Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
23/08/2026, 12:19
General
- Target 2026-08-22_140227cb062e39b7960447b0affa765b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 20.7MB
- Sample260823-pg6dmaab78
- SHA256 c474ba5c219fcde7891a3be8c70f599c9736108c10f1142ee3447d0a22af5e3f
Malware Config
Extracted
-
xworm
-
XWorm V5.6
-
tissues-carte.tun.ply.gg:42477
-
Install_directory
%AppData%
-
install_file
XClient.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Detects Windows executables referencing non-Windows User-Agents 2 IoCs
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 11 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_140227cb062e39b7960447b0affa765b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_140227cb062e39b7960447b0affa765b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_140227cb062e39b7960447b0affa765b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_140227cb062e39b7960447b0affa765b_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\visible.exeC:\Users\Admin\AppData\Local\Temp\visible.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
-
-
C:\Users\Admin\AppData\Local\Temp\eumfc1oab171.exeC:\Users\Admin\AppData\Local\Temp\eumfc1oab171.exe3⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VoicemeeterRemote.dll
_chacha20.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
libffi-8.dll
python314.dll
eumfc1oab171.exe
visible.exe
memory/5044-91-0x00007FFE66FBF000-0x00007FFE66FC0000-memory.dmp
memory/5044-94-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/5044-92-0x0000000000C70000-0x0000000000C84000-memory.dmp
memory/5044-111-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/5044-109-0x0000000002DE0000-0x0000000002DF0000-memory.dmp
memory/5044-96-0x00007FFE66E30000-0x00007FFE677D4000-memory.dmp
memory/5996-99-0x0000000005640000-0x000000000564A000-memory.dmp
memory/5996-93-0x0000000000910000-0x0000000000BAA000-memory.dmp
memory/5996-100-0x0000000005740000-0x000000000595C000-memory.dmp
memory/5996-101-0x0000000005520000-0x0000000005530000-memory.dmp
memory/5996-90-0x0000000074982000-0x0000000074983000-memory.dmp
memory/5996-97-0x0000000005580000-0x0000000005612000-memory.dmp
memory/5996-110-0x0000000074982000-0x0000000074983000-memory.dmp
memory/5996-95-0x0000000005A90000-0x000000000604A000-memory.dmp
memory/5996-112-0x0000000005520000-0x0000000005530000-memory.dmp