Overview

overview

7

Static

static

3

2026-07-11...ar.exe

windows10-2004-x64

7

2026-07-11...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/07/2026, 05:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-11_7c461be303ca6cab3c1f1d9c5708c14d_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 38.3MB
  • Sample260711-gnsgcaex81
  • SHA256 6916f33297ac3598ae781b771489c96d3582ff20a56281ccbc36fffefd298568
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
executionpersistence

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_7c461be303ca6cab3c1f1d9c5708c14d_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-11_7c461be303ca6cab3c1f1d9c5708c14d_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1912
    • C:\Users\Admin\AppData\Local\Temp\2026-07-11_7c461be303ca6cab3c1f1d9c5708c14d_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-11_7c461be303ca6cab3c1f1d9c5708c14d_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:708
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /create /tn WindowsDefenderSecurityScan /xml C:\Users\Admin\AppData\Local\Temp\windows_defender_scan.xml /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4744
  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_7c461be303ca6cab3c1f1d9c5708c14d_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-11_7c461be303ca6cab3c1f1d9c5708c14d_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5604
    • C:\Users\Admin\AppData\Local\Temp\2026-07-11_7c461be303ca6cab3c1f1d9c5708c14d_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-11_7c461be303ca6cab3c1f1d9c5708c14d_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1872
      • C:\Windows\SYSTEM32\schtasks.exe
        schtasks /create /tn WindowsDefenderSecurityScan /xml C:\Users\Admin\AppData\Local\Temp\windows_defender_scan.xml /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4136

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\PyQt6\Qt6\bin\MSVCP140.dll
        • Size 576KB
        • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\PyQt6\Qt6\bin\MSVCP140_1.dll
        • Size 30KB
        • SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\PyQt6\Qt6\bin\Qt6Core.dll
        • Size 5.5MB
        • SHA256 abf826a5763c4b3517258f07060a7a93f4d47ae14f79253304dc2a4dbe0d98a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\PyQt6\Qt6\bin\VCRUNTIME140_1.dll
        • Size 43KB
        • SHA256 1f0f5f2ce671e0f68cf96176721df0e5e6f527c8ca9cfa98aa875b5a3816d460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\PyQt6\QtCore.pyd
        • Size 2.3MB
        • SHA256 029ea8a2f97ca561e2753fc053e70d63545a6d15a43609f9be09002274c538d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\PyQt6\QtWidgets.pyd
        • Size 4.8MB
        • SHA256 3775325ca5cf154b7cc48fd0de3068e04aef249a7818589e3ee80589ab8f4a87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\PyQt6\sip.cp313-win_amd64.pyd
        • Size 108KB
        • SHA256 214959105c8c6fdaa4fb5cf8ddf7dd5a683299744b0c85b14a8d01bf90afa01b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\_asyncio.pyd
        • Size 71KB
        • SHA256 4c6d6690e91974804c1eaf77827ea63882711689baff0718a246796ff40b2a23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\_bz2.pyd
        • Size 83KB
        • SHA256 55894b2b98d01f37b9a8cf4daf926d0161ff23c2fb31c56f9dbbac3a61932712
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\_cffi_backend.cp313-win_amd64.pyd
        • Size 176KB
        • SHA256 d5b09da2e726b4e90cf0edad5d2a0ec52f369dfd060e14d3807a32b2205031fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\_ctypes.pyd
        • Size 129KB
        • SHA256 5c4c489ac052795c27af063c96bc4db5ab250144d4839050cfa9bb3836b87c32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\_hashlib.pyd
        • Size 63KB
        • SHA256 78223aef72777efc93c739f5308a3fc5de28b7d10e6975b8947552a62592772b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\_lzma.pyd
        • Size 155KB
        • SHA256 e44dea262a24df69fd9b50b08d09ae6f8b051137ce0834640c977091a6f9fca8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\_overlapped.pyd
        • Size 55KB
        • SHA256 c8a0e2c0d7f82cedb839d2c0b827cf139113faa4aba05f2345c80e2cf3335b8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\_queue.pyd
        • Size 34KB
        • SHA256 73cade82ee139459fe5841e5631274fc9caf7f579418b613f278125435653539
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\_socket.pyd
        • Size 82KB
        • SHA256 62d0493ced6ca33e2fd8141649dd9889c23b2e9afc5fdf56edb4f888c88fb823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\_ssl.pyd
        • Size 178KB
        • SHA256 e94f0195363c5c9babfc4c17ec6fb1aa8bbabf59e377db66ce6a79c4c58bbd07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\_wmi.pyd
        • Size 39KB
        • SHA256 afad80f9e62a57814779cf3e48352b583c1a0697b11a23cc9db3f4e43f7f8664
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\base_library.zip
        • Size 1.3MB
        • SHA256 8cb6c26c85635846d08e43fceccf1eba77939a6a3e509a702ce172c081ee9c29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bcrypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\bcrypt\_bcrypt.pyd
        • Size 298KB
        • SHA256 898d1fe05e287d66bd379f26eb49d27a260f14666c7dc8b1719dae8c489abff0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\charset_normalizer\md.cp313-win_amd64.pyd
        • Size 10KB
        • SHA256 1f8a5173d8bfe6c569e81c738b830800307ed4586d2ae9ac5cc13a468c6e1892
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
        • Size 122KB
        • SHA256 437ceb75e7bc7c72c9090558397ef3598b0bc7bc499434af5827028083d300ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _rust.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\cryptography\hazmat\bindings\_rust.pyd
        • Size 8.8MB
        • SHA256 92f58bb4f01a75a0ef4dd9425dc2a96ddfe25fc93fd9dc11ea8f0d05b7a4f085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sodium.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\nacl\_sodium.pyd
        • Size 340KB
        • SHA256 d733c23c6a4b21625a4ff07f6562ba882bcbdb0f50826269419d8de0574f88cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\python3.dll
        • Size 70KB
        • SHA256 c1de4bfe57dc4a5be8c72c865d617dc39dfd8162fcd2ce1fac9f401cf9efb504
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\python313.dll
        • Size 5.8MB
        • SHA256 78b1dd211c0e66a0603df48da2c9b67a915ab3258701b9285d3faa255ed8dc25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\select.pyd
        • Size 31KB
        • SHA256 81f124b01a85882e362a42e94a13c0eff2f4ccd72d461821dc5457a789554413
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI19122\unicodedata.pyd
        • Size 695KB
        • SHA256 3f462ee6e7743a87e5791181936539642e3761c55de3de980a125f91fe21f123
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qt_help_en.qm
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56042\PyQt6\Qt6\translations\qt_help_en.qm
        • Size 16B
        • SHA256 9959b510b15d18937848ad13007e30459d2e993c67e564badbfc18f935695c85
        • MD5 SHA1 SHA512
        Submit Download

        memory/708-183-0x00007FFE34C90000-0x00007FFE34EE8000-memory.dmp
        Download

        memory/708-223-0x00007FFE3B020000-0x00007FFE3B23E000-memory.dmp
        Download

        memory/708-224-0x000001ECE2730000-0x000001ECE2740000-memory.dmp
        Download

        memory/1872-385-0x00007FFE2C6B0000-0x00007FFE2C908000-memory.dmp
        Download

        memory/1872-386-0x00007FFE2B110000-0x00007FFE2B32E000-memory.dmp
        Download