Overview

overview

9

Static

static

3

2026-07-17...om.exe

windows10-2004-x64

9

2026-07-17...om.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    151s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 01:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-17_f5eda3691eb498d0fdda420de3a92173_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
  • Size 45.6MB
  • Sample260718-bt1f9aby2m
  • SHA256 e21ade09ea48d84620405b7bd964cd825db04dfe6c1bc8a57c6d588fc4c74627
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
execution

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Loads dropped DLL 46 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_f5eda3691eb498d0fdda420de3a92173_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-17_f5eda3691eb498d0fdda420de3a92173_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4372
    • C:\Users\Admin\AppData\Local\Temp\2026-07-17_f5eda3691eb498d0fdda420de3a92173_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-17_f5eda3691eb498d0fdda420de3a92173_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:4948
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue'; $target='C:\\Users\\Admin\\AppData\\Local\\Temp'; $pPid=4948; $currentPid=$PID; function Global-Nuke { try { $procs=Get-Process | Where-Object { $_.Path -like \"$target*\" -and $_.Id -ne $PID }; $handleProcs=@(); try { $allProcs=Get-Process; foreach($p in $allProcs){ if($p.Id -ne $PID){ try { $handles=Get-WmiObject Win32_ProcessHandle -Filter \"ProcessId=$($p.Id)\" 2>$null; foreach($h in $handles){ if($h.Handle -and $h.Handle.Name -like \"$target*\"){ $handleProcs +=$p; break; } } } catch { } } } } catch { } $allProcsToKill=$procs + $handleProcs | Select-Object -Unique; foreach($p in $allProcsToKill){ try { Stop-Process -Id $p.Id -Force -ErrorAction Stop; } catch { try { taskkill /F /T /PID $p.Id /NoWindow 2>$null; } catch { } } } } catch { } }; $monitorCount=0; while($true){ Start-Sleep -Milliseconds 500; $monitorCount++; try { $parent=Get-Process -Id $pPid -ErrorAction Stop; } catch { Global-Nuke; break; } }; Stop-Process -Id $currentPid -Force"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4320

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\PySide6\QtCore.pyd
        • Size 3.2MB
        • SHA256 be52341a5df1f76ecca2fb1e94eb429dfa46f0b659ed6536f25119b565b21ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\PySide6\QtGui.pyd
        • Size 3.7MB
        • SHA256 f0549716b10a8b4fbd5c6c041f36af215223809f919f4c4722d44cc199d5c593
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\PySide6\QtWidgets.pyd
        • Size 4.6MB
        • SHA256 85cb6c2181b4b09887a7d8507dd950844d1b8f74a9c4002c7b71169f75bf6fda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\Qt6Core.dll
        • Size 10.0MB
        • SHA256 65fe6224b6c47a15b058738031d31dce9928c4d7a58e1b8db6434f6f5cddd702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 cd071161ad325ff2de92b0e33d71334ef20712544796949623ce92dfb3957e90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\Qt6Widgets.dll
        • Size 6.3MB
        • SHA256 5a9f37dedd3dc5bcc1a4bb8ea919c49fc62df751a1450accc34379eb6710eab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\_bz2.pyd
        • Size 84KB
        • SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\_ctypes.pyd
        • Size 124KB
        • SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\_lzma.pyd
        • Size 157KB
        • SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\_queue.pyd
        • Size 32KB
        • SHA256 48e76e0ad63f6932b4a77b5819f41c1e7595636ca8d9e824f0943a14b8bb5035
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\_socket.pyd
        • Size 83KB
        • SHA256 3efa4636cf9e350856f6927d67a4c2564bf9bd2758a00bbf17d3aece5b60016d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\_uuid.pyd
        • Size 26KB
        • SHA256 acce4f281d7ffb2dec0997527faf25b1df62ad7bd3032c568ddcf65c90edc867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\_wmi.pyd
        • Size 39KB
        • SHA256 a980f1e7a29842bd946863fc2693fbeb555a9dc0f9e1630dfed9a2fcdef3ece2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        main.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\main.dll
        • Size 28.9MB
        • SHA256 817412a2717c1f66ad6f43ed08729feb72207d6783dfd0feec71fa8e0aadfd5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\msvcp140.dll
        • Size 628KB
        • SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orjson.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\orjson\orjson.pyd
        • Size 218KB
        • SHA256 0c40fb1b55914918543780266e63ae8024a9e3de9c06b6d7df1e330370bc2cb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        palooz.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\palooz.pyd
        • Size 246KB
        • SHA256 e48beee161b24bb952fb00fd6cdfd82df0d976698cca448b2d0689d0ecea0394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyside6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\pyside6.abi3.dll
        • Size 242KB
        • SHA256 d4072be872b31f3748de5e6c28cb2976dafbf063d3ccfa38e5dabda29babcdaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\python3.dll
        • Size 68KB
        • SHA256 fb975a606e7fbf74f64260e3f60c3490b4f74a183c0926fd6ed1ac4c52ac7b1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\python312.dll
        • Size 6.6MB
        • SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        T_Male_Trader01_v06_icon_normal.webp
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\resources\game_data\icons\pals\T_Male_Trader01_v06_icon_normal.webp
        • Size 1KB
        • SHA256 87891eaa078eb0b0bd4dbace894c0e2d6af60e1d631f22152a38cf33b1fc7624
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        T_Male_Trader01_v07_icon_normal.webp
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\resources\game_data\icons\pals\T_Male_Trader01_v07_icon_normal.webp
        • Size 2KB
        • SHA256 344fd29cbc6dea21df2e8b318498be8e6e55974ee0280d9f413276152dfd38dd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        T_Male_Trader01_v08_icon_normal.webp
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\resources\game_data\icons\pals\T_Male_Trader01_v08_icon_normal.webp
        • Size 2KB
        • SHA256 2facf81f64a914e6fde4eeb8ed542755632bfc517ccaf3c907a7177bae203c04
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        T_Male_Trader01_v11_icon_normal.webp
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\resources\game_data\icons\pals\T_Male_Trader01_v11_icon_normal.webp
        • Size 1KB
        • SHA256 ba7f8613a2a745f75cffd84d5bcca7f70839a9bfbc52cae7c2458426a5bb0d6a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        T_Male_Trader01_v18_icon_normal.webp
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\resources\game_data\icons\pals\T_Male_Trader01_v18_icon_normal.webp
        • Size 2KB
        • SHA256 b7aab0d30255d36c8cc24b8ba9d2bb9ae1036dbf428b40a158d1d31acaea7ce1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        T_itemicon_Weapon_SphereLauncher.webp
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\resources\game_data\icons\technologies\T_itemicon_Weapon_SphereLauncher.webp
        • Size 7KB
        • SHA256 9bc6a97dca038b707208673eb8a5685a1746690e9906657da7040dc691b5c422
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\select.pyd
        • Size 32KB
        • SHA256 d4d7181b11db0bd22a6cd5cda6f8583d1f5c77615fd0a6ca33350619d6e0438a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shiboken6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\shiboken6.abi3.dll
        • Size 375KB
        • SHA256 47f4f9b44c95037565dd14f4be04f350f20c53c05483b750e0be867c39a7441e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\shiboken6\MSVCP140_1.dll
        • Size 26KB
        • SHA256 d878d7cb27187247a3ce1adfdf1f9b7b703e4429bc55f3e95284a43e80c10151
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Shiboken.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\shiboken6\Shiboken.pyd
        • Size 32KB
        • SHA256 0e2c5318c5ac60a016a12230bbb1f6a9d990c45cbf4a7c4af24aefb5ab7dc40a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\shiboken6\msvcp140_2.dll
        • Size 265KB
        • SHA256 c0ab58670a2cebaad8e7ef1f57d8f684a43bdf1c39d20a032088425905802655
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_inventory_loadouts.json
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\src\data\configs\base_inventory_loadouts.json
        • Size 5KB
        • SHA256 b90377644fa3452f285edc0819fa4cf17345a95b0b4244db495f96561043834a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        equipment_loadouts.json
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\src\data\configs\equipment_loadouts.json
        • Size 2KB
        • SHA256 6126b2c8df2b57a0ee6a16884474e011586532b77e8162dcc3be97cf06527331
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        inventory_loadouts.json
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\src\data\configs\inventory_loadouts.json
        • Size 2KB
        • SHA256 e779a1e7c46d031e8773ee6b344bdb22f82176fa1606cc82e0c7b833ae80c3a1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        passive_loadouts.json
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\src\data\configs\passive_loadouts.json
        • Size 1KB
        • SHA256 071df5b1bea8838858ef859eccffd3995d496db7a682f379ce6a1eb461be85e7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.cfg
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\src\data\configs\user.cfg
        • Size 265B
        • SHA256 ccaad2787c832675e1c322b88469330a3b854cb7c7c01ff4de22621771f5792f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4372_346135_Y4VpP4iVuAU\vcruntime140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4320-2898-0x00000215FF6F0000-0x00000215FF712000-memory.dmp
        Download

        memory/4948-2886-0x00007FF840A40000-0x00007FF840DFB000-memory.dmp
        Download

        memory/4948-2879-0x00007FF841740000-0x00007FF841D8D000-memory.dmp
        Download

        memory/4948-2872-0x00007FF842C60000-0x00007FF842F93000-memory.dmp
        Download

        memory/4948-2883-0x00007FF841D90000-0x00007FF842249000-memory.dmp
        Download