Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
18/08/2026, 00:00
General
- Target 2026-08-17_ae5ff94ce364d19b6672b559711babb3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 36.6MB
- Sample260818-aaej1ascmb
- SHA256 73a80f04a7bdb79d6fde4a7c5e393c47cd9dc897173c11ec770f43270e0d32f5
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects executables using Telegram Chat Bot 1 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 14 IoCs
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_ae5ff94ce364d19b6672b559711babb3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_ae5ff94ce364d19b6672b559711babb3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_ae5ff94ce364d19b6672b559711babb3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_ae5ff94ce364d19b6672b559711babb3_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc" 2>nul 1>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc"4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName" 2>nul 1>nul3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\svchost_5064.exeC:\Users\Admin\AppData\Local\Temp\svchost_5064.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /target:exe /out:"C:\Users\Admin\AppData\Local\Temp\svchost_5064.exe" "C:\Users\Admin\AppData\Local\Temp\guardian_src_1b65030b72f847d29eb85305b8510f0a.cs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD42E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC73188A83EB7E4E979A809378E6A15268.TMP"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RESD42E.tmp
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_socket.pyd
_uuid.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
libffi-8.dll
_psutil_windows.pyd
python3.DLL
python314.dll
svchost_5064.exe
CSC73188A83EB7E4E979A809378E6A15268.TMP
guardian_src_1b65030b72f847d29eb85305b8510f0a.cs
memory/2960-70-0x0000023E38070000-0x0000023E38A14000-memory.dmp
memory/6020-58-0x00007FFF4A960000-0x00007FFF4B304000-memory.dmp
memory/6020-59-0x00007FFF4A960000-0x00007FFF4B304000-memory.dmp
memory/6020-60-0x00007FFF4A960000-0x00007FFF4B304000-memory.dmp
memory/6020-61-0x00007FFF4A960000-0x00007FFF4B304000-memory.dmp
memory/6020-62-0x000001DDF1A90000-0x000001DDF2DBA000-memory.dmp
memory/6020-55-0x00007FFF4A960000-0x00007FFF4B304000-memory.dmp
memory/6020-56-0x00007FFF4A960000-0x00007FFF4B304000-memory.dmp
memory/6020-57-0x000001DDEDD30000-0x000001DDEF32A000-memory.dmp
memory/6020-54-0x00007FFF4AAEF000-0x00007FFF4AAF0000-memory.dmp
memory/6020-71-0x00007FFF4A960000-0x00007FFF4B304000-memory.dmp