Overview

overview

7

Static

static

3

2026-07-16...ar.exe

windows10-2004-x64

7

2026-07-16...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    112s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/07/2026, 04:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-16_3fc6647a26f2c93908939086fd291d0f_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 15.9MB
  • Sample260716-e5hx5ac15p
  • SHA256 8f6c3bfc0840e3eff750b96083f72d791d47083443f001b7d524aa21340e131c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasion

Malware Config

Signatures

  • Loads dropped DLL 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies registry class 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-16_3fc6647a26f2c93908939086fd291d0f_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-16_3fc6647a26f2c93908939086fd291d0f_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3200
    • C:\Users\Admin\AppData\Local\Temp\2026-07-16_3fc6647a26f2c93908939086fd291d0f_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-16_3fc6647a26f2c93908939086fd291d0f_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4644
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:4764

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\VCRUNTIME140.dll
          • Size 106KB
          • SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_asyncio.pyd
          • Size 62KB
          • SHA256 45c229c3988f30580c79b38fc0c19c81e6f7d5778e64cef6ce04dd188a9ccab5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_bz2.pyd
          • Size 81KB
          • SHA256 775fbc6e9a4c7e9710205157350f3d6141b5a9e8f44cb07b3eac38f2789c8723
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cffi_backend.cp310-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_cffi_backend.cp310-win_amd64.pyd
          • Size 174KB
          • SHA256 4f1ce205c2be986c9d38b951b6bcb6045eb363e06dacc069a41941f80be9068c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_ctypes.pyd
          • Size 119KB
          • SHA256 e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_decimal.pyd
          • Size 242KB
          • SHA256 4ae6f6fb3992bb878416211221b3d62515e994d78f72eab51e0126ca26d0ee96
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_hashlib.pyd
          • Size 60KB
          • SHA256 cd33f823e608d3bda759ad441f583a20fc0198119b5a62a8964f172559acb7d3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_lzma.pyd
          • Size 153KB
          • SHA256 0a70e8546fa6038029f2a3764e721ceebea415818e5f0df6b90d6a40788c3b31
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multiprocessing.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_multiprocessing.pyd
          • Size 32KB
          • SHA256 af84076b03a0eadec2b75d01f06bb3765b35d6f0639fb7c14378736d64e1acaa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_overlapped.pyd
          • Size 47KB
          • SHA256 f16e595b0a87c32d9abd2035f8ea97b39339548e7c518df16a6cc27ba7733973
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_queue.pyd
          • Size 29KB
          • SHA256 007bcf19d9b036a7e73f5ef31f39bfb1910f72c9c10e4a1b0658352cfe7a8b75
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_socket.pyd
          • Size 75KB
          • SHA256 8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_ssl.pyd
          • Size 155KB
          • SHA256 e33b7a4aa5cdd5462ee66830636fdd38048575a43d06eb7e2f688358525ddeab
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          auto.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_tcl_data\auto.tcl
          • Size 21KB
          • SHA256 517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cp1252.enc
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_tcl_data\encoding\cp1252.enc
          • Size 1KB
          • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          pkgIndex.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_tcl_data\http1.0\pkgIndex.tcl
          • Size 746B
          • SHA256 77265723959c092897c2449c5b7768ca72d0efcd8c505bddbb7a84f6aa401339
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          init.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_tcl_data\init.tcl
          • Size 25KB
          • SHA256 331bcf0f9f635bd57c3384f2237260d074708b0975c700cfcbdb285f5f59ab1f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pkgIndex.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_tcl_data\opt0.4\pkgIndex.tcl
          • Size 620B
          • SHA256 6a4abd2c519a745325c26fb23be7bbf95252d653a24806eb37fd4aa6a6479afe
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          package.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_tcl_data\package.tcl
          • Size 23KB
          • SHA256 f46ab61cdebe3aa45fa7e61a48930d64a0d0e7e94d04d6bf244f48c36cafe948
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tclIndex
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_tcl_data\tclIndex
          • Size 5KB
          • SHA256 ddf7e42def37888ad0a564aa4f8ca95f4eec942cebebfca851d35515104d5c89
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tm.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_tcl_data\tm.tcl
          • Size 11KB
          • SHA256 4b7ed9fd2363d6876092db3f720cbddf97e72b86b519403539ba96e1c815ed8f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          button.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_tk_data\button.tcl
          • Size 21KB
          • SHA256 1f5dd8d81b26f16e772e92fd2a22accb785004d0ed3447e54f87005d9c6a07a5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          icons.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_tk_data\icons.tcl
          • Size 10KB
          • SHA256 1264940e62b9a37967925418e9d0dc0befd369e8c181b9bab3d1607e3cc14b85
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pkgIndex.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_tk_data\pkgIndex.tcl
          • Size 376B
          • SHA256 3f2539e85e2a9017913e61fe2600b499315e1a6f249a4ff90e0b530a1eeb8898
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          tk.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_tk_data\tk.tcl
          • Size 23KB
          • SHA256 0f617d96cbf213296d7a5f7fcffbb4ae1149840d7d045211ef932e8dd66683e9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\_tkinter.pyd
          • Size 63KB
          • SHA256 4262cabac7e97220d0e4bd72deb337ffd9df429860ab298b3e2d5c9223874705
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\base_library.zip
          • Size 859KB
          • SHA256 b42475f5b3046506dc720dec51b7b859746e022b9de3f763e36cd18b24929db2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\libcrypto-1_1.dll
          • Size 3.3MB
          • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-7.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\libffi-7.dll
          • Size 32KB
          • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\libssl-1_1.dll
          • Size 686KB
          • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _psutil_windows.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\psutil\_psutil_windows.pyd
          • Size 65KB
          • SHA256 9c7fc855d9d1614e70705c7dcc6f4ac3cdcab5adfeb6a67d382f5ade09eadc15
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\pyexpat.pyd
          • Size 193KB
          • SHA256 56984d43be27422d31d8ece87d0abda2c0662ea2ff22af755e49e3462a5f8b65
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\python3.DLL
          • Size 63KB
          • SHA256 d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python310.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\python310.dll
          • Size 4.3MB
          • SHA256 156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\select.pyd
          • Size 28KB
          • SHA256 8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\tcl86t.dll
          • Size 1.8MB
          • SHA256 fbfd065f861ec0a90dd513bc209c56bbc23c54d2839964a0ec2df95848af7860
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msgcat-1.6.1.tm
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\tcl8\8.5\msgcat-1.6.1.tm
          • Size 34KB
          • SHA256 6774519f179872ec5292523f2788b77b2b839e15665037e097a0d4edddd1c6fb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\tk86t.dll
          • Size 1.5MB
          • SHA256 cd2f60075064dfc2e65c88b239a970cb4bd07cb3eec7cc26fb1bf978d4356b08
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI32002\unicodedata.pyd
          • Size 1.1MB
          • SHA256 4b6e3ba734c15ec789b5d7469a5097bd082bdfd8e55e636ded0d097cf6511e05
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download