Overview

overview

9

Static

static

3

2026-07-14...om.exe

windows10-2004-x64

9

2026-07-14...om.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    151s
  • max time network
    108s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    14/07/2026, 14:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-14_dcba8647a9633791d6cf772238e7d9d1_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
  • Size 45.5MB
  • Sample260714-rr3rlahs2x
  • SHA256 c3e95570e3dc99270ca30513c205a66654c774fe08f6ce2e316360ae1049b263
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
execution

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Loads dropped DLL 45 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-14_dcba8647a9633791d6cf772238e7d9d1_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-14_dcba8647a9633791d6cf772238e7d9d1_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4496
    • C:\Users\Admin\AppData\Local\Temp\2026-07-14_dcba8647a9633791d6cf772238e7d9d1_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-14_dcba8647a9633791d6cf772238e7d9d1_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:3292
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue'; $target='C:\\Users\\Admin\\AppData'; $pPid=3292; $currentPid=$PID; function Global-Nuke { try { $procs=Get-Process | Where-Object { $_.Path -like \"$target*\" -and $_.Id -ne $PID }; $handleProcs=@(); try { $allProcs=Get-Process; foreach($p in $allProcs){ if($p.Id -ne $PID){ try { $handles=Get-WmiObject Win32_ProcessHandle -Filter \"ProcessId=$($p.Id)\" 2>$null; foreach($h in $handles){ if($h.Handle -and $h.Handle.Name -like \"$target*\"){ $handleProcs +=$p; break; } } } catch { } } } } catch { } $allProcsToKill=$procs + $handleProcs | Select-Object -Unique; foreach($p in $allProcsToKill){ try { Stop-Process -Id $p.Id -Force -ErrorAction Stop; } catch { try { taskkill /F /T /PID $p.Id /NoWindow 2>$null; } catch { } } } } catch { } }; $monitorCount=0; while($true){ Start-Sleep -Milliseconds 500; $monitorCount++; try { $parent=Get-Process -Id $pPid -ErrorAction Stop; } catch { Global-Nuke; break; } }; Stop-Process -Id $currentPid -Force"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1272

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\PySide6\QtCore.pyd
        • Size 3.2MB
        • SHA256 be52341a5df1f76ecca2fb1e94eb429dfa46f0b659ed6536f25119b565b21ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\PySide6\QtGui.pyd
        • Size 3.7MB
        • SHA256 f0549716b10a8b4fbd5c6c041f36af215223809f919f4c4722d44cc199d5c593
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\PySide6\QtWidgets.pyd
        • Size 4.6MB
        • SHA256 85cb6c2181b4b09887a7d8507dd950844d1b8f74a9c4002c7b71169f75bf6fda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\Qt6Core.dll
        • Size 10.0MB
        • SHA256 65fe6224b6c47a15b058738031d31dce9928c4d7a58e1b8db6434f6f5cddd702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 cd071161ad325ff2de92b0e33d71334ef20712544796949623ce92dfb3957e90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\Qt6Widgets.dll
        • Size 6.3MB
        • SHA256 5a9f37dedd3dc5bcc1a4bb8ea919c49fc62df751a1450accc34379eb6710eab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\_bz2.pyd
        • Size 84KB
        • SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\_ctypes.pyd
        • Size 124KB
        • SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\_lzma.pyd
        • Size 157KB
        • SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\_socket.pyd
        • Size 83KB
        • SHA256 3efa4636cf9e350856f6927d67a4c2564bf9bd2758a00bbf17d3aece5b60016d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\_ssl.pyd
        • Size 175KB
        • SHA256 0bc527d2dbc50009f43b2ed5d5982c4f63f4b647647ffa9eda612dcda80f6040
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\_uuid.pyd
        • Size 26KB
        • SHA256 acce4f281d7ffb2dec0997527faf25b1df62ad7bd3032c568ddcf65c90edc867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\_wmi.pyd
        • Size 39KB
        • SHA256 a980f1e7a29842bd946863fc2693fbeb555a9dc0f9e1630dfed9a2fcdef3ece2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\libssl-3.dll
        • Size 776KB
        • SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        main.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\main.dll
        • Size 28.4MB
        • SHA256 bf0cab451fd919bcff33b9770f2f6502d8bec15d6f6817aa1b8fab61cae175c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orjson.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\orjson\orjson.pyd
        • Size 218KB
        • SHA256 0c40fb1b55914918543780266e63ae8024a9e3de9c06b6d7df1e330370bc2cb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        palooz.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\palooz.pyd
        • Size 246KB
        • SHA256 18e36d498192fc7a90ec8bbfe7687becfbb1b09614fabdd14e7347097c705be2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyside6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\pyside6.abi3.dll
        • Size 242KB
        • SHA256 d4072be872b31f3748de5e6c28cb2976dafbf063d3ccfa38e5dabda29babcdaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\python3.dll
        • Size 68KB
        • SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\python312.dll
        • Size 6.6MB
        • SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        T_Male_Trader01_v06_icon_normal.webp
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\resources\game_data\icons\pals\T_Male_Trader01_v06_icon_normal.webp
        • Size 1KB
        • SHA256 87891eaa078eb0b0bd4dbace894c0e2d6af60e1d631f22152a38cf33b1fc7624
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        T_Male_Trader01_v07_icon_normal.webp
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\resources\game_data\icons\pals\T_Male_Trader01_v07_icon_normal.webp
        • Size 2KB
        • SHA256 344fd29cbc6dea21df2e8b318498be8e6e55974ee0280d9f413276152dfd38dd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        T_Male_Trader01_v08_icon_normal.webp
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\resources\game_data\icons\pals\T_Male_Trader01_v08_icon_normal.webp
        • Size 2KB
        • SHA256 2facf81f64a914e6fde4eeb8ed542755632bfc517ccaf3c907a7177bae203c04
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        T_Male_Trader01_v11_icon_normal.webp
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\resources\game_data\icons\pals\T_Male_Trader01_v11_icon_normal.webp
        • Size 1KB
        • SHA256 ba7f8613a2a745f75cffd84d5bcca7f70839a9bfbc52cae7c2458426a5bb0d6a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        T_Male_Trader01_v18_icon_normal.webp
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\resources\game_data\icons\pals\T_Male_Trader01_v18_icon_normal.webp
        • Size 2KB
        • SHA256 b7aab0d30255d36c8cc24b8ba9d2bb9ae1036dbf428b40a158d1d31acaea7ce1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        T_itemicon_Weapon_SphereLauncher.webp
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\resources\game_data\icons\technologies\T_itemicon_Weapon_SphereLauncher.webp
        • Size 7KB
        • SHA256 9bc6a97dca038b707208673eb8a5685a1746690e9906657da7040dc691b5c422
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\select.pyd
        • Size 32KB
        • SHA256 d4d7181b11db0bd22a6cd5cda6f8583d1f5c77615fd0a6ca33350619d6e0438a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shiboken6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\shiboken6.abi3.dll
        • Size 375KB
        • SHA256 47f4f9b44c95037565dd14f4be04f350f20c53c05483b750e0be867c39a7441e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\shiboken6\MSVCP140.dll
        • Size 536KB
        • SHA256 005f2324c7ff79bbe9a44992b0708abb4c871bd24bcc7a34aca5eab4439c1f4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\shiboken6\MSVCP140_2.dll
        • Size 265KB
        • SHA256 c0ab58670a2cebaad8e7ef1f57d8f684a43bdf1c39d20a032088425905802655
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Shiboken.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\shiboken6\Shiboken.pyd
        • Size 32KB
        • SHA256 0e2c5318c5ac60a016a12230bbb1f6a9d990c45cbf4a7c4af24aefb5ab7dc40a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\shiboken6\msvcp140_1.dll
        • Size 26KB
        • SHA256 d878d7cb27187247a3ce1adfdf1f9b7b703e4429bc55f3e95284a43e80c10151
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        config.json
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4496_171954_rhecsd-1SpI\src\data\configs\config.json
        • Size 70B
        • SHA256 ca4cd2f5d136fc210585bfdabec96efd61a8e4d5f9a843301c04149b30403a36
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1272-2900-0x0000022CE0240000-0x0000022CE0262000-memory.dmp
        Download

        memory/3292-2876-0x00007FFEF9A90000-0x00007FFEF9E4B000-memory.dmp
        Download

        memory/3292-2872-0x00007FFEF47F0000-0x00007FFEF4CA9000-memory.dmp
        Download

        memory/3292-2873-0x00007FFEF3860000-0x00007FFEF3EAD000-memory.dmp
        Download

        memory/3292-2863-0x00007FFF0E820000-0x00007FFF0EB53000-memory.dmp
        Download