Analysis
- max time kernel
149s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/11/2026, 12:44
General
- Target 2026-11-07_7bbed2b8474eac9f038f0ffd097e8d1e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
- Size 17.0MB
- Sample261107-pyhnwsds7p
- SHA256 0e5b41569cf40c73f6745fc07e1535b0bf65e21c2839556c0ed9898599a1963f
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 48 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-07_7bbed2b8474eac9f038f0ffd097e8d1e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-07_7bbed2b8474eac9f038f0ffd097e8d1e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-11-07_7bbed2b8474eac9f038f0ffd097e8d1e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-07_7bbed2b8474eac9f038f0ffd097e8d1e_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"2⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /TN DeviceSyncRuntime /TR "\"C:\ProgramData\Microsoft\DeviceSync\DeviceSyncRuntime.exe\" --quiet" /SC MINUTE /MO 10 /RL HIGHEST /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -Command "Set-ScheduledTask -TaskName 'DeviceSyncRuntime' -Settings (New-ScheduledTaskSettingsSet -Hidden -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable) | Out-Null"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncRuntime.exe"C:\ProgramData\Microsoft\DeviceSync\DeviceSyncRuntime.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncRuntime.exe"C:\ProgramData\Microsoft\DeviceSync\DeviceSyncRuntime.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncRuntime.exe"C:\ProgramData\Microsoft\DeviceSync\DeviceSyncRuntime.exe" --quiet1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\DeviceSync\DeviceSyncRuntime.exe"C:\ProgramData\Microsoft\DeviceSync\DeviceSyncRuntime.exe" --quiet2⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
.w
DeviceSyncRuntime.exe
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_tkinter.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
libcrypto-3.dll
libffi-8.dll
libtommath.dll
python315.dll
tcl90.dll
tcl9tk90.dll
ucrtbase.dll
unicodedata.pyd
zlib1.dll
__PSScriptPolicyTest_q1vyvg5w.ssv.psm1
memory/2828-108-0x00007FF9F03B0000-0x00007FF9F0D54000-memory.dmp
memory/2828-122-0x000001FFDF9F0000-0x000001FFDF9FA000-memory.dmp
memory/2828-113-0x00007FF9F03B0000-0x00007FF9F0D54000-memory.dmp
memory/2828-114-0x00007FF9F03B0000-0x00007FF9F0D54000-memory.dmp
memory/2828-116-0x00007FF9F03B0000-0x00007FF9F0D54000-memory.dmp
memory/2828-117-0x00007FF9F03B0000-0x00007FF9F0D54000-memory.dmp
memory/2828-115-0x00007FF9F03B0000-0x00007FF9F0D54000-memory.dmp
memory/2828-121-0x000001FFDFC90000-0x000001FFDFD42000-memory.dmp
memory/2828-120-0x000001FFDFA00000-0x000001FFDFA1E000-memory.dmp
memory/2828-112-0x00007FF9F03B0000-0x00007FF9F0D54000-memory.dmp
memory/2828-111-0x00007FF9F03B0000-0x00007FF9F0D54000-memory.dmp
memory/2828-123-0x000001FFDFA40000-0x000001FFDFA5E000-memory.dmp
memory/2828-125-0x00007FF9F03B0000-0x00007FF9F0D54000-memory.dmp
memory/2828-110-0x00007FF9F03B0000-0x00007FF9F0D54000-memory.dmp
memory/2828-103-0x00007FF9F053F000-0x00007FF9F0540000-memory.dmp
memory/2828-109-0x00007FF9F03B0000-0x00007FF9F0D54000-memory.dmp
memory/2828-107-0x00007FF9F03B0000-0x00007FF9F0D54000-memory.dmp
memory/2828-106-0x000001FFC7730000-0x000001FFC7752000-memory.dmp
memory/5940-220-0x000002D3460D0000-0x000002D34636E000-memory.dmp
memory/5940-297-0x000002D3460D0000-0x000002D34636E000-memory.dmp