Analysis
- max time kernel
151s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/09/2026, 02:24
General
- Target 2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 83.0MB
- Sample260924-cvs91ayaja
- SHA256 663ec77cb8887e069c41b8913adf616645c7bb2108dad79ef00cbbc15b8b84ea
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 64 IoCs
- Looks up external IP address via web service 1 TTPs 30 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a command shell one-liner 1 TTPs 29 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=2828" "pipe_handle=1748"3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=4916" "pipe_handle=1744"4⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"5⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=2676" "pipe_handle=1752"5⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"6⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version6⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list6⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=1632" "pipe_handle=1716"6⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"7⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=4572" "pipe_handle=1736"7⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"8⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version8⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list8⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=516" "pipe_handle=1728"8⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"9⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version9⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list9⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=5684" "pipe_handle=1708"9⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"10⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version10⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list10⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=3060" "pipe_handle=1732"10⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"11⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version11⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list11⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=2840" "pipe_handle=1748"11⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"12⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version12⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=4700" "pipe_handle=1716"12⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"13⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version13⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=4860" "pipe_handle=1736"13⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"14⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version14⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=5760" "pipe_handle=1756"14⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"15⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version15⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list15⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=1004" "pipe_handle=1772"15⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"16⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version16⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list16⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=4532" "pipe_handle=1744"16⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"17⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version17⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list17⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=6000" "pipe_handle=1084"17⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"18⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version18⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV119⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list18⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=5848" "pipe_handle=1740"18⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"19⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version19⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list19⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV120⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=4300" "pipe_handle=1728"19⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"20⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version20⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list20⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=3044" "pipe_handle=1712"20⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"21⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version21⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list21⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=4188" "pipe_handle=1724"21⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"22⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version22⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=5956" "pipe_handle=1748"22⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"23⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version23⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list23⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=5636" "pipe_handle=1728"23⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"24⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version24⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=2952" "pipe_handle=1740"24⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"25⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version25⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list25⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=2816" "pipe_handle=1732"25⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"26⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version26⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=872" "pipe_handle=1728"26⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"27⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version27⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list27⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=4972" "pipe_handle=1672"27⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"28⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version28⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list28⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=2600" "pipe_handle=1764"28⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"29⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version29⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list29⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=4076" "pipe_handle=1756"29⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"30⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version30⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list30⤵
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_af63d213f7284098e62adf6cc62b8e5a_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe" "--multiprocessing-fork" "parent_pid=6100" "pipe_handle=1700"30⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"31⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\wmic.exewmic os get Version31⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name,CurrentClockSpeed,L2CacheSize,L3CacheSize,Description,Caption,Manufacturer /format:list31⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
api-ms-win-core-console-l1-1-0.dll
api-ms-win-core-datetime-l1-1-0.dll
api-ms-win-core-debug-l1-1-0.dll
api-ms-win-core-errorhandling-l1-1-0.dll
api-ms-win-core-file-l1-1-0.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-handle-l1-1-0.dll
api-ms-win-core-heap-l1-1-0.dll
api-ms-win-core-interlocked-l1-1-0.dll
api-ms-win-core-libraryloader-l1-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-memory-l1-1-0.dll
api-ms-win-core-namedpipe-l1-1-0.dll
api-ms-win-core-processenvironment-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-profile-l1-1-0.dll
api-ms-win-core-rtlsupport-l1-1-0.dll
api-ms-win-core-string-l1-1-0.dll
api-ms-win-core-synch-l1-1-0.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-sysinfo-l1-1-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-util-l1-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.DLL
python311.dll
select.pyd
sqlite3.dll
tcl86t.dll
tk86t.dll
ucrtbase.dll
gfm79ar8