Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
26/09/2026, 15:45
General
- Target 2026-09-26_bdaa882903836e6983b3b3d74854386c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 20.0MB
- Sample260926-s69dcsxvbv
- SHA256 f5599afc4bb6070435af634572401b60b280e12c065310af0b9f3899429c6b0e
Malware Config
Signatures
- Loads dropped DLL 21 IoCs
- UPX packed file 53 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-26_bdaa882903836e6983b3b3d74854386c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-26_bdaa882903836e6983b3b3d74854386c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-26_bdaa882903836e6983b3b3d74854386c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-26_bdaa882903836e6983b3b3d74854386c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python3.DLL
python314.dll
Lorem ipsum.txt
sqlite3.dll
ucrtbase.dll
memory/5328-192-0x00007FFDF48F0000-0x00007FFDF4919000-memory.dmp
memory/5328-207-0x00007FFDF47F0000-0x00007FFDF47FF000-memory.dmp
memory/5328-184-0x00007FFDE1760000-0x00007FFDE1D91000-memory.dmp
memory/5328-176-0x00007FFDF47F0000-0x00007FFDF47FF000-memory.dmp
memory/5328-159-0x00007FFDF48F0000-0x00007FFDF4919000-memory.dmp
memory/5328-173-0x00007FFDF5370000-0x00007FFDF537D000-memory.dmp
memory/5328-193-0x00007FFDEAF10000-0x00007FFDEAF45000-memory.dmp
memory/5328-195-0x00007FFDE99C0000-0x00007FFDE9B13000-memory.dmp
memory/5328-168-0x00007FFDF48A0000-0x00007FFDF48CC000-memory.dmp
memory/5328-189-0x00007FFDF2EF0000-0x00007FFDF2F0A000-memory.dmp
memory/5328-188-0x00007FFDE1DA0000-0x00007FFDE24AF000-memory.dmp
memory/5328-170-0x00007FFDF4820000-0x00007FFDF48A0000-memory.dmp
memory/5328-165-0x00007FFDF48D0000-0x00007FFDF48EA000-memory.dmp
memory/5328-161-0x00007FFDF59A0000-0x00007FFDF59AF000-memory.dmp
memory/5328-202-0x00007FFDE5860000-0x00007FFDE59EA000-memory.dmp
memory/5328-200-0x00007FFDEACF0000-0x00007FFDEAD16000-memory.dmp
memory/5328-151-0x00007FFDE1DA0000-0x00007FFDE24AF000-memory.dmp
memory/5328-205-0x00007FFDF4820000-0x00007FFDF48A0000-memory.dmp
memory/5328-206-0x00007FFDF5370000-0x00007FFDF537D000-memory.dmp
memory/5328-181-0x00007FFDF4770000-0x00007FFDF4784000-memory.dmp
memory/5328-208-0x00007FFDF4770000-0x00007FFDF4784000-memory.dmp
memory/5328-209-0x00007FFDE1760000-0x00007FFDE1D91000-memory.dmp
memory/5328-210-0x00007FFDEAF10000-0x00007FFDEAF45000-memory.dmp
memory/5328-222-0x00007FFDEAF10000-0x00007FFDEAF45000-memory.dmp
memory/5328-221-0x00007FFDF2EF0000-0x00007FFDF2F0A000-memory.dmp
memory/5328-212-0x00007FFDF48F0000-0x00007FFDF4919000-memory.dmp
memory/5328-224-0x00007FFDEACF0000-0x00007FFDEAD16000-memory.dmp
memory/5328-225-0x00007FFDE5860000-0x00007FFDE59EA000-memory.dmp
memory/5328-226-0x00007FFDE1DA0000-0x00007FFDE24AF000-memory.dmp
memory/5328-223-0x00007FFDE99C0000-0x00007FFDE9B13000-memory.dmp
memory/5328-220-0x00007FFDE1760000-0x00007FFDE1D91000-memory.dmp
memory/5328-219-0x00007FFDF4770000-0x00007FFDF4784000-memory.dmp
memory/5328-218-0x00007FFDF47F0000-0x00007FFDF47FF000-memory.dmp
memory/5328-217-0x00007FFDF5370000-0x00007FFDF537D000-memory.dmp
memory/5328-216-0x00007FFDF4820000-0x00007FFDF48A0000-memory.dmp
memory/5328-215-0x00007FFDF48A0000-0x00007FFDF48CC000-memory.dmp
memory/5328-214-0x00007FFDF48D0000-0x00007FFDF48EA000-memory.dmp
memory/5328-213-0x00007FFDF59A0000-0x00007FFDF59AF000-memory.dmp