Overview

overview

10

Static

static

3

2026-06-10...om.exe

windows10-2004-x64

8

2026-06-10...om.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    9s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    10/06/2026, 02:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-10_022ecc20a6fe98ebdfc96451dc8b472e_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
  • Size 34.9MB
  • Sample260610-clfmjsdv5p
  • SHA256 c3cb8985c6ca5d9ad34c55e90b23561a561579c037e714b6521901b135f8c942
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryexploitblankgrabberpersistenceprivilege_escalationstealer

Malware Config

Signatures

  • Family: blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber
  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Possible privilege escalation attempt 4 IoCs
    exploit
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 33 IoCs
  • Modifies file permissions 1 TTPs 4 IoCs
    discovery
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 15 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-10_022ecc20a6fe98ebdfc96451dc8b472e_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-10_022ecc20a6fe98ebdfc96451dc8b472e_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Users\Admin\AppData\Local\Temp\2026-06-10_022ecc20a6fe98ebdfc96451dc8b472e_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-06-10_022ecc20a6fe98ebdfc96451dc8b472e_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3552
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls||clear
        3⤵
          PID:4648
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4028
          • C:\Windows\system32\netsh.exe
            netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:2996
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1320
          • C:\Windows\system32\netsh.exe
            netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:4684
        • C:\Windows\SYSTEM32\takeown.exe
          takeown /F C:\Windows\localhost.crt
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:4968
        • C:\Windows\SYSTEM32\icacls.exe
          icacls C:\Windows\localhost.crt /grant Administrators:F
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:3284
        • C:\Windows\SYSTEM32\takeown.exe
          takeown /F C:\Windows\localhost.key
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:2316
        • C:\Windows\SYSTEM32\icacls.exe
          icacls C:\Windows\localhost.key /grant Administrators:F
          3⤵
          • Possible privilege escalation attempt
          • Modifies file permissions
          PID:3220
        • C:\Windows\SYSTEM32\certutil.exe
          certutil -addstore Root C:\Windows\localhost.crt
          3⤵
            PID:2352
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "ipconfig /flushdns"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4656
            • C:\Windows\system32\ipconfig.exe
              ipconfig /flushdns
              4⤵
              • Gathers network information
              PID:3408
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:496
            • C:\Windows\system32\netsh.exe
              netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:3476
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3924
            • C:\Windows\system32\netsh.exe
              netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:5108
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh interface ipv4 add address "name=Loopback Pseudo-Interface 1" address=162.159.133.234 mask=255.255.255.255"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2296
            • C:\Windows\system32\netsh.exe
              netsh interface ipv4 add address "name=Loopback Pseudo-Interface 1" address=162.159.133.234 mask=255.255.255.255
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:1056
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "start "" "C:\Users\hTNPDnElge.exe""
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2308
            • C:\Users\hTNPDnElge.exe
              "C:\Users\hTNPDnElge.exe"
              4⤵
              • Executes dropped EXE
              PID:4708

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            _imaging.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\PIL\_imaging.pyd
            • Size 2.5MB
            • SHA256 a6150bd6d42c8179bb0bef700765b1dba247b89e115808f70727eb5a04fc344f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _imagingft.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\PIL\_imagingft.pyd
            • Size 2.1MB
            • SHA256 bc9e0564c33a1319438de7a08f555b325c9b7e28d316680c53f19572d5e5655c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\VCRUNTIME140.dll
            • Size 94KB
            • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _brotli.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\_brotli.pyd
            • Size 801KB
            • SHA256 791e7195d7df47a21466868f3d7386cff13f16c51fcd0350bf4028e96278dff1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\_bz2.pyd
            • Size 78KB
            • SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _cffi_backend.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\_cffi_backend.pyd
            • Size 175KB
            • SHA256 c379126647af2cbfb592d6a921f6218da59b886e2a56e9b82f8159aced6f1100
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\_ctypes.pyd
            • Size 117KB
            • SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _elementtree.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\_elementtree.pyd
            • Size 119KB
            • SHA256 16480ede0430be5249481a9bfb843eb0ef98f93b467a5428352fc23cc8c9051d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\_hashlib.pyd
            • Size 57KB
            • SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\_lzma.pyd
            • Size 149KB
            • SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\_queue.pyd
            • Size 26KB
            • SHA256 9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\_socket.pyd
            • Size 72KB
            • SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\_ssl.pyd
            • Size 152KB
            • SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            orchestrator.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\chardet\pipeline\orchestrator.pyd
            • Size 10KB
            • SHA256 5227e0a6b9bc555971f3f0c4d5014b9abfefbe62a6e82d9e0b9d34d48d0e7c3e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\libcrypto-1_1.dll
            • Size 3.3MB
            • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-7.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\libffi-7.dll
            • Size 32KB
            • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\libssl-1_1.dll
            • Size 678KB
            • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _sodium.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\nacl\_sodium.pyd
            • Size 396KB
            • SHA256 57822e7aed944269943bcb855fc14560a5b6ae38869de4e3d00c380a5119ecc7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _psutil_windows.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\psutil\_psutil_windows.pyd
            • Size 69KB
            • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pyexpat.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\pyexpat.pyd
            • Size 187KB
            • SHA256 e2146bed9720eb94388532551444f434d3195310fa7bd117253e7df81a8e187e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            injector.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\pyinjector\injector.pyd
            • Size 20KB
            • SHA256 10575c0fe3fa9dabeddb0f65beb38e3d99081245de46c6770994ed28dbba397e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\python3.dll
            • Size 60KB
            • SHA256 8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python310.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\python310.dll
            • Size 4.2MB
            • SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pywintypes310.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\pywintypes310.dll
            • Size 132KB
            • SHA256 7a7e9bce1b56932dcc1d27edd05adbaeab82a201a15e0f24d2d32fbd99c1b682
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\select.pyd
            • Size 25KB
            • SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\unicodedata.pyd
            • Size 1.1MB
            • SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcruntime140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\vcruntime140_1.dll
            • Size 36KB
            • SHA256 04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            win32security.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1500_397387_S3C1aFnnC4I\win32security.pyd
            • Size 132KB
            • SHA256 b0cebc35da5125433df59337b82be652a722cfb3dd8c8525f9f250770ecbbbf0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            hTNPDnElge.exe
            • Path C:\Users\hTNPDnElge.exe
            • Size 18.4MB
            • SHA256 cde67e86abfe61a733575f08c52a9067640b8475d6fd8aadf6a8837277071d73
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            localhost.crt
            • Path C:\Windows\localhost.crt
            • Size 1KB
            • SHA256 3f9c8ef590c78a2977096455deea067d0f03457d22149c3b726b78a3085aa4f3
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/3552-128-0x000001E3FB440000-0x000001E3FE755000-memory.dmp
            Download