Overview

overview

9

Static

static

3

2026-07-10...om.exe

windows10-2004-x64

9

2026-07-10...om.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    110s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 07:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-10_e0877f60921f23b723abf9c0cf0f47a9_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
  • Size 36.4MB
  • Sample260710-h6seqsfs9p
  • SHA256 9e2add138d6a09e1c113f923e0301d063fbcdb9cd14b1ce4b3a37d34222b561f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discovery

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Loads dropped DLL 37 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_e0877f60921f23b723abf9c0cf0f47a9_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_e0877f60921f23b723abf9c0cf0f47a9_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:6124
    • C:\Users\Admin\AppData\Local\Temp\2026-07-10_e0877f60921f23b723abf9c0cf0f47a9_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-10_e0877f60921f23b723abf9c0cf0f47a9_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3968
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /fo csv /nh"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1008
        • C:\Windows\system32\tasklist.exe
          tasklist /fo csv /nh
          4⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4356

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\MSVCP140.dll
        • Size 627KB
        • SHA256 639342ea9a67c0009122238ce070a8257e2e04d367d627509fec29f8442afb42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\_asyncio.pyd
        • Size 76KB
        • SHA256 cc27a21453b309197030b5fa8051a8a9c89aec79f9b81ee4ea2a2551ac0f912f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _brotli.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\_brotli.pyd
        • Size 836KB
        • SHA256 44f02bcf2b15519a487cf653e16b5f9c65f26d0be559592878988ad47148fc5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\_bz2.pyd
        • Size 86KB
        • SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\_ctypes.pyd
        • Size 139KB
        • SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\_elementtree.pyd
        • Size 135KB
        • SHA256 1f8259cc74aed52e4cd2de6cb1b54bec8b1725a84760c1c5b30ded49f652824a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\_hashlib.pyd
        • Size 67KB
        • SHA256 9bc6ffcd2ab4ac87c4035f18b432e888d0d4a36795c97bf3f28ddf32cc34e40f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\_lzma.pyd
        • Size 157KB
        • SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\_overlapped.pyd
        • Size 56KB
        • SHA256 0e8b684fdcc8c6de88bd4b92b6ed44a6fd917949c98b0691285e0cf6c760dc36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\_queue.pyd
        • Size 35KB
        • SHA256 acf60e246f6a83a914fb6c411f04bd3eb8bba83070612ca44af99d74f06c5524
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\_socket.pyd
        • Size 85KB
        • SHA256 65caaa6f35c329d901ba3f3d9f7fc4d7443dcde89907dccbd6748786cc517476
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\_ssl.pyd
        • Size 180KB
        • SHA256 12e31f50739e33b115c7e10febf1ccedeb5d9353cd539c608cc5dd164bee17a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\_uuid.pyd
        • Size 27KB
        • SHA256 635d6c46bbf6b86dd30a802bd1c6e214dabccb44d1452c52f0b557ae5bcc6f68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\_wmi.pyd
        • Size 39KB
        • SHA256 6fb2c6316628664319b2abcf961f0cbbac809966a65b653c86e7864ad8701496
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\_zstd.pyd
        • Size 491KB
        • SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        glfw3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\glfw3.dll
        • Size 226KB
        • SHA256 47eb143f3ef0b148136ac48d27cbd67e0422647fef977d0ee7291d2b09f1102d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imgui_bundle.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\imgui_bundle\_imgui_bundle.pyd
        • Size 28.2MB
        • SHA256 a2926a2bf85bdb5f78e04fe75b5c2fb425d84df690476998e5932ca09cad968c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 8b27ebae75cc99f20075322446af36c9ffcb4e3b400a77d712ef43f007f47f7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\libssl-3.dll
        • Size 776KB
        • SHA256 56dd50fb903b860ace831d0cd6c6250cd57e8655867c3a0fa16eac2d4cc0ba0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libscipy_openblas64_-b788215d9d47792bcba3a2e2a7114320.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\numpy.libs\libscipy_openblas64_-b788215d9d47792bcba3a2e2a7114320.dll
        • Size 19.5MB
        • SHA256 b788215d9d47792bcba3a2e2a71143205a57282828a483f1fb071ca2c159f616
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
        • Size 561KB
        • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiarray_umath.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\numpy\_core\_multiarray_umath.pyd
        • Size 3.7MB
        • SHA256 a4e136e0454d6169bcf534ce57882dd4376804af6a2cc10cce73c30a61a39775
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _umath_linalg.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\numpy\linalg\_umath_linalg.pyd
        • Size 109KB
        • SHA256 430f262492458bc73460e24837c30b2ffed95ee622af2ce19920a9c54291ca78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\psutil\_psutil_windows.pyd
        • Size 69KB
        • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\pyexpat.pyd
        • Size 214KB
        • SHA256 9349be352300fef4b16da0574c670b174d75094574ab51f3d385767d1e3dfc0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\python3.dll
        • Size 72KB
        • SHA256 f3d0cd260a46a9617a8b1d4d5e8703278478c22a910165bffb4e4ddf6562d93f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\python314.dll
        • Size 6.5MB
        • SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\select.pyd
        • Size 32KB
        • SHA256 8c3ee20776d8eb7c441f2006ed46b9ba932060c6b66df4c1e156dcf7738d56ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app_icon.png
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6124_983802_FAJl-1VWSYQ\src\assets\app_icon.png
        • Size 625KB
        • SHA256 1ec36a1c1bc64f7416a47c28173d9ec48605336f7167484fbfc1892ab68beae6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3968-1110-0x00007FFCCF100000-0x00007FFCD0480000-memory.dmp
        Download

        memory/3968-1130-0x00007FFCCF100000-0x00007FFCD0480000-memory.dmp
        Download