Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/04/2026, 04:31

General

  • Target
    2026-04-20_a2e0b7f52fd8bf41440038569f33f83a_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 12.2MB
  • Sample260420-e5xfhsgz8l
  • SHA256 4261c9374c876caea2e648701f234b9d9c21f8ea1d8b432f249d3cc01ad04643
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-20_a2e0b7f52fd8bf41440038569f33f83a_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-20_a2e0b7f52fd8bf41440038569f33f83a_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2928
    • C:\Users\Admin\AppData\Local\Temp\2026-04-20_a2e0b7f52fd8bf41440038569f33f83a_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-04-20_a2e0b7f52fd8bf41440038569f33f83a_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:920
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:5320

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\VCRUNTIME140.dll
          • Size 106KB
          • SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
          • MD5 SHA1 SHA512 SSDEEP TLSH

          VCRUNTIME140_1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _asyncio.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\_asyncio.pyd
          • Size 63KB
          • SHA256 8ec1af6be27a49e3dc70075d0b5ef9255fad52cbbdab6a5072080085b4e45e89
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _bz2.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\_bz2.pyd
          • Size 82KB
          • SHA256 50e21ce62f8d9bab92f6a7e9b39a86406c32d2df18408bb52ffb3d245c644c7b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _cffi_backend.cp311-win_amd64.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\_cffi_backend.cp311-win_amd64.pyd
          • Size 174KB
          • SHA256 9aee90cf7980c8ff694bb3ffe06c71f87eb6a613033f73e3174a732648d39980
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _ctypes.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\_ctypes.pyd
          • Size 120KB
          • SHA256 b59e103f8ec6c1190ded21eef27bea01579220909c3968eeec37d46d2ed39e80
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _decimal.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\_decimal.pyd
          • Size 247KB
          • SHA256 59fee7a8d0a85ed98bbf5dfb7a0ad64b60cbe88427efd98b3c9faad3e4421a87
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _hashlib.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\_hashlib.pyd
          • Size 63KB
          • SHA256 19dd3b5ebb840885543974a4cb6c8ea4539d76e3672be0f390a3a82443391778
          • MD5 SHA1 SHA512 SSDEEP TLSH

          _lzma.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\_lzma.pyd
          • Size 155KB
          • SHA256 ab822f7e846d4388b6f435d788a028942096ba1344297e0b7005c9d50814981b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-console-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-console-l1-1-0.dll
          • Size 21KB
          • SHA256 e756f6970905657cf73ecb3f57bae55a67be29afa75ae4d16046b0f7229708eb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-datetime-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-datetime-l1-1-0.dll
          • Size 21KB
          • SHA256 4e08856ff5203592c27f943f5586d2214b7c5dacde1b1ef75c2316590ab788c9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-debug-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-debug-l1-1-0.dll
          • Size 21KB
          • SHA256 e83d5e5eb772070999f34a214ebffcf0a6068ebc1c4b4f1991188448f323808d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-errorhandling-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-errorhandling-l1-1-0.dll
          • Size 21KB
          • SHA256 45afaf08d1cd7e43ac5ded47ed5fd708b86e835a9470c81e8130ed6955b84db8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-fibers-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-fibers-l1-1-0.dll
          • Size 21KB
          • SHA256 83ecd4fc05c5603621ab687657b8862175025c9910f8dc1b23135d2350dd9219
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-file-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-file-l1-1-0.dll
          • Size 25KB
          • SHA256 f73000652ca7ca7468ca6134663c99cbaf7bd97740bdbdd5d1e1e23ccfd5db75
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-file-l1-2-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-file-l1-2-0.dll
          • Size 18KB
          • SHA256 d9973270a952b4ce615104520051e847b26e4b1cc330a5a95ba1ae128f0dfdeb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-file-l2-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-file-l2-1-0.dll
          • Size 18KB
          • SHA256 144d3a28e43e47fc1cce956255cc80467d4a6fbbb8f612ec6d85f62de030a924
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-handle-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-handle-l1-1-0.dll
          • Size 21KB
          • SHA256 2783b85d98f4a92faf67a94fc04e9c2f6786627949984828d14deab1682bbe3f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-heap-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-heap-l1-1-0.dll
          • Size 21KB
          • SHA256 6d14b49e8e21de08b9fa778f15c259dbd4feb9b54eb628d69bd50e5c86aa65a5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-interlocked-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-interlocked-l1-1-0.dll
          • Size 21KB
          • SHA256 22cf7040d9cb3dc79d941a6bbe4cebd5beaa1355d6e424843e6970404281e61e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-libraryloader-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-libraryloader-l1-1-0.dll
          • Size 21KB
          • SHA256 425e4ebee71347295e36776d415611d451e2a51b451df57da23ed8f8fb4664e8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-localization-l1-2-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-localization-l1-2-0.dll
          • Size 20KB
          • SHA256 6475f20f46814d28845c2fa73e9c283a8504483fa16d911325588c778cf76c26
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-memory-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-memory-l1-1-0.dll
          • Size 21KB
          • SHA256 9c5ea7a7e943c65da3aeff4da33b47fc4a3becea2f7a0b6aa2b632cd6d8b4632
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-namedpipe-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-namedpipe-l1-1-0.dll
          • Size 21KB
          • SHA256 245cf5d5abc866d5ce327c4a1524ae3954ccfc9a7284c817fa15962695e6b6fa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-processenvironment-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-processenvironment-l1-1-0.dll
          • Size 21KB
          • SHA256 3add350dcd79c64a98e47adf733f26c9fdf47df097b060f04f067cdaf32e99cc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-processthreads-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-processthreads-l1-1-0.dll
          • Size 21KB
          • SHA256 42f88e44e488a74af796e8c2a2548879764a40e554f35d1deb8eaff5def09e20
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-processthreads-l1-1-1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-processthreads-l1-1-1.dll
          • Size 18KB
          • SHA256 ae574c9b8a2467c3ee0ac3e862255e93a02627bce146ad7b720b99905dc224fc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-profile-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-profile-l1-1-0.dll
          • Size 21KB
          • SHA256 cac8fb2938ed80bd7eed42e3c68dead6cb41c30cfb567f23085986422f1a2747
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-rtlsupport-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-rtlsupport-l1-1-0.dll
          • Size 21KB
          • SHA256 02fd3b0adf86967b6fc133797c12fa9ee8d0cf64778b5ca937b56e86ac726343
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-string-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-string-l1-1-0.dll
          • Size 21KB
          • SHA256 c9103f6afdd8a6fea734da372911b0a3b018a84e00675a9355ea6f091e641781
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-synch-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-synch-l1-1-0.dll
          • Size 21KB
          • SHA256 882edcaa7b39dc9e330d1b3dcb2a770be2404d6358d76cf4cf5e52231bedac60
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-synch-l1-2-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-synch-l1-2-0.dll
          • Size 18KB
          • SHA256 9566b81b1c6db1727a4bb3a7a3de12247ff5297f34548593280ec31f2b2e2c65
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-sysinfo-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-sysinfo-l1-1-0.dll
          • Size 21KB
          • SHA256 e92ce06aa782a4e50a5bc95da5ac5ded0dc3da7e1152078002a12367aa7cc1af
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-timezone-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-timezone-l1-1-0.dll
          • Size 18KB
          • SHA256 5909e928d791f67a13e3130033cb0e2178f5167a644c3ab5336322d38356db47
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-core-util-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-core-util-l1-1-0.dll
          • Size 21KB
          • SHA256 edd387b01cb9d85a44e27e656e5ea6898b8e9604682db29cb87ee3236f3a1d9f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-conio-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-crt-conio-l1-1-0.dll
          • Size 21KB
          • SHA256 bf651fcd0f10dc528caa3168abd6ea528458c78aaa75b93b3c615d5a18567192
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-convert-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-crt-convert-l1-1-0.dll
          • Size 22KB
          • SHA256 91c5966932287078d0e616d8e0369347991f39765749bbffa1ed3a9df49776d9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-environment-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-crt-environment-l1-1-0.dll
          • Size 18KB
          • SHA256 8d9d3e905d072c4465e4787dd5bd843d3a5dd5ac5ad9d7f232032b25facc82ab
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-filesystem-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-crt-filesystem-l1-1-0.dll
          • Size 20KB
          • SHA256 8f9361d02f68392127fe264655eac4fef4a4a1bf63571f184ce26faa98670702
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-heap-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-crt-heap-l1-1-0.dll
          • Size 18KB
          • SHA256 76dad3e04c9ff61b40ae1c9e039837cd1c077d59b6a008643e4fbf2dbdb564dc
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-locale-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-crt-locale-l1-1-0.dll
          • Size 18KB
          • SHA256 ba1458f730ff90009483c763926d1c74383480e529541c0ef5d4de44e7a4f14c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-math-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-crt-math-l1-1-0.dll
          • Size 27KB
          • SHA256 5f2bb085217304006c81c55214c6093ec476e554e31808026e424da82f58aa0e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-process-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-crt-process-l1-1-0.dll
          • Size 21KB
          • SHA256 a7433b9f8965f914da00dda4ede62d4db69f561a548cbc8d312293d0917a33c7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-runtime-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-crt-runtime-l1-1-0.dll
          • Size 22KB
          • SHA256 11aca97acda31203aeee496c9f183b49db1c54d0efa48888a15ab4ea47ee080f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-stdio-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-crt-stdio-l1-1-0.dll
          • Size 24KB
          • SHA256 cf7bbe93ae75a1c46a38204a6acef71bf2f5e3cd34501825601900e07d3d7b15
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-string-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-crt-string-l1-1-0.dll
          • Size 24KB
          • SHA256 b516d1772b75714f039440cf5d070b87a187d2f67b7f891c94cf1c60330fbfa7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-time-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-crt-time-l1-1-0.dll
          • Size 20KB
          • SHA256 a4b0f75854949980d410c5da90c36ddb94be292431c89fd3e992f9d5f8ee9983
          • MD5 SHA1 SHA512 SSDEEP TLSH

          api-ms-win-crt-utility-l1-1-0.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\api-ms-win-crt-utility-l1-1-0.dll
          • Size 18KB
          • SHA256 d675ee0c418c4cd7ff0c19c2d945331c8e6072a51abbca548e7d9d2f1bf288dd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          base_library.zip

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\base_library.zip
          • Size 1.4MB
          • SHA256 f3ad31762a73dc28666344a2e67e1019bf89e0239d66b734cc50f05f4a946166
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libcrypto-1_1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\libcrypto-1_1.dll
          • Size 3.3MB
          • SHA256 eb975c94e5f4292edd9a8207e356fe4ea0c66e802c1e9305323d37185f85ad6d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libffi-8.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\libffi-8.dll
          • Size 37KB
          • SHA256 68fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libssl-1_1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\libssl-1_1.dll
          • Size 686KB
          • SHA256 d98dd943517963fd0e790fde00965822aa4e4a48e8a479afad74abf14a300771
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pyexpat.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\pyexpat.pyd
          • Size 194KB
          • SHA256 3d81d06311a8a15967533491783ea9c7fc88d594f40eee64076723cebdd58928
          • MD5 SHA1 SHA512 SSDEEP TLSH

          python311.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\python311.dll
          • Size 5.5MB
          • SHA256 0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae
          • MD5 SHA1 SHA512 SSDEEP TLSH

          select.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\select.pyd
          • Size 29KB
          • SHA256 b5d4d5b6da675376bd3b2824d9cda957b55fe3d8596d5675381922ef0e64a0f5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ucrtbase.dll

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\ucrtbase.dll
          • Size 973KB
          • SHA256 4c5b8e529854cedfa8f46cd6906952400cdbbf25efc4cf37dda2c42d8e96ddcb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          unicodedata.pyd

          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29282\unicodedata.pyd
          • Size 1.1MB
          • SHA256 a5db7900ecd5ea5ab1c06a8f94b2885f00dd2e1adf34bcb50c8a71691a97804f
          • MD5 SHA1 SHA512 SSDEEP TLSH