Overview

overview

7

Static

static

3

2026-05-25...om.exe

windows10-2004-x64

7

2026-05-25...om.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    25/05/2026, 03:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-25_046235f7a4c8a678af912aedb9bef5d2_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
  • Size 9.8MB
  • Sample260525-d1lyjsd15x
  • SHA256 9c70b3a739822c866ef86864a60ea9da5ea864b88ae7a364cbaec69e9c164d3a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-25_046235f7a4c8a678af912aedb9bef5d2_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-25_046235f7a4c8a678af912aedb9bef5d2_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Users\Admin\AppData\Local\Temp\2026-05-25_046235f7a4c8a678af912aedb9bef5d2_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-05-25_046235f7a4c8a678af912aedb9bef5d2_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      PID:2980

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _imaging.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2528_312298_ouvS4jjYGhk\PIL\_imaging.pyd
        • Size 2.4MB
        • SHA256 676e119107b4787c79532c97a0aaa7fbfc891bd267fdbaf5b2888e3b68f0f29f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2528_312298_ouvS4jjYGhk\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2528_312298_ouvS4jjYGhk\_bz2.pyd
        • Size 82KB
        • SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2528_312298_ouvS4jjYGhk\_lzma.pyd
        • Size 155KB
        • SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        exp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2528_312298_ouvS4jjYGhk\exp.dll
        • Size 10.3MB
        • SHA256 d934966b8722156892dd67f26745db7b29f0593877b812f3a62f7fd28c1802c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2528_312298_ouvS4jjYGhk\python311.dll
        • Size 5.5MB
        • SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download