597c6c6217221e35465a333aec0d3a1ac76b42861f2e5811b9f633b6722765b6

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/09/2026, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_8a00bf6e4a8c20d035a97079bcc7ef25_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
Size 45.3MB
Sample260923-1tachaeb68
SHA256 597c6c6217221e35465a333aec0d3a1ac76b42861f2e5811b9f633b6722765b6
MD5 8a00bf6e4a8c20d035a97079bcc7ef25
SHA1 2209262b2ea27d1e81a14e4cacc4f8aed53cd50b
SHA512 702731be898f4ee1c850b8f2e26df539842acbd732d1681460bd834c0d0d551c5c3474c7ee15a666d52471da93dfc91309ebf5fe51ae2f96dc5264533f69d9cd
SSDEEP 786432:pCIvIZdeJNAB7a0iqmMpaohZGXZBLCso6ZiL1zwbq/ZaDc/wHXjZZMrmPXuPAHSQ:pCuIZdeMXi8pJGDD4/e4rmfuPNS3
TLSH
T1E3A73370B1DE0EFAEB5B7239F9182AD2D6327820033098EF9761A6F155BC182D775345
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
1248	2026-09-23_8a00bf6e4a8c20d035a97079bcc7ef25_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
1248	2026-09-23_8a00bf6e4a8c20d035a97079bcc7ef25_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
1248	2026-09-23_8a00bf6e4a8c20d035a97079bcc7ef25_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
1248	2026-09-23_8a00bf6e4a8c20d035a97079bcc7ef25_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
1248	2026-09-23_8a00bf6e4a8c20d035a97079bcc7ef25_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
1248	2026-09-23_8a00bf6e4a8c20d035a97079bcc7ef25_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
1248	2026-09-23_8a00bf6e4a8c20d035a97079bcc7ef25_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3016	powershell.exe
4064	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3016	powershell.exe
3016	powershell.exe
3016	powershell.exe
4064	powershell.exe
4064	powershell.exe
4064	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeIncreaseQuotaPrivilege	3016	powershell.exe
Token: SeSecurityPrivilege	3016	powershell.exe
Token: SeTakeOwnershipPrivilege	3016	powershell.exe
Token: SeLoadDriverPrivilege	3016	powershell.exe
Token: SeSystemProfilePrivilege	3016	powershell.exe
Token: SeSystemtimePrivilege	3016	powershell.exe
Token: SeProfSingleProcessPrivilege	3016	powershell.exe
Token: SeIncBasePriorityPrivilege	3016	powershell.exe
Token: SeCreatePagefilePrivilege	3016	powershell.exe
Token: SeBackupPrivilege	3016	powershell.exe
Token: SeRestorePrivilege	3016	powershell.exe
Token: SeShutdownPrivilege	3016	powershell.exe
Token: SeDebugPrivilege	3016	powershell.exe
Token: SeSystemEnvironmentPrivilege	3016	powershell.exe
Token: SeRemoteShutdownPrivilege	3016	powershell.exe
Token: SeUndockPrivilege	3016	powershell.exe
Token: SeManageVolumePrivilege	3016	powershell.exe
Token: 33	3016	powershell.exe
Token: 34	3016	powershell.exe
Token: 35	3016	powershell.exe
Token: 36	3016	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeIncreaseQuotaPrivilege	4064	powershell.exe
Token: SeSecurityPrivilege	4064	powershell.exe
Token: SeTakeOwnershipPrivilege	4064	powershell.exe
Token: SeLoadDriverPrivilege	4064	powershell.exe
Token: SeSystemProfilePrivilege	4064	powershell.exe
Token: SeSystemtimePrivilege	4064	powershell.exe
Token: SeProfSingleProcessPrivilege	4064	powershell.exe
Token: SeIncBasePriorityPrivilege	4064	powershell.exe
Token: SeCreatePagefilePrivilege	4064	powershell.exe
Token: SeBackupPrivilege	4064	powershell.exe
Token: SeRestorePrivilege	4064	powershell.exe
Token: SeShutdownPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeSystemEnvironmentPrivilege	4064	powershell.exe
Token: SeRemoteShutdownPrivilege	4064	powershell.exe
Token: SeUndockPrivilege	4064	powershell.exe
Token: SeManageVolumePrivilege	4064	powershell.exe
Token: 33	4064	powershell.exe
Token: 34	4064	powershell.exe
Token: 35	4064	powershell.exe
Token: 36	4064	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 1248	3212	2026-09-23_8a00bf6e4a8c20d035a97079bcc7ef25_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe	91
PID 1248 wrote to memory of 3016	1248	2026-09-23_8a00bf6e4a8c20d035a97079bcc7ef25_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe	92
PID 1248 wrote to memory of 4064	1248	2026-09-23_8a00bf6e4a8c20d035a97079bcc7ef25_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-09-23_8a00bf6e4a8c20d035a97079bcc7ef25_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_8a00bf6e4a8c20d035a97079bcc7ef25_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Users\Admin\AppData\Local\Temp\2026-09-23_8a00bf6e4a8c20d035a97079bcc7ef25_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
  C:\Users\Admin\AppData\Local\Temp\2026-09-23_8a00bf6e4a8c20d035a97079bcc7ef25_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath | ForEach-Object { $_ }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionExtension | ForEach-Object { $_ }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f1e5d82b5a189ea2be5bcb97eaf21b4ff8cb785bf14b9b7d0c3532a3cd068d60
MD5 22f0ffaa212f3eff78593bfdeee03662
SHA1 1464dfc97fd5c12669e86a3ebf2c748910c3a0c0
SHA512 cfa263d4dc671f524387464ef486912af1d32d2ca39594a346e17f511050f9ef98e8c20f042c67e367ba60eaa39abdb1d677bb570ed9d05101e17b8441faeb63
TLSH
T170216833B3DD8614CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uckgna1b.yo0.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uckgna1b.yo0.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3212_283125_MZgZH_qEh4w\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3212_283125_MZgZH_qEh4w\_ctypes.pyd
Size 131KB
SHA256 9d6dccb4cd84a44a107f9b06b91c0a44e85766d9bf4debb6abbde8fda7494c2c
MD5 f75c30ccf8ecf05a2ba83cb06eeb354f
SHA1 962545549964c61dfbd31ab7d52ed470f7c5a9d6
SHA512 277f113ef07c02c83e7542899104cd8a1e626e84a7b9b0f9d68e8562ac6221413cfac14b84c5db5156bebe80381034273529abadaa01592b11c6d346cf95e24a
SSDEEP 3072:/uZ3aSoXIGagR+lf/FTzy4JxXBUnFIqyPst:Gobqf/FTzyixRUnn
TLSH
T186D37E0B776800AADAA39178C533AF47EFB1B453161097CF02A4C59A2F637966E7F305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3212_283125_MZgZH_qEh4w\_hashlib.pyd
Size 67KB
SHA256 79a26289aef0d92545a082507c7021f10e219621d137cb726c4d0fbbfd4b46ae
MD5 4949202690a7f755717b685a99e21092
SHA1 42ad37b620d204a8fcd5bdb2c09609b43639d1ac
SHA512 52172d67a60e79bec735c9b71ccf5c5b558c436391735256a4168a200911c0d7d09d22c86cf8fb75331afc02f9924c395ce1b28c9516c9e9207b9885a9da9894
SSDEEP 1536:eqXn1yAu1lEAXfXEfcV5Tam96CAhIqvICyPs5i9rfIYzWS:z1w1uAcfcym96CAhIqvIQu
TLSH
T11E637C9596894092E92382B5C4A34F83FA75F3521711ABDFA2A8C0CD2F233C78777756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Temp\onefile_3212_283125_MZgZH_qEh4w\backend\node_modules\es-object-atoms\LICENSE
Size 1KB
SHA256 5e325595b4ea8cfec3802f545b1def5d7b73e4a5b8e9ba63e32a320f67732292
MD5 8fe23ea421aaf9f9d687709f6a6a09b7
SHA1 a47868ab90b532df82abe3e4f507bcb2ea441364
SHA512 8acd3b84f3afa8c6ff9c1a58ab774ea33aec7701c022ba8f4d36218a8d1c03e80ef2ee1d692dbd43dbf5883153137c5e000f113b98da23d870dfab6f71b78afa
TLSH
T11111751EB25107B228AB13605578ACD5F23BB25F7A9F2A84246DF345633A06CC5FF844
MD5 SHA1 SHA512 TLSH

Submit Download

.nycrc

Path C:\Users\Admin\AppData\Local\Temp\onefile_3212_283125_MZgZH_qEh4w\backend\node_modules\get-proto\.nycrc
Size 139B
SHA256 997785c50b0773e5e18bf15550fbf57823c634fefe623cd37b3c83696402ad0a
MD5 d0104f79f0b4f03bbcd3b287fa04cf8c
SHA1 54f9d7adf8943cb07f821435bb269eb4ba40ccc2
SHA512 daf9b5445cfc02397f398adfa0258f2489b70699dfec6ca7e5b85afe5671fdcabe59edee332f718f5e5778feb1e301778dffe93bb28c1c0914f669659bad39c6
TLSH
T170C09B65E43F596B255D119CBD4CD5C7155415E1C1CD8F097D156661C31DB64004F541
MD5 SHA1 SHA512 TLSH

Submit Download

.nycrc

Path C:\Users\Admin\AppData\Local\Temp\onefile_3212_283125_MZgZH_qEh4w\backend\node_modules\side-channel-list\.nycrc
Size 216B
SHA256 948366fea3b423a46366326d0bb2e54b08abd1cf0b243678ba6625740c40da5a
MD5 c2ab942102236f987048d0d84d73d960
SHA1 95462172699187ac02eaec6074024b26e6d71cff
SHA512 e36b20c16ceeb090750f3865efc8d7fd983ae4e8b41c30cc3865d2fd4925bf5902627e1f1ed46c0ff2453f076ef9de34be899ef57754b29cd158440071318479
TLSH
T12ED0A710F03A051561DD629C7D4DB057051404A2818A8625AC712260CB78A10104B941
MD5 SHA1 SHA512 TLSH

Submit Download

tsconfig.json

Path C:\Users\Admin\AppData\Local\Temp\onefile_3212_283125_MZgZH_qEh4w\backend\node_modules\side-channel-weakmap\tsconfig.json
Size 116B
SHA256 6346ee4c020f341387588479dd83740a65ab902a462b8c6b3b8bf51f032c6795
MD5 52fad431b4493384deb61bca02e2ff01
SHA1 a16472424f8c26184de557eff8d6824939d1fc8e
SHA512 35b51bdea5bd3080b065d7aa72de5de16c5d839c6af8671f8325d35b69f7da5d9a5d53c53c38ccdbcf74847cc0bbf3d06e1eca01415a1546ffd5581747b1434a
TLSH
T19BB0922A960D0CB321D93E4C6D0FCACA969863C3C9C3655EADFAA162CB10A480027990
MD5 SHA1 SHA512 TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3212_283125_MZgZH_qEh4w\libcrypto-3.dll
Size 5.0MB
SHA256 09499e186cf0e434ffa17ad153aa9a66d6048c54a2c03b823e2a06c49d9affe4
MD5 6d0a1af0e9a539a749dd50add9c4c27b
SHA1 e484df936d4c1072f6aaa287ef41fe8ed238e87b
SHA512 485c01182e838488c93cdc6d526d5f568b52101ac49a5739461fb3480ec490110a50695f53f60079431c940880a3c049fdac8e562bb00e0930578b2cb947d5e4
SSDEEP 98304:uAH+4va7N1rRtynkJj2uSFPzy1CPwDvt3uFlDC/R:uuVv+1rRkMj2uSF21CPwDvt3uFlDC/R
TLSH
T111367B6AA7A80189E4BAC13CC9534617D2B1F85A57B097CF18A156BD0F37FCA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3212_283125_MZgZH_qEh4w\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3212_283125_MZgZH_qEh4w\python313.dll
Size 5.9MB
SHA256 e820bf024efd2b56bb2b82791e6b6ddc7303f070f8e72cba7637482a8a906238
MD5 e60c200eeefd75110b5801b150f9ff53
SHA1 6e3a63bf17c7c8c4cafe51fb648e4dd767220139
SHA512 b59cda63fce21d571510e373523b7dd4aae18a8f005fe9de39c4f2d66920f37f4d857d4781d43dc141485884a77a2b7d0ce45610e3105fdd7d91296ff09caea2
SSDEEP 98304:XHoJQujBS7z5bCwCG/ytJ1Lff7rexvCHDMiEfVc7Sz1:XHoJQqUn5bCpfWi2c+z1
TLSH
T13D567C16729E41ACD97B8078CA07864BF7B27C053E60834B61E6BB5D2FB3362476E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3016-1035-0x000001B8F15D0000-0x000001B8F15EE000-memory.dmp

Download

memory/3016-1037-0x000001B8F15B0000-0x000001B8F15BA000-memory.dmp

Download

memory/3016-1036-0x000001B8F15F0000-0x000001B8F16A2000-memory.dmp

Download

memory/3016-1030-0x000001B8F1520000-0x000001B8F1542000-memory.dmp

Download