Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/08/2026, 00:53
General
- Target 2026-08-15_1854daf8b1e4f70997bd09e6ee22f756_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
- Size 23.4MB
- Sample260816-a855lsxwds
- SHA256 3751fbb74d4d18c53250eca728714d47d855ef707fffc288f7294ea5ac01d66f
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 48 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_1854daf8b1e4f70997bd09e6ee22f756_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_1854daf8b1e4f70997bd09e6ee22f756_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JizhiLauncher_Cache\机智启动器_0.5.21_beta.exeC:\Users\Admin\AppData\Local\Temp\2026-08-15_1854daf8b1e4f70997bd09e6ee22f756_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -Command "$gpus = @(); $paths = Get-ChildItem 'HKLM:\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\*' -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match '^\d{4}$' }; foreach ($p in $paths) { $name = $p.GetValue('DriverDesc'); if ($name -match 'AMD' -or $name -match 'Radeon') { $vBytes = $p.GetValue('HardwareInformation.qwMemorySize'); if ($null -eq $vBytes) { $vBytes = $p.GetValue('HardwareInformation.MemorySize') }; $vram = 0; if ($vBytes -is [byte[]]) { if ($vBytes.Length -eq 8) { $vram = [BitConverter]::ToUInt64($vBytes, 0) } elseif ($vBytes.Length -eq 4) { $vram = [BitConverter]::ToUInt32($vBytes, 0) } } else { $vram = [long]$vBytes }; $gpus += @{Name=$name; VRAM=[math]::Round($vram/1GB,1)}; } } $gpus | ConvertTo-Json"3⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
QtCore.pyd
QtGui.pyd
QtWidgets.pyd
_bz2.pyd
_ctypes.pyd
libcrypto-3.dll
libffi-8.dll
MSVCP140.dll
Shiboken.pyd
MSVCP140_1.dll
QtUiTools.pyd
Qt6Core.dll
Qt6Gui.dll
Qt6OpenGLWidgets.dll
Qt6Widgets.dll
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
libssl-3.dll
msvcp140_2.dll
pyside6.abi3.dll
python3.dll
python313.dll
qt6opengl.dll
qt6uitools.dll
select.pyd
shiboken6.abi3.dll
机智启动器_0.5.21_beta.exe
memory/1136-160-0x000001E74A6D0000-0x000001E74A6F2000-memory.dmp
memory/1136-161-0x000001E74ABD0000-0x000001E74AD92000-memory.dmp
memory/2768-131-0x00007FF9D6C80000-0x00007FF9D7139000-memory.dmp
memory/2768-122-0x00007FF9D7450000-0x00007FF9D7782000-memory.dmp
memory/2768-135-0x00007FF9D4C20000-0x00007FF9D4FD9000-memory.dmp
memory/2768-132-0x00007FF9D4FE0000-0x00007FF9D562A000-memory.dmp