Overview

overview

10

Static

static

3

2026-05-22...om.exe

windows10-2004-x64

7

2026-05-22...om.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/05/2026, 10:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-22_aef2cc72005d18a2564e88f1f6bb86d9_blankgrabber_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom.exe
  • Size 38.9MB
  • Sample260522-l5nlyagy6l
  • SHA256 1bc7b48dc00d0b49fa0eb87475951514be88067b2e764a24222def55501b70b9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 46 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 8 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-22_aef2cc72005d18a2564e88f1f6bb86d9_blankgrabber_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-22_aef2cc72005d18a2564e88f1f6bb86d9_blankgrabber_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3356
    • C:\Users\Admin\AppData\Local\Temp\2026-05-22_aef2cc72005d18a2564e88f1f6bb86d9_blankgrabber_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-05-22_aef2cc72005d18a2564e88f1f6bb86d9_blankgrabber_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1708

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PySide6\QtCore.pyd
        • Size 3.1MB
        • SHA256 97612934c29d24c2f4c6a16a75171c061384261877038fe80f43048c800c92f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PySide6\QtGui.pyd
        • Size 3.7MB
        • SHA256 53d23667b0167c21064eef83ca3dfdbdc5f95f8953929de084146f4c5054a7f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PySide6\QtWidgets.pyd
        • Size 4.6MB
        • SHA256 cef76cbe093a955d9bc8a18be29e5f7adcd3fdf97b145a39b4f7e41f9738f40c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd
        • Size 18KB
        • SHA256 47db23efe5b68524fbf387d7a1355f6d007c922b3f9ad273b5d038cce4bb3c2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\sqlite3.dll
        • Size 1.5MB
        • SHA256 93b889157cab2641dd3f51d6c4a6becee1bdc37111f5d9069f97a6a024c185c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\Qt6Core.dll
        • Size 9.8MB
        • SHA256 d8c54af3d84b16c17a086451ee8ef6e821e478603ffb9b91c000a7e50d6a7f6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 34bc69bb2e21c11a6f318c60430852eddac856848842cf0c5a19d22f7733992b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\VCRUNTIME140.dll
        • Size 101KB
        • SHA256 f18b2e10bce61f9d9b721561c165c4d2486b30fc486d62d5a6e45ed76049c252
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\_bz2.pyd
        • Size 71KB
        • SHA256 1c0b4d13924dbee0a8ff0ad2185e75218f216d100247730409f7acba469c2608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\_ctypes.pyd
        • Size 113KB
        • SHA256 dc04cfcdc03b61741fab41d20adc97eec112e01a9ef48636ea75e868a3f3d8ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\_lzma.pyd
        • Size 143KB
        • SHA256 5afcb2b06ca2e97cf4a5f0e14ef2a7cf0620992044ba0343e47116560de8fde3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\_queue.pyd
        • Size 20KB
        • SHA256 0d0621aba45dbb8b1854501e93a88e1250181f008879955f283444267c28f3c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\_socket.pyd
        • Size 70KB
        • SHA256 757783e530405dffa78d89d348d34c9f055672fdfdbada1dd017bf8629feb5ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\_sqlite3.pyd
        • Size 109KB
        • SHA256 de6add9c0f3fa5b06f4782d510b464fde5499fd1019ad96643373a1ee9d21d04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\_ssl.pyd
        • Size 161KB
        • SHA256 3209ee7956cbc5f0aca9bf39041959da0087e5cd5fda457dd583336a1eb79cfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\libcrypto-3-x64.dll
        • Size 5.7MB
        • SHA256 0a1ae179afdc80527997905e301941fcffe688083e5290c68ffce13d711c4618
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\libffi-8.dll
        • Size 27KB
        • SHA256 173df735b8db41e4cbf9ec5f3d84dbdbc222a2479f009931e6a1841227112fff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\libssl-3-x64.dll
        • Size 914KB
        • SHA256 b69c989afda6359c847b4c36cabe3a9ce081c6aad71b4385368961f1bb805add
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyside6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\pyside6.abi3.dll
        • Size 253KB
        • SHA256 6f3fb0793f16e40576b71b6f88e14288efc3ac55eb7be9cb158d8ee764bf9c1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\python3.dll
        • Size 55KB
        • SHA256 f01ce0f091b3f7660cc9a00a96d508ec3076ccd13a045d09d09443effe57f5cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\python312.dll
        • Size 6.7MB
        • SHA256 7e5b70f491585c51a309e7de9d03f0258dbacabb853e7db44f85dda24e54d7e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qt6widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\qt6widgets.dll
        • Size 6.3MB
        • SHA256 77dff21c7f28072da5d05288822f1e750d37e3827b2e051acad01af18d8d4130
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shiboken6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\shiboken6.abi3.dll
        • Size 373KB
        • SHA256 ad3dd18c1cbb1641dc9bca5bed350e0a108d90d1799ae91f0e4a83997d2d5e09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Shiboken.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\shiboken6\Shiboken.pyd
        • Size 32KB
        • SHA256 e44152f30538477225002e6f8bebf7ac2de1534da5ce5ad17402c9c8d6ce8045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\shiboken6\msvcp140.dll
        • Size 536KB
        • SHA256 d8fcd3b7619e7aa5623653afecbec42751358e56ac04aed7cc679cc494376ef1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\shiboken6\msvcp140_1.dll
        • Size 26KB
        • SHA256 acc334f9d3ddc6fe10f36c50f31cb7cfe01bc270a10ce68112b33640cd180e17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\shiboken6\msvcp140_2.dll
        • Size 265KB
        • SHA256 347b895a8de25338c16b845200f1196c63002621a04a1c0ccb5c87c7e9536228
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3356_134239180383587207\vcruntime140_1.dll
        • Size 28KB
        • SHA256 fe4f518343d41037b301396397b19be2ecf6afecc2ab4b965fbf6579c092b8dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ProfitLook.db
        • Path C:\Users\Admin\AppData\Roaming\ProfitLook\ProfitLook.db
        • Size 212KB
        • SHA256 38f299cbeeef363f35fa2bb4d30ddc94115eef63b91dffb53a18a6b3f6a0ca7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ProfitLook.db-wal
        • Path C:\Users\Admin\AppData\Roaming\ProfitLook\ProfitLook.db-wal
        • Size 221KB
        • SHA256 7fe694289e59c3c129f76ecbc52684cbe6c9674737a790f27c720f8155ca5d46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1708-150-0x00007FFFD2510000-0x00007FFFD2B57000-memory.dmp
        Download

        memory/1708-155-0x00007FFFD2E40000-0x00007FFFD31F7000-memory.dmp
        Download

        memory/1708-152-0x00007FFFD3250000-0x00007FFFD36FD000-memory.dmp
        Download

        memory/1708-139-0x00007FFFD4120000-0x00007FFFD4445000-memory.dmp
        Download

        memory/1708-224-0x000001E888050000-0x000001E888A1A000-memory.dmp
        Download

        memory/1708-257-0x000001E888050000-0x000001E888A1A000-memory.dmp
        Download

        memory/1708-290-0x000001E888050000-0x000001E888A1A000-memory.dmp
        Download

        memory/1708-315-0x000001E888050000-0x000001E888A1A000-memory.dmp
        Download

        memory/1708-340-0x000001E888050000-0x000001E888A1A000-memory.dmp
        Download

        memory/1708-363-0x000001E888050000-0x000001E888A1A000-memory.dmp
        Download

        memory/1708-386-0x000001E888050000-0x000001E888A1A000-memory.dmp
        Download

        memory/1708-411-0x000001E888050000-0x000001E888A1A000-memory.dmp
        Download

        memory/1708-434-0x000001E888050000-0x000001E888A1A000-memory.dmp
        Download

        memory/1708-457-0x000001E888050000-0x000001E888A1A000-memory.dmp
        Download

        memory/1708-480-0x000001E888050000-0x000001E888A1A000-memory.dmp
        Download

        memory/1708-503-0x000001E888050000-0x000001E888A1A000-memory.dmp
        Download

        memory/1708-526-0x000001E888050000-0x000001E888A1A000-memory.dmp
        Download

        memory/1708-549-0x000001E888050000-0x000001E888A1A000-memory.dmp
        Download