a47545c93f934513875264aec5d82b58c235445c665992750c2451388dee98cd

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_61fc08dd6e1e633f3ddda8acffe22621_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 6.7MB
Sample260813-ffbcesbm2s
SHA256 a47545c93f934513875264aec5d82b58c235445c665992750c2451388dee98cd
MD5 61fc08dd6e1e633f3ddda8acffe22621
SHA1 6eced543df6b437b8c8ee186dd91e3ba7008f96e
SHA512 66d37985c5501d7935631854db0ea021142296b1aa4d8d040ac8dc20a88c7f8ceb388df06b1e9a5a8f32699d5ae312d58998513e1bd89fd73fa36ed70437e349
SSDEEP 98304:MCMfowCmltLA1h9eT393YigJhH0yqTu/NWPdHdda9D4oRiKSM/p41w:7RqA1HeT39Iig+c0/aFFRSd
TLSH
T15C663356E3B505FAF8BBC03DC1EAC545EE62389667B2C5CF239412161E73AD1887BB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
4644	2026-08-13_61fc08dd6e1e633f3ddda8acffe22621_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4644	2026-08-13_61fc08dd6e1e633f3ddda8acffe22621_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4644	2026-08-13_61fc08dd6e1e633f3ddda8acffe22621_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
4644	2026-08-13_61fc08dd6e1e633f3ddda8acffe22621_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 4644	2044	2026-08-13_61fc08dd6e1e633f3ddda8acffe22621_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-13_61fc08dd6e1e633f3ddda8acffe22621_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_61fc08dd6e1e633f3ddda8acffe22621_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\2026-08-13_61fc08dd6e1e633f3ddda8acffe22621_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-13_61fc08dd6e1e633f3ddda8acffe22621_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  PID:4644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20442\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20442\_bz2.pyd
Size 82KB
SHA256 1be51ef2b5acbe490217aa1ff12618d24b95df6136c6844714b9ca997b4c7f9b
MD5 37eace4b806b32f829de08db3803b707
SHA1 8a4e2bb2d04685856d1de95b00f3ffc6ea1e76b9
SHA512 1591a263de16373ee84594943a0993721b1e1a2f56140d348a646347a8e9760930df4f632adcee9c9870f9c20d7818a3a8c61b956723bf94777e0b7fb7689b2d
SSDEEP 1536:xqgz7lGeu595+NHRGYWlnswz108Lh3uwtIbCVW7Syqx7T:AgzxAbl3nLhJtIbCVW8T
TLSH
T135839DA3A76166B5F4AB82B999C14363E330FD45075083DFE384835A2F12F917D743AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20442\_decimal.pyd
Size 247KB
SHA256 23bdd07b84d2dbcb077624d6dcbfc66ab13a9ef5f9eebe31dc0ffece21b9e50c
MD5 e4e032221aca4033f9d730f19dc3b21a
SHA1 584a3b4bc26a323ce268a64aad90c746731f9a48
SHA512 4a350ba9e8481b66e7047c9e6c68e6729f8074a29ef803ed8452c04d6d61f8f70300d5788c4c3164b0c8fb63e7c9715236c0952c3166b606e1c7d7fff36b7c4c
SSDEEP 6144:F4aNJPKHCXqKEyKOxVpclJeMvfrZNxKl9qWM53pLW1A+6teJCxc:O2JyHCXqKIMpgeMnr5K4lRxc
TLSH
T1C8445A56A2490CA4DE778074989B4B47FBB278840350D3CF43A4CAA76F577A327BE784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20442\_hashlib.pyd
Size 63KB
SHA256 2ad55e11bddb5b65cdf6e9e126d82a3b64551f7ad9d4cbf74a1058fd7e5993bd
MD5 ba682dfcdd600a4bb43a51a0d696a64c
SHA1 df85ad909e9641f8fcaa0f8f5622c88d904e9e20
SHA512 79c607e58881d3c3dfb83886fe7aa4cddb5221c50499d33fe21e1efb0ffa1fd0d3f52cbe97b16b04fbe2b067d6eb5997ac66dec9d2a160d3cb6d44ffca0f5636
SSDEEP 1536:0WuY1lTorKnYzF9G0pLOjWNBgFIbOIp7Sy0Vxu:tuYc9GIOjiBgFIbOIpqC
TLSH
T1CA537C46A28144A4D96781B9C9A34E57FAF2F1001720ABDF4368C18D2F237D397F6766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20442\_lzma.pyd
Size 155KB
SHA256 663f1087c2ed664c5995a3ffa64546d2e33a0fce8a9121b48cc7c056b74a2948
MD5 3273720ddf2c5b75b072a1fb13476751
SHA1 5fe0a4f98e471eb801a57b8c987f0feb1781ca8b
SHA512 919dbbfcc2f5913655d77f6c4ae9baa3a300153a5821dc9f23e0aceb89f69cb9fb86d6ce8f367b9301e0f7b6027e6b2f0911a2e73255ab5150a74b862f8af18e
SSDEEP 3072:OJlBQV6AniiMeSznf09mNogMKNA/ZttIbZ1bW/9:OJlozifF8YOgbihtL
TLSH
T1C7F34B92A394F4D5F7628C78D6624F53E7F678090310929A02CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20442\_socket.pyd
Size 77KB
SHA256 8f9ede5044643413c3b072cd31a565956498ca07cdd17fb6a04483d388fdad76
MD5 485d998a2de412206f04fa028fe6ba90
SHA1 286e29d4f91a46171ba1e3c8229e6de94b499f1d
SHA512 68591522e9188f06ff81cd2b3506b40b9ad508d6e34f0111819bf5eff47ed9adf95ebfae5d05b685c4f53b186d15cc45e0d831d96be926f7a5762ee2f1341f1f
SSDEEP 1536:sEbflgPFXTcf3uj79/s+S+pzpp+iTFVf7JRIbLw87Sy8Ckxt:smG1U3uj79/sT+pzH+YFVTJRIbLw8eCg
TLSH
T13B736B11A29050A9E273C07AC5635E27FB70F4C117D4A7CF5264CA6E5F23782EE7AB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI20442\base_library.zip
Size 1.4MB
SHA256 d860b0ded9059d0f8f1b5b98dee8cc5949f455a4c031d1e9015152eba7f137f7
MD5 273a1afb4fa1ac0ef4c650ebf5862d60
SHA1 3ca52d5389db98caf8da9b76f627ac366d9e3255
SHA512 af00c14a168b3ce0a209ae25f65ae772fcc6c376d0a94dfd7ad387d429176b410495341012818ccd55aa96d6ae49d11698ea934498874e8a0fee3ba351b5f50d
SSDEEP 24576:TafPpdmzP/Rk5z4HHJTL3cnz/bucEvUFi8QR5p30iwhi:b/REbQR5pPf
TLSH
T1CB6509817982B5B7F804F3BB4026090DB328C5B4FB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20442\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
TLSH
T1E6366A6AA7A80188E5BAC13CCA534617D6B1F816577097CF19A1967C0F33FDA2B3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI20442\python311.dll
Size 5.5MB
SHA256 2835e0f24fb13ef019608b13817f3acf8735fbc5f786d00501c4a151226bdff1
MD5 d06da79bfd21bb355dc3e20e17d3776c
SHA1 610712e77f80d2507ffe85129bfeb1ff72fa38bf
SHA512 e4dd839c18c95b847b813ffd0ca81823048d9b427e5dcf05f4fbe0d77b8f7c8a4bd1c67c106402cd1975bc20a8ec1406a38ad4764ab466ef03cb7eb1f431c38a
SSDEEP 49152:7KUvq5S8qfFIbGoSieBCZjze3eWVWhQNkGDiUWmtAoaOvi26g2je7wkUB3AO1Fp6:7KUvq1quUqjTPGzuvihAs2oH9M8I9URf
TLSH
T164467C2672609461C87B8472EA2F924BD7B67C501F20CB0B51A4B7AA2F73B531EDF345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20442\select.pyd
Size 29KB
SHA256 fb06ac13f8b444c3f7ae5d2af15710a4e60a126c3c61a1f1e1683f05f685626c
MD5 e07ae2f7f28305b81adfd256716ae8c6
SHA1 9222cd34c14a116e7b9b70a82f72fc523ef2b2f6
SHA512 acb143194ca465936a48366265ae3e11a2256aeae333c576c8c74f8ed9b60987daff81647aef74e236b30687a28bc7e3aa21c6aedbfa47b1501658a2bfd117b4
SSDEEP 768:jeUeWEHqTG+RIbQGC5YiSyvkki+AMxkEGu:jeUeWEKTG+RIbQGg7Sy/rxyu
TLSH
T125D29FA76F545885D823C5B2A8E34E16EA35B6558B10C2CF3368C16D4F323C27BB73A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI20442\unicodedata.pyd
Size 1.1MB
SHA256 f28ac3e3ad02f9e1d8b22df15fa30b2190b080261a9adc6855248548cd870d20
MD5 5cc36a5de45a2c16035ade016b4348eb
SHA1 35b159110e284b83b7065d2cff0b5ef4ccfa7bf1
SHA512 9cccbf81e80c32976b7b2e0e3978e8f7350cce542356131b24ebab34b256efd44643d41ee4b2994b9152c2e5af302aa182a1889c99605140f47494a501ef46c1
SSDEEP 12288:iYPYbfjwR6nb8onRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eDq97:iaYbM90IDJcjEwPgPOG6Xyd46q97
TLSH
T1DD355BC9BB828D66D87B31B944D2212F1361C273475B233BB65513285C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads