-0.dll
          • Size 18KB
          • SHA256 a934ee2bda04576524c4b9e05186179af388bcdf782aef02878a342427f3361d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-libraryloader-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-libraryloader-l1-1-0.dll
          • Size 18KB
          • SHA256 def954361eba9ca81693dde0ceb108136cbc1b5c9e50bafc62182079219d0735
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-localization-l1-2-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-localization-l1-2-0.dll
          • Size 20KB
          • SHA256 2b7e6b54ebc2b9556e2f75e7372d4b2d16758f928b79395b8a55c7acdca93341
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-memory-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-memory-l1-1-0.dll
          • Size 18KB
          • SHA256 1fcc4c3c6c688c02c4b61a4d054d45f97cbf8fbb34f8d306a9d455db7d44f641
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-namedpipe-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-namedpipe-l1-1-0.dll
          • Size 18KB
          • SHA256 3a1bbd714ba09814a42b62eef1abd48c27f4c02c5b0c69975e017406e8037f77
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-processenvironment-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-processenvironment-l1-1-0.dll
          • Size 19KB
          • SHA256 c18fcf72b0b53be9c41c5f8e60f1dcbe15f8a374880f2abb9b5e8aad17a508a0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-processthreads-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-processthreads-l1-1-0.dll
          • Size 20KB
          • SHA256 c042b609479eafbb7eaa98586f4178455ece1db9ffb441f7ec0f8026ed1d0de6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-processthreads-l1-1-1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-processthreads-l1-1-1.dll
          • Size 18KB
          • SHA256 5129795d6e0aeca2fa56aaa56d71d2e9809c2ad77c14265abcb51fe832105e00
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-profile-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-profile-l1-1-0.dll
          • Size 17KB
          • SHA256 49d214f07eced8a966e9ce102cd6a5fec8c9bb47ee3f1d027c23a258142b44b8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-rtlsupport-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-rtlsupport-l1-1-0.dll
          • Size 18KB
          • SHA256 ef8814992833c056235cdfb04214758ec1e5bfc147069d005920f05a18056169
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-string-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-string-l1-1-0.dll
          • Size 18KB
          • SHA256 aaa457e091a2737df36849b0b403eee22ea571ba09dc4f181c7177c2f254a6dd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-synch-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-synch-l1-1-0.dll
          • Size 20KB
          • SHA256 a79597dbacd18716bf6bf0cfaa0c647b862165d48972937669bac03a9d196f71
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-synch-l1-2-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-synch-l1-2-0.dll
          • Size 18KB
          • SHA256 d95346a16d088e510def0eff7cbdcb71d70adf335d0a88a7838c9476590c8f8c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-sysinfo-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-sysinfo-l1-1-0.dll
          • Size 19KB
          • SHA256 5f1801102b5b865c8275588d1a983f6166ccc15794a0a96ce9534889173da06d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-timezone-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-timezone-l1-1-0.dll
          • Size 18KB
          • SHA256 23f035627abed3460e6dbe8436e5b608c7c30f69091011f655f10ee49ebfd282
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-util-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-core-util-l1-1-0.dll
          • Size 17KB
          • SHA256 bb15ccff99ecdd52cf0c5d178ee6ee445bd3192664775ea74d2fa1648b5d1b4a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-conio-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-conio-l1-1-0.dll
          • Size 19KB
          • SHA256 edf658d7655b524f5158b69a189d9715f87ceac701a055acc23ce608e4ea0774
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-convert-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-convert-l1-1-0.dll
          • Size 22KB
          • SHA256 b353bd22b97fd3704557a99359c9ea0b4e0ad8b7e43b5e21700dabd1a1d84923
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-environment-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-environment-l1-1-0.dll
          • Size 18KB
          • SHA256 325e7bb5c8a3c7f9db8698a570b7d9d9424a028d51f937a2dff3dc5ff0b6e457
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-filesystem-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-filesystem-l1-1-0.dll
          • Size 20KB
          • SHA256 b78607f566599e92bfa8ff5de0f28c439207abf17f274a045500a0d107287d41
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-heap-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-heap-l1-1-0.dll
          • Size 19KB
          • SHA256 a57d8275c34c1094f6a4535e23c7bee4759532e08776ff84c5fe487c0f925eb4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-locale-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-locale-l1-1-0.dll
          • Size 18KB
          • SHA256 29abdc8c5396132b004e6751464641b8f0562249333b2257a1d2eb4aecc8d9dc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-math-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-math-l1-1-0.dll
          • Size 26KB
          • SHA256 6a9dd5a4e52c1aa0e341e35e9dc1a6fbf476ebacd64add3a53c146f019a9a4c6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-process-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-process-l1-1-0.dll
          • Size 19KB
          • SHA256 e31fd2a662773f4b2d84d29dc312d5614992b8e1b700840a2f5ae539ad9a21c2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-runtime-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-runtime-l1-1-0.dll
          • Size 21KB
          • SHA256 6e794d0fad29cc5bdd5d0511fd923d3434ed122cff0ed697903900c93c807582
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-stdio-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-stdio-l1-1-0.dll
          • Size 24KB
          • SHA256 513bb1dd16be7491ced8fa2494b604257285f76062525685c2991391d0c048c3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-string-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-string-l1-1-0.dll
          • Size 24KB
          • SHA256 63de06332e8ff15a5bff699e70ed2537a9d273ba62463fa16265d261f3c5bb31
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-time-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-time-l1-1-0.dll
          • Size 20KB
          • SHA256 803b6f86f178e71f462dfdd6521c9f4791059c1fab5dc86de17c34c25e55f8bd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-utility-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\api-ms-win-crt-utility-l1-1-0.dll
          • Size 18KB
          • SHA256 7a578dd2ceb4387ae8f67f6a82ab553ca1570d1588ab6645859e5625585af95c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          base_library.zip

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\base_library.zip
          • Size 1.3MB
          • SHA256 9b7c66de984130027b738ffb19da649897af7cfbdf61262f2ce356916d39ac83
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libcrypto-3.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\libcrypto-3.dll
          • Size 5.0MB
          • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libffi-8.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libssl-3.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\libssl-3.dll
          • Size 774KB
          • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pyexpat.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\pyexpat.pyd
          • Size 197KB
          • SHA256 d32d7722d6ed2b2780c039d63af044554c0ba9cf6e6efef28ebc79cb443d2da0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          python3.DLL

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\python3.DLL
          • Size 66KB
          • SHA256 25a39e721c26e53bec292395d093211bba70465280acfa2059fa52957ec975b2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          python312.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\python312.dll
          • Size 6.6MB
          • SHA256 c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
          • MD5 SHA1 SHA512 SSDEEP TLSH

          select.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\select.pyd
          • Size 30KB
          • SHA256 00bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ucrtbase.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\ucrtbase.dll
          • Size 977KB
          • SHA256 d804ea40eacfc22a5e029b66d6d4f83d81f76a7ead80313b33839253f90af6b7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          unicodedata.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI15522\unicodedata.pyd
          • Size 1.1MB
          • SHA256 bf669344d1b1c607d10304be47d2a2fb572e043109181e2c5c1038485af0c3d7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          memory/876-143-0x00000000648C0000-0x000000006496B000-memory.dmp