Overview

overview

9

Static

static

3

2026-06-27...om.exe

windows10-2004-x64

9

2026-06-27...om.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 04:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_9e26fbe82893e299b3e51368a1b73c30_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 14.9MB
  • Sample260629-e7x5tsds2v
  • SHA256 aa97ceacadaaf3f6b84f49e805aa74d380962443cc82787fba184adbe4824e2e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryspywarestealer

Malware Config

Signatures

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VirtualBox drivers on disk 2 TTPs 3 IoCs
    defense_evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare drivers on disk 2 TTPs 2 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 38 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Kills process with taskkill 6 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_9e26fbe82893e299b3e51368a1b73c30_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_9e26fbe82893e299b3e51368a1b73c30_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5504
    • C:\Users\Admin\AppData\Local\Temp\2026-06-27_9e26fbe82893e299b3e51368a1b73c30_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-06-27_9e26fbe82893e299b3e51368a1b73c30_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Looks for VirtualBox Guest Additions in registry
      • Looks for VirtualBox drivers on disk
      • Looks for VMWare Tools registry key
      • Looks for VMWare drivers on disk
      • Checks BIOS information in registry
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6876
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:2588
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic cpu get name"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5068
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic cpu get name
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:548
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic computersystem get model"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3936
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic computersystem get model
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1528
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic diskdrive get model"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:6856
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic diskdrive get model
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:6836
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic baseboard get manufacturer"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:6732
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic baseboard get manufacturer
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:5800
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "wmic path Win32_NetworkAdapter where Manufacturer!='Microsoft' get MACAddress"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3848
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic path Win32_NetworkAdapter where Manufacturer!='Microsoft' get MACAddress
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:7132
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "ver"
          3⤵
            PID:6456
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:6260
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic csproduct get uuid
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:768
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe 2>nul"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:5216
            • C:\Windows\system32\taskkill.exe
              taskkill /F /IM chrome.exe
              4⤵
              • Kills process with taskkill
              PID:6660
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "whoami 2>nul"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2192
            • C:\Windows\system32\whoami.exe
              whoami
              4⤵
                PID:4208
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "whoami 2>nul"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4640
              • C:\Windows\system32\whoami.exe
                whoami
                4⤵
                  PID:6696
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe 2>nul"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:5596
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /IM msedge.exe
                  4⤵
                  • Kills process with taskkill
                  PID:3932
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "whoami 2>nul"
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:4936
                • C:\Windows\system32\whoami.exe
                  whoami
                  4⤵
                    PID:356
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /F /IM brave.exe 2>nul"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2036
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM brave.exe
                    4⤵
                    • Kills process with taskkill
                    PID:2080
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /F /IM chromium.exe 2>nul"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1904
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM chromium.exe
                    4⤵
                    • Kills process with taskkill
                    PID:1268
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe 2>nul"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2600
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM opera.exe
                    4⤵
                    • Kills process with taskkill
                    PID:2244
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "taskkill /F /IM opera.exe 2>nul"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5420
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM opera.exe
                    4⤵
                    • Kills process with taskkill
                    PID:5160

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  _raw_aes.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\Cryptodome\Cipher\_raw_aes.pyd
                  • Size 34KB
                  • SHA256 889f9b558a47a4333bfd3e3814eaec2328ac8648722d912c7873fdea62fcf886
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _raw_aesni.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\Cryptodome\Cipher\_raw_aesni.pyd
                  • Size 15KB
                  • SHA256 6c9a2bed5c1bd9acd8bcea7f5f20f7fa63e4465b0914ae70250bd59a8028333c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _cpuid_c.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\Cryptodome\Util\_cpuid_c.pyd
                  • Size 10KB
                  • SHA256 e7e6f27d5203768e6454b4066847a3af02548c811146da047c4a53b1edaf32e9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VCRUNTIME140.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\VCRUNTIME140.dll
                  • Size 96KB
                  • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VCRUNTIME140_1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\VCRUNTIME140_1.dll
                  • Size 37KB
                  • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _asyncio.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\_asyncio.pyd
                  • Size 62KB
                  • SHA256 aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _bz2.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\_bz2.pyd
                  • Size 81KB
                  • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _cffi_backend.cp311-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\_cffi_backend.cp311-win_amd64.pyd
                  • Size 174KB
                  • SHA256 8100f667a3f64eeb37b9326d0c53a931e0ea3cea4ade5dbdc638c368355c0948
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ctypes.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\_ctypes.pyd
                  • Size 120KB
                  • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _decimal.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\_decimal.pyd
                  • Size 245KB
                  • SHA256 d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _hashlib.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\_hashlib.pyd
                  • Size 62KB
                  • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _lzma.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\_lzma.pyd
                  • Size 154KB
                  • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _multiprocessing.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\_multiprocessing.pyd
                  • Size 32KB
                  • SHA256 0ae3bf383ff998886f97576c55d6bf0a076c24395cf6fcd2265316e9a6e8c007
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _overlapped.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\_overlapped.pyd
                  • Size 48KB
                  • SHA256 a083e83f609ed7a2fc18a95d44d8f91c9dc74842f33e19e91988e84db94c3b5b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _queue.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\_queue.pyd
                  • Size 30KB
                  • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _socket.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\_socket.pyd
                  • Size 76KB
                  • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _sqlite3.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\_sqlite3.pyd
                  • Size 115KB
                  • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ssl.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\_ssl.pyd
                  • Size 155KB
                  • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _uuid.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\_uuid.pyd
                  • Size 23KB
                  • SHA256 f7f57807c15c21c5aa9818edf3993d0b94aef8af5808e1ad86a98637fc499d44
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  base_library.zip
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\base_library.zip
                  • Size 1.4MB
                  • SHA256 6e25d636e775996fb9e9b7edf1f685e31b1a11fe6ef6c0a2dc1bef4012560421
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libcrypto-1_1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\libcrypto-1_1.dll
                  • Size 3.3MB
                  • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libffi-8.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\libffi-8.dll
                  • Size 34KB
                  • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libssl-1_1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\libssl-1_1.dll
                  • Size 686KB
                  • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  pyexpat.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\pyexpat.pyd
                  • Size 193KB
                  • SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  python3.DLL
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\python3.DLL
                  • Size 64KB
                  • SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  python311.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\python311.dll
                  • Size 5.5MB
                  • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  pythoncom311.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\pywin32_system32\pythoncom311.dll
                  • Size 665KB
                  • SHA256 f20794876cd77d37d893512bdd8f2112bb791e134ebf2697c9034fa32eb93c11
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  pywintypes311.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\pywin32_system32\pywintypes311.dll
                  • Size 132KB
                  • SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  select.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\select.pyd
                  • Size 28KB
                  • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sqlite3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\sqlite3.dll
                  • Size 1.4MB
                  • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  unicodedata.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\unicodedata.pyd
                  • Size 1.1MB
                  • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  win32api.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\win32\win32api.pyd
                  • Size 135KB
                  • SHA256 cd9ec02d502dc1548233aa2efe9fcbf47e4677b28c169553f36194a50f55ff28
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  win32crypt.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI55042\win32\win32crypt.pyd
                  • Size 122KB
                  • SHA256 57b37eae88743fe71226365880f8870b2082a8df9775c28019f58c25f75a05c9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download