Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
24/10/2026, 02:06
General
- Target 2026-10-22_a4352ccb583784970314456f7ea0974d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 9.6MB
- Sample261024-cjk49afs2s
- SHA256 ea03b52aa8fa46de5325cb51dfada281158191c0b5d8fe6dabbb210da688c150
Malware Config
Signatures
- Loads dropped DLL 14 IoCs
- UPX packed file 33 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_a4352ccb583784970314456f7ea0974d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_a4352ccb583784970314456f7ea0974d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_a4352ccb583784970314456f7ea0974d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_a4352ccb583784970314456f7ea0974d_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
python312.dll
select.pyd
ucrtbase.dll
_winpty.cp312-win_amd64.pyd
conpty.dll
winpty.dll
memory/3032-100-0x00007FF9C2B10000-0x00007FF9C2B3D000-memory.dmp
memory/3032-141-0x0000000064180000-0x00000000642A7000-memory.dmp
memory/3032-92-0x00007FF9C4170000-0x00007FF9C4195000-memory.dmp
memory/3032-104-0x00007FF9C3560000-0x00007FF9C3579000-memory.dmp
memory/3032-110-0x00007FF9C2AF0000-0x00007FF9C2B05000-memory.dmp
memory/3032-112-0x00007FF9AFDA0000-0x00007FF9B02C2000-memory.dmp
memory/3032-107-0x00007FF9C3840000-0x00007FF9C384D000-memory.dmp
memory/3032-94-0x00007FF9C3E00000-0x00007FF9C3E0F000-memory.dmp
memory/3032-87-0x00007FF9B02D0000-0x00007FF9B09A0000-memory.dmp
memory/3032-116-0x00007FF9BB600000-0x00007FF9BB691000-memory.dmp
memory/3032-138-0x00007FF9AFDA0000-0x00007FF9B02C2000-memory.dmp
memory/3032-98-0x00007FF9C3850000-0x00007FF9C3869000-memory.dmp
memory/3032-142-0x00007FF9B02D0000-0x00007FF9B09A0000-memory.dmp
memory/3032-140-0x00007FF9B02D0000-0x00007FF9B09A0000-memory.dmp
memory/3032-139-0x00007FF9BB600000-0x00007FF9BB691000-memory.dmp
memory/3032-137-0x00007FF9C2AF0000-0x00007FF9C2B05000-memory.dmp
memory/3032-136-0x00007FF9C3840000-0x00007FF9C384D000-memory.dmp
memory/3032-135-0x00007FF9C3560000-0x00007FF9C3579000-memory.dmp
memory/3032-134-0x00007FF9C2B10000-0x00007FF9C2B3D000-memory.dmp
memory/3032-133-0x00007FF9C3850000-0x00007FF9C3869000-memory.dmp
memory/3032-132-0x00007FF9C3E00000-0x00007FF9C3E0F000-memory.dmp
memory/3032-131-0x00007FF9C4170000-0x00007FF9C4195000-memory.dmp