Analysis
- max time kernel
149s - max time network
13s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
22/09/2026, 09:49
General
- Target 2026-09-21_d580912c402e40439f85091003042ad7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 12.7MB
- Sample260922-ltgn9adc39
- SHA256 5fbbfe5f03df7def3234fc43489c9dc7e72c91c3873c944d9088520a6614c584
Malware Config
Signatures
- Loads dropped DLL 21 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- System Network Connections Discovery 1 TTPs 3 IoCs
Attempt to get a listing of network connections.
- Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 17 IoCs
- Suspicious use of SendNotifyMessage 17 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-21_d580912c402e40439f85091003042ad7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-21_d580912c402e40439f85091003042ad7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-21_d580912c402e40439f85091003042ad7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-21_d580912c402e40439f85091003042ad7_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\WorkBuddyTelemetryGuard\backend.ps1 status3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NETSTAT.EXE"C:\Windows\system32\NETSTAT.EXE" -ano4⤵
- System Network Connections Discovery
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\frou3os3\frou3os3.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES63C1.tmp" "c:\Users\Admin\AppData\Local\Temp\frou3os3\CSC28175ACC75C04EFEACA2A8CF3F55B245.TMP"5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\WorkBuddyTelemetryGuard\backend.ps1 status3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NETSTAT.EXE"C:\Windows\system32\NETSTAT.EXE" -ano4⤵
- System Network Connections Discovery
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i1bt4c3c\i1bt4c3c.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1AEC.tmp" "c:\Users\Admin\AppData\Local\Temp\i1bt4c3c\CSCD05940CB5E454B2BAC49223D74E6846.TMP"5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\WorkBuddyTelemetryGuard\backend.ps1 status3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NETSTAT.EXE"C:\Windows\system32\NETSTAT.EXE" -ano4⤵
- System Network Connections Discovery
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vksa12ih\vksa12ih.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1838.tmp" "c:\Users\Admin\AppData\Local\Temp\vksa12ih\CSCCBBCD5ECAA874F81BB3BFB6BE4B6D592.TMP"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_imaging.cp311-win_amd64.pyd
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
auto.tcl
cp1252.enc
pkgIndex.tcl
init.tcl
pkgIndex.tcl
package.tcl
tclIndex
tm.tcl
button.tcl
entry.tcl
icons.tcl
listbox.tcl
menu.tcl
panedwindow.tcl
pkgIndex.tcl
scale.tcl
scrlbar.tcl
spinbox.tcl
text.tcl
tk.tcl
fonts.tcl
ttk.tcl
_tkinter.pyd
backend.ps1
base_library.zip
fastcheck.ps1
guard.pfx
guard_proxy_cb.js
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python311.dll
select.pyd
tcl86t.dll
msgcat-1.6.1.tm
tk86t.dll
unicodedata.pyd
__PSScriptPolicyTest_ubqfef2k.ibe.ps1
tmpbxht3bgm.ico
memory/1516-1085-0x000001A5B8AD0000-0x000001A5B9474000-memory.dmp
memory/1808-1117-0x0000020CEA580000-0x0000020CEAF24000-memory.dmp
memory/3404-1036-0x00007FFD152B0000-0x00007FFD15C54000-memory.dmp
memory/3404-1062-0x00007FFD152B0000-0x00007FFD15C54000-memory.dmp
memory/3404-1037-0x00007FFD152B0000-0x00007FFD15C54000-memory.dmp
memory/3404-1038-0x00007FFD152B0000-0x00007FFD15C54000-memory.dmp
memory/3404-1039-0x00007FFD152B0000-0x00007FFD15C54000-memory.dmp
memory/3404-1040-0x00007FFD152B0000-0x00007FFD15C54000-memory.dmp
memory/3404-1041-0x00007FFD152B0000-0x00007FFD15C54000-memory.dmp
memory/3404-1042-0x00007FFD152B0000-0x00007FFD15C54000-memory.dmp
memory/3404-1043-0x00007FFD152B0000-0x00007FFD15C54000-memory.dmp
memory/3404-1044-0x00007FFD152B0000-0x00007FFD15C54000-memory.dmp
memory/3404-1045-0x00007FFD152B0000-0x00007FFD15C54000-memory.dmp
memory/3404-1030-0x00007FFD1543F000-0x00007FFD15440000-memory.dmp
memory/3404-1054-0x0000015BA6ED0000-0x0000015BA6ED8000-memory.dmp
memory/3404-1055-0x0000015BA74A0000-0x0000015BA7662000-memory.dmp
memory/3404-1056-0x0000015BA7BA0000-0x0000015BA80C8000-memory.dmp
memory/3404-1034-0x00007FFD152B0000-0x00007FFD15C54000-memory.dmp
memory/3404-1035-0x00007FFD152B0000-0x00007FFD15C54000-memory.dmp
memory/3404-1033-0x0000015BA6EE0000-0x0000015BA6F02000-memory.dmp
memory/4532-1118-0x0000021EFB2C0000-0x0000021EFB2C8000-memory.dmp
memory/5168-1014-0x000001FCCB020000-0x000001FCCB021000-memory.dmp
memory/5988-1086-0x0000012433800000-0x0000012433808000-memory.dmp
memory/6124-1053-0x000002B42F460000-0x000002B42FE04000-memory.dmp