Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 21:57

General

  • Target
    2026-08-23_c562a62e3a76099b26c75c7eb031430a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 11.5MB
  • Sample260823-1vdfjsbj8v
  • SHA256 c3c99d9a445246b03e577e3366865e82dc735dece6e37ba6d53f53634685c9cb
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Loads dropped DLL 50 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_c562a62e3a76099b26c75c7eb031430a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c562a62e3a76099b26c75c7eb031430a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Users\Admin\AppData\Local\Temp\2026-08-23_c562a62e3a76099b26c75c7eb031430a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-23_c562a62e3a76099b26c75c7eb031430a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:5940

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\VCRUNTIME140.dll
        • Size 96KB
        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VCRUNTIME140_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\VCRUNTIME140_1.dll
        • Size 37KB
        • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _bz2.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\_bz2.pyd
        • Size 81KB
        • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _ctypes.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\_ctypes.pyd
        • Size 120KB
        • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _decimal.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\_decimal.pyd
        • Size 245KB
        • SHA256 d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _hashlib.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\_hashlib.pyd
        • Size 62KB
        • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _lzma.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\_lzma.pyd
        • Size 154KB
        • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _queue.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\_queue.pyd
        • Size 30KB
        • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
        • MD5 SHA1 SHA512 SSDEEP TLSH

        _socket.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\_socket.pyd
        • Size 76KB
        • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-console-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-console-l1-1-0.dll
        • Size 21KB
        • SHA256 cb3f7b194d220004ffa6eef1305849bcef38033c49cb1b16c5ab3c3d60bd9d20
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-datetime-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-datetime-l1-1-0.dll
        • Size 21KB
        • SHA256 2161c0add0ee0a312e12d0346a1b24b6e5e1356a5a7e264911650a8e1d017e1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-debug-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-debug-l1-1-0.dll
        • Size 21KB
        • SHA256 cf7dc6f5abe58e31b41912b4a84cabd106eecf7cad7f5a1942c4befaca703536
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-errorhandling-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 21KB
        • SHA256 41dd8451c6b25a7a924a7a42a3d466350bcd2820fca4177ef5f6305e6eadb97a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-fibers-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-fibers-l1-1-0.dll
        • Size 21KB
        • SHA256 70ea8113b1825f3529b307ce2edb1048ebc60c83c016892b6177f3c8cb56b9bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-file-l1-1-0.dll
        • Size 25KB
        • SHA256 a198091842029a252e0112120b93bf7323b04ed647a3d2bd27fde72637385a7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-file-l1-2-0.dll
        • Size 21KB
        • SHA256 68e28b5944193ab45be2cc14e49424ba0c5d8713bb6b027e96ff1c16147f19a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-file-l2-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-file-l2-1-0.dll
        • Size 21KB
        • SHA256 57cb180884f33b064957d9c1dd509bb5e8fd541e9458b84d88e025790c1dc986
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-handle-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-handle-l1-1-0.dll
        • Size 21KB
        • SHA256 39dbe64591ef5d0aa48bd61ab9262bb6ca37a896dd71169aafbf90bba82dea53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-heap-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-heap-l1-1-0.dll
        • Size 21KB
        • SHA256 9669ee54d953bba692fc6b5e806f7f7645258c5f0618d253f8043e832fe75e2d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-interlocked-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 21KB
        • SHA256 39883213a6434f6f3a3f6d174630a1286c28ef7f47b7e3e1de4623cd9f3ce270
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-libraryloader-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 21KB
        • SHA256 b942e2a62d69ce41534ca7c9822f672edeb8ff37b8e650001c9432c28b765cd7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-localization-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-localization-l1-2-0.dll
        • Size 21KB
        • SHA256 361ebbef6e0d77624560b87d888464b331403e09845836a04f5800682aa4ed48
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-memory-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-memory-l1-1-0.dll
        • Size 21KB
        • SHA256 52785bb917c6e38fb69ed5bc1d2bcf01a1c84ec6fb0b94319dde3835cf64fb7c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-namedpipe-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 21KB
        • SHA256 8019b8c033e5e556c006fefd540a754d85fb4bc68ab851ae78bb4c6fa42f3413
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processenvironment-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 21KB
        • SHA256 f4d5be821780a3db520258a451b50fa8cde1486b607477a958f6f529dcb74f43
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processthreads-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 21KB
        • SHA256 ae507dcdd0e6c6bded417a64918ef0cc76e41ffe475f67478b841ba05cc73bbb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-processthreads-l1-1-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 21KB
        • SHA256 92bb2dd3172befd83dc039deb83577efc0f4e42390aa3d428d6f296bd3f462fa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-profile-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-profile-l1-1-0.dll
        • Size 21KB
        • SHA256 f30d1aba7bb55874ab6b91b0d81378face8570420aefcc89f18e420459ca9b7a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-rtlsupport-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 21KB
        • SHA256 b3237f2efe5e22eb802caded8cc85aeb104192dfdea31cfe7381b58c1b37affe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-string-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-string-l1-1-0.dll
        • Size 21KB
        • SHA256 4451084c3993c3a1bd3ec0613005c59ca23c722bbc73da47d64893ee46f22103
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-synch-l1-1-0.dll
        • Size 21KB
        • SHA256 347a1267a70015b30d6d5752b7d1b60dd51f2b89b7cdf97c7128444d6af1ffb2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-synch-l1-2-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-synch-l1-2-0.dll
        • Size 21KB
        • SHA256 24dd4de212b4b43c2e3d565d0c253509f44edd06e59ed9600db3fcbbf04aedb8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-sysinfo-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 21KB
        • SHA256 eccae6c70ef79c70dd3eaa6d7ec4e14f8b341169aa772bb0100de550f0a44cb4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-timezone-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-timezone-l1-1-0.dll
        • Size 21KB
        • SHA256 bc0a3295b1e552f47f7034d47dcaa9123caa9423d202df5737b9301d68cb6667
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-core-util-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-core-util-l1-1-0.dll
        • Size 21KB
        • SHA256 222f7e8b5774968ffd899a9ee2139f9934eb5a50b9a9da2cf0592134d3ad54b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-conio-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-crt-conio-l1-1-0.dll
        • Size 21KB
        • SHA256 b33d0e78ff6e9a9bf3bf369942412eb9c85f02b65230e77cb11a99730f6c4030
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-convert-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-crt-convert-l1-1-0.dll
        • Size 25KB
        • SHA256 43f20e591ae0afece324a2a9636ba557690f0bca29935967a0f33098725c94fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-environment-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-crt-environment-l1-1-0.dll
        • Size 21KB
        • SHA256 41d678da2ed4089e9abd91ce70309d6bfadeeded25b7a96cc9a1071f1efdac12
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-filesystem-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 21KB
        • SHA256 03f4bffe5e2c273be4ad87cbb84363e80f3d1a63f9e2965045a0922c76cadc69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-heap-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-crt-heap-l1-1-0.dll
        • Size 21KB
        • SHA256 8c7d51aa0042969b8f1c99ee7d692a214e5b220b6c59a2016ddf60b030466b2f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-locale-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-crt-locale-l1-1-0.dll
        • Size 21KB
        • SHA256 c0225ee09d6779288c86db3bfcbdfbab58e39eb9355844653b5761ca09faf0ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-math-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-crt-math-l1-1-0.dll
        • Size 29KB
        • SHA256 d4247022622bcecfa9e25c212e8833de1602aab55756eb3d1a54515704984e41
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-process-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-crt-process-l1-1-0.dll
        • Size 21KB
        • SHA256 5e0543b480befd83f440f2a1a30c5b7a9a9f49abd305fe02ed8ca4f156076a09
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-runtime-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 25KB
        • SHA256 707073941e2b24bd94e7ef11e1fa7aca92fd63fcc6babf42865615ea6bb1f388
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-stdio-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 25KB
        • SHA256 56f1507c3bcdb39d4db5af07908542486200488bc47927b9724a532e99134b8e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-string-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-crt-string-l1-1-0.dll
        • Size 25KB
        • SHA256 bc0d452a9638c86705d93ef6b8a4dd8912cc6cfda8403dc6c6e9061599d6875e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-time-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-crt-time-l1-1-0.dll
        • Size 21KB
        • SHA256 e748d40325659477feda7e7b4d2d770fb69cbc94c3c28289fa45b60617c413d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        api-ms-win-crt-utility-l1-1-0.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\api-ms-win-crt-utility-l1-1-0.dll
        • Size 21KB
        • SHA256 2c9404ea15c37fd0fb6fff964917512c2191c73241cbaa40e056244b265b1171
        • MD5 SHA1 SHA512 SSDEEP TLSH

        base_library.zip

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\base_library.zip
        • Size 1.4MB
        • SHA256 450e0f9ed6b74e0f10da546bbc4888a4ab9d85573631dd4e5bf67bf8a04a9cc0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libcrypto-1_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libffi-8.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\libffi-8.dll
        • Size 34KB
        • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libssl-1_1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\libssl-1_1.dll
        • Size 686KB
        • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
        • MD5 SHA1 SHA512 SSDEEP TLSH

        python311.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\python311.dll
        • Size 5.5MB
        • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        select.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\select.pyd
        • Size 28KB
        • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sqlite3.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\sqlite3.dll
        • Size 1.4MB
        • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ucrtbase.dll

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\ucrtbase.dll
        • Size 1.1MB
        • SHA256 903806c8888e3c9ac0212ed50be6889c21cf4fd12f49931da8b548b5326a0bf8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unicodedata.pyd

        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000005c42\unicodedata.pyd
        • Size 1.1MB
        • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
        • MD5 SHA1 SHA512 SSDEEP TLSH