Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 05:28

General

  • Target
    2026-08-20_bc80d89dbfddc8d9278f7c2c0d7d960d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 12.4MB
  • Sample260820-f58dfser31
  • SHA256 2cc4d282ead2f87f2a1cda65e67eb67fdfee52905996d10ba09670a8bd368f4d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_bc80d89dbfddc8d9278f7c2c0d7d960d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_bc80d89dbfddc8d9278f7c2c0d7d960d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4724
    • C:\Users\Admin\AppData\Local\Temp\2026-08-20_bc80d89dbfddc8d9278f7c2c0d7d960d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-20_bc80d89dbfddc8d9278f7c2c0d7d960d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:5736

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LIBBZ2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\LIBBZ2.dll
        • Size 81KB
        • SHA256 25a4aae35dd89709620106db311af5bca7c868182b961e106a895ae14d2fc98a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VCRUNTIME140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\VCRUNTIME140.dll
        • Size 121KB
        • SHA256 0205071c36c17f1efbd70178c852cb7d49985c484202752b8704b7ac6b184e60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _bz2.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_bz2.pyd
        • Size 35KB
        • SHA256 66087dfa899701e2d7781b51143e9ab10a646cb336d9649ff0e30a628e769735
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _lzma.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_lzma.pyd
        • Size 47KB
        • SHA256 e94780e5b1f96b470dc757df3326321247b088fc2fab0c5b9b7a33b5977aabfb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        auto.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tcl_data\auto.tcl
        • Size 20KB
        • SHA256 67be04b5aa4c0845f8c5143171acf31ad6b3f23eb1a0be98133133e8abc9822b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cp1252.enc

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tcl_data\encoding\cp1252.enc
        • Size 1KB
        • SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
        • MD5 SHA1 SHA512 TLSH

        pkgIndex.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tcl_data\http1.0\pkgIndex.tcl
        • Size 735B
        • SHA256 420c4b3088c9dacd21bc348011cac61d7cb283b9bee78ae72eed764ab094651c
        • MD5 SHA1 SHA512 TLSH

        init.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tcl_data\init.tcl
        • Size 24KB
        • SHA256 6fc657ec3742e7aee13ea51fa1a0838b38e3d9995ed2470f6669923e80f153d8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pkgIndex.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tcl_data\opt0.4\pkgIndex.tcl
        • Size 624B
        • SHA256 c6ef00c55362782a3b8c185e84413225dde64cec690fb324158d7028c53c3745
        • MD5 SHA1 SHA512 TLSH

        package.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tcl_data\package.tcl
        • Size 22KB
        • SHA256 ab3cc8c4fae3831761cf77e501028a48db6e4f4fd998102785e7fca7c9e7a142
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tclIndex

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tcl_data\tclIndex
        • Size 7KB
        • SHA256 e7620c3c29c497f6c0119b63b27d95df9da4d7d3a478bef138fb45b1a39452a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tm.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tcl_data\tm.tcl
        • Size 11KB
        • SHA256 0375cf5a5b3193fa23a2eac4a2ac40ae5ca9e29c6215283ec611726b23491a65
        • MD5 SHA1 SHA512 SSDEEP TLSH

        button.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\button.tcl
        • Size 20KB
        • SHA256 2f013b643d62f08ddaaa1dea39ff80d6607569c9e1acc19406377b64d75ccf53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        entry.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\entry.tcl
        • Size 17KB
        • SHA256 92fb2fe5b22cc697f9396d3681cf3d31c03598d7d8d1858b4b7ab976e9c80a5c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icons.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\icons.tcl
        • Size 10KB
        • SHA256 4cab80ace4104a4169c9bd1fdb24d697889b984b91a290b69a481912c38a9fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        listbox.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\listbox.tcl
        • Size 14KB
        • SHA256 fdfd4cf3102d83bad3556d0e0086b5f320f74484babf90421cf526fd8b9fbeb0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        menu.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\menu.tcl
        • Size 37KB
        • SHA256 39e93a2bd75b9156235f3271ea02fd7cac82b542ae56df733cd7bd62a2c4207e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        panedwindow.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\panedwindow.tcl
        • Size 5KB
        • SHA256 4adf738b17691489c71c4b9d9a64b12961ada8667b81856f7adbc61dffeadf29
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pkgIndex.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\pkgIndex.tcl
        • Size 376B
        • SHA256 6127926b94db2992ab450fc6cc2ec3d071f7bbc856656d0ae20cc3fd4036f547
        • MD5 SHA1 SHA512 TLSH

        scale.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\scale.tcl
        • Size 8KB
        • SHA256 423546933269faec913001f2bce30bbdbce3927dc9dd96fe74813e7ffb27cfb5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        scrlbar.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\scrlbar.tcl
        • Size 12KB
        • SHA256 189e7ee4b67861001c714a55880db34acf7d626a816e18b04b232af9e6e33e81
        • MD5 SHA1 SHA512 SSDEEP TLSH

        spinbox.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\spinbox.tcl
        • Size 15KB
        • SHA256 a804c83029e04e6bd34d335260f388890d7657deb544173858bd05018d73ab01
        • MD5 SHA1 SHA512 SSDEEP TLSH

        text.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\text.tcl
        • Size 33KB
        • SHA256 fd12bca3c7dcedf3fc6640902af1c9f48bc5df27c9153edaec15413f1581e4a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tk.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\tk.tcl
        • Size 23KB
        • SHA256 a12d0ca9385ea35394d2bed4ad0945e9f670c33d56d79d4c41b25a2041ffb98d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        button.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\ttk\button.tcl
        • Size 2KB
        • SHA256 684ed40a9609ca275ce6f3e547fbf2980e3c040faddaf0fd39b7cbd7d5987366
        • MD5 SHA1 SHA512 TLSH

        combobox.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\ttk\combobox.tcl
        • Size 11KB
        • SHA256 6a859f587ef781fa348368dac3cad6ccef727ed51a2510888abc2af8bc88ae76
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cursors.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\ttk\cursors.tcl
        • Size 4KB
        • SHA256 c1db93eaf482bee1bf57cb423f28a8c6770ced9b37ebbb8c9fc86d61215fe8e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        entry.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\ttk\entry.tcl
        • Size 16KB
        • SHA256 9c341735e179279766240dc89b83b6a9ebac60890065251fe5cf438f8b14d937
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fonts.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\ttk\fonts.tcl
        • Size 5KB
        • SHA256 1f2d2965b2c72ae953c0829a227577ada8959d24502638b3186aa840b678cc3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        menubutton.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\ttk\menubutton.tcl
        • Size 6KB
        • SHA256 a16dfb1eaf77b05a0ef92b4cc7d00f559fb6cf0b2f735c3afac50303c524a081
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notebook.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\ttk\notebook.tcl
        • Size 5KB
        • SHA256 8bef93353a7134434dc780eea77b52ef6dc853a193e8d81a132d0e24ed93234b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        panedwindow.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\ttk\panedwindow.tcl
        • Size 2KB
        • SHA256 2d12d4df3c7b2988e2e28017372eb562e81436c602b8bb31c717bdd0eec18a74
        • MD5 SHA1 SHA512 TLSH

        progress.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\ttk\progress.tcl
        • Size 1KB
        • SHA256 a9c34f595e547ce94ee65e27c415195d2b210653a9ffcfb39559c5e0fa9c06f8
        • MD5 SHA1 SHA512 TLSH

        scale.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\ttk\scale.tcl
        • Size 2KB
        • SHA256 6161c40bf5d6cfe9c836aab2370efc951bc3e14bc17dd9477455b86b5252d696
        • MD5 SHA1 SHA512 TLSH

        scrollbar.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\ttk\scrollbar.tcl
        • Size 3KB
        • SHA256 0726ab1e541b35713e6f7b91fabb4fed5c129b8160d4d5dbf85aeffaa218d54b
        • MD5 SHA1 SHA512 TLSH

        sizegrip.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\ttk\sizegrip.tcl
        • Size 2KB
        • SHA256 36faf032bd9c72f30751feb00778fd21d01108cdb1f3ea4afd0b5bb5e84732de
        • MD5 SHA1 SHA512 TLSH

        spinbox.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\ttk\spinbox.tcl
        • Size 4KB
        • SHA256 5132e39112916486c49018c1bffba70f30df607b103e22ae5d43c71dabe8cb40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        treeview.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\ttk\treeview.tcl
        • Size 9KB
        • SHA256 42fcb70306b8ad483fa2649d7c9b13891b2b841e26d294f53da322da488c6254
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ttk.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\ttk\ttk.tcl
        • Size 5KB
        • SHA256 58689c03514d197b2eb3c4ccf1985e48f37f20343c18eb179de2d7f7099b20f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        utils.tcl

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tk_data\ttk\utils.tcl
        • Size 8KB
        • SHA256 ab0721c50cac71ff3ce7726940aac3390b723224cd421ac9eab06a552f1aa152
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _tkinter.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_tkinter.pyd
        • Size 69KB
        • SHA256 e79acaa0968b0d82609380913c96e504fa45aad3ce3a97faad545b0515286789
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _zstd.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\_zstd.pyd
        • Size 62KB
        • SHA256 37202c318758e9892d3da7882051cc449c7e91a8c40ab396c827775a3ccafecb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base_library.zip

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\base_library.zip
        • Size 1.3MB
        • SHA256 9d37781ce1625c607a8bea743f020a69b84ee4fcfffcbeabe5d36562a6d249a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        liblzma.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\liblzma.dll
        • Size 195KB
        • SHA256 960b67b5188e142ae86e7a3ad0ad417a6c50e7a511b19155ad46061f46d0857f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python314.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\python314.dll
        • Size 6.8MB
        • SHA256 61341999eaf7fda594fbf2d918172b3347a47f40650e7a039142609bcfbc5d8a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tcl86t.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\tcl86t.dll
        • Size 1.8MB
        • SHA256 d09bfdef21e50ac087cdfca28e77e7932f88dfcc7593b12d3d92c6522e6ddbea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msgcat-1.6.1.tm

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\tcl8\8.5\msgcat-1.6.1.tm
        • Size 33KB
        • SHA256 5732951b02b45c3702c2f9ee7c43deabfcfe0aaae893f89bcc59e32bd9444ce3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tk86t.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\tk86t.dll
        • Size 1.5MB
        • SHA256 3757ebc3a3950e78798e966989b5030a312ba7dbe5d52878d41a07eeccd3b92a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ucrtbase.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\ucrtbase.dll
        • Size 1.1MB
        • SHA256 fbed69a52fdcf571dd37fe4cc63cb86ed3732b5b998807f14968788027c00754
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zlib.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\zlib.dll
        • Size 100KB
        • SHA256 a2e123cc624634d08200b4e5ee6a2828d2df88fd9573b5b5fdd9da336f5738a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zstd.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012742\zstd.dll
        • Size 657KB
        • SHA256 9c65f8f58e132a83a1da8c018c2d62f774e5a33e9fd511f13941986870662357
        • MD5 SHA1 SHA512 SSDEEP TLSH