Overview

overview

7

Static

static

3

2026-05-25...om.exe

windows10-2004-x64

7

2026-05-25...om.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    25/05/2026, 03:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-25_76f750aa12f145c421f1c36747540131_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
  • Size 9.8MB
  • Sample260525-ebecvaaz3l
  • SHA256 5e18f5fc2b2f6f9e4e110f4c513f7140d15a93ea83a54d0a22b9fa3ba1885fb7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-25_76f750aa12f145c421f1c36747540131_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-25_76f750aa12f145c421f1c36747540131_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Users\Admin\AppData\Local\Temp\2026-05-25_76f750aa12f145c421f1c36747540131_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-05-25_76f750aa12f145c421f1c36747540131_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      PID:3100

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _imaging.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1760_274559_xNj1ryxPtf4\PIL\_imaging.pyd
        • Size 2.4MB
        • SHA256 676e119107b4787c79532c97a0aaa7fbfc891bd267fdbaf5b2888e3b68f0f29f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1760_274559_xNj1ryxPtf4\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1760_274559_xNj1ryxPtf4\_bz2.pyd
        • Size 82KB
        • SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1760_274559_xNj1ryxPtf4\_lzma.pyd
        • Size 155KB
        • SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        exp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1760_274559_xNj1ryxPtf4\exp.dll
        • Size 10.3MB
        • SHA256 4a7a34f2f10d4290bed410285d67b3e78e16544038c6fd25beb4d968a4894514
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1760_274559_xNj1ryxPtf4\python311.dll
        • Size 5.5MB
        • SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3100-29-0x00000289DA900000-0x00000289DAED6000-memory.dmp
        Download