Overview

overview

9

Static

static

3

2026-07-10...om.exe

windows10-2004-x64

9

2026-07-10...om.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/07/2026, 07:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-10_e0877f60921f23b723abf9c0cf0f47a9_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
  • Size 36.4MB
  • Sample260710-h6seqsfs9p
  • SHA256 9e2add138d6a09e1c113f923e0301d063fbcdb9cd14b1ce4b3a37d34222b561f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discovery

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Loads dropped DLL 38 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_e0877f60921f23b723abf9c0cf0f47a9_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_e0877f60921f23b723abf9c0cf0f47a9_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4708
    • C:\Users\Admin\AppData\Local\Temp\2026-07-10_e0877f60921f23b723abf9c0cf0f47a9_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-10_e0877f60921f23b723abf9c0cf0f47a9_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4596
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:2348
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /fo csv /nh"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4100
          • C:\Windows\system32\tasklist.exe
            tasklist /fo csv /nh
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:2124

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          MSVCP140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\MSVCP140.dll
          • Size 627KB
          • SHA256 639342ea9a67c0009122238ce070a8257e2e04d367d627509fec29f8442afb42
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\VCRUNTIME140.dll
          • Size 117KB
          • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\_asyncio.pyd
          • Size 76KB
          • SHA256 cc27a21453b309197030b5fa8051a8a9c89aec79f9b81ee4ea2a2551ac0f912f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _brotli.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\_brotli.pyd
          • Size 836KB
          • SHA256 44f02bcf2b15519a487cf653e16b5f9c65f26d0be559592878988ad47148fc5e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\_bz2.pyd
          • Size 86KB
          • SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\_ctypes.pyd
          • Size 139KB
          • SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _elementtree.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\_elementtree.pyd
          • Size 135KB
          • SHA256 1f8259cc74aed52e4cd2de6cb1b54bec8b1725a84760c1c5b30ded49f652824a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\_hashlib.pyd
          • Size 67KB
          • SHA256 9bc6ffcd2ab4ac87c4035f18b432e888d0d4a36795c97bf3f28ddf32cc34e40f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\_lzma.pyd
          • Size 157KB
          • SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\_overlapped.pyd
          • Size 56KB
          • SHA256 0e8b684fdcc8c6de88bd4b92b6ed44a6fd917949c98b0691285e0cf6c760dc36
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\_socket.pyd
          • Size 85KB
          • SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\_ssl.pyd
          • Size 180KB
          • SHA256 12e31f50739e33b115c7e10febf1ccedeb5d9353cd539c608cc5dd164bee17a7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\_uuid.pyd
          • Size 27KB
          • SHA256 635d6c46bbf6b86dd30a802bd1c6e214dabccb44d1452c52f0b557ae5bcc6f68
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _wmi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\_wmi.pyd
          • Size 39KB
          • SHA256 6fb2c6316628664319b2abcf961f0cbbac809966a65b653c86e7864ad8701496
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _zstd.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\_zstd.pyd
          • Size 491KB
          • SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          glfw3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\glfw3.dll
          • Size 226KB
          • SHA256 47eb143f3ef0b148136ac48d27cbd67e0422647fef977d0ee7291d2b09f1102d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _imgui_bundle.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\imgui_bundle\_imgui_bundle.pyd
          • Size 28.2MB
          • SHA256 a2926a2bf85bdb5f78e04fe75b5c2fb425d84df690476998e5932ca09cad968c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\libcrypto-3.dll
          • Size 5.0MB
          • SHA256 8b27ebae75cc99f20075322446af36c9ffcb4e3b400a77d712ef43f007f47f7d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\libssl-3.dll
          • Size 776KB
          • SHA256 56dd50fb903b860ace831d0cd6c6250cd57e8655867c3a0fa16eac2d4cc0ba0b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libscipy_openblas64_-b788215d9d47792bcba3a2e2a7114320.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\numpy.libs\libscipy_openblas64_-b788215d9d47792bcba3a2e2a7114320.dll
          • Size 19.5MB
          • SHA256 b788215d9d47792bcba3a2e2a71143205a57282828a483f1fb071ca2c159f616
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
          • Size 561KB
          • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multiarray_umath.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\numpy\_core\_multiarray_umath.pyd
          • Size 3.7MB
          • SHA256 a4e136e0454d6169bcf534ce57882dd4376804af6a2cc10cce73c30a61a39775
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _umath_linalg.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\numpy\linalg\_umath_linalg.pyd
          • Size 109KB
          • SHA256 430f262492458bc73460e24837c30b2ffed95ee622af2ce19920a9c54291ca78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _psutil_windows.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\psutil\_psutil_windows.pyd
          • Size 69KB
          • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\pyexpat.pyd
          • Size 214KB
          • SHA256 9349be352300fef4b16da0574c670b174d75094574ab51f3d385767d1e3dfc0d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\python3.dll
          • Size 72KB
          • SHA256 f3d0cd260a46a9617a8b1d4d5e8703278478c22a910165bffb4e4ddf6562d93f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python314.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\python314.dll
          • Size 6.5MB
          • SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\select.pyd
          • Size 32KB
          • SHA256 8c3ee20776d8eb7c441f2006ed46b9ba932060c6b66df4c1e156dcf7738d56ce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          app_icon.png
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4708_443751_AnyOGn5CuuE\src\assets\app_icon.png
          • Size 625KB
          • SHA256 1ec36a1c1bc64f7416a47c28173d9ec48605336f7167484fbfc1892ab68beae6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4596-1129-0x00000181152F0000-0x00000181159E4000-memory.dmp
          Download

          memory/4596-1130-0x00007FFBED490000-0x00007FFBEE810000-memory.dmp
          Download

          memory/4596-1131-0x00000181152F0000-0x00000181159E4000-memory.dmp
          Download

          memory/4596-1132-0x00007FFBED490000-0x00007FFBEE810000-memory.dmp
          Download