Overview

overview

10

Static

static

3

2026-07-20...om.exe

windows10-2004-x64

10

2026-07-20...om.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 04:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_e6abd149d065688d28dbcd6c723b53ef_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
  • Size 28.4MB
  • Sample260720-elca8shs7w
  • SHA256 5e03aa7a660f59bfc3937d76b0e1361846fccdd5c4539ee1857b09f53898fefb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
blankgrabberstealer

Malware Config

Signatures

  • Family: blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber
  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Custom signature
    Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Custom signature
    Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Loads dropped DLL 26 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 6 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_e6abd149d065688d28dbcd6c723b53ef_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_e6abd149d065688d28dbcd6c723b53ef_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Users\Admin\AppData\Local\Temp\2026-07-20_e6abd149d065688d28dbcd6c723b53ef_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-20_e6abd149d065688d28dbcd6c723b53ef_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      PID:5808

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\_asyncio.pyd
        • Size 71KB
        • SHA256 4c6d6690e91974804c1eaf77827ea63882711689baff0718a246796ff40b2a23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\_bz2.pyd
        • Size 83KB
        • SHA256 55894b2b98d01f37b9a8cf4daf926d0161ff23c2fb31c56f9dbbac3a61932712
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\_ctypes.pyd
        • Size 129KB
        • SHA256 5c4c489ac052795c27af063c96bc4db5ab250144d4839050cfa9bb3836b87c32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\_hashlib.pyd
        • Size 63KB
        • SHA256 78223aef72777efc93c739f5308a3fc5de28b7d10e6975b8947552a62592772b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\_lzma.pyd
        • Size 155KB
        • SHA256 e44dea262a24df69fd9b50b08d09ae6f8b051137ce0834640c977091a6f9fca8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\_overlapped.pyd
        • Size 55KB
        • SHA256 c8a0e2c0d7f82cedb839d2c0b827cf139113faa4aba05f2345c80e2cf3335b8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\_queue.pyd
        • Size 34KB
        • SHA256 73cade82ee139459fe5841e5631274fc9caf7f579418b613f278125435653539
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\_socket.pyd
        • Size 82KB
        • SHA256 62d0493ced6ca33e2fd8141649dd9889c23b2e9afc5fdf56edb4f888c88fb823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\_sqlite3.pyd
        • Size 126KB
        • SHA256 c2161b71db9ce8c518d65e8a36c9ec67cd6d039ff732203b8adbe2c7ea883f6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\_ssl.pyd
        • Size 178KB
        • SHA256 e94f0195363c5c9babfc4c17ec6fb1aa8bbabf59e377db66ce6a79c4c58bbd07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\_uuid.pyd
        • Size 27KB
        • SHA256 cde836ef0bde1c15c1c3750de54b50d2285864c512abbfc9e2c94f0ff5aa5ca2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\_wmi.pyd
        • Size 39KB
        • SHA256 afad80f9e62a57814779cf3e48352b583c1a0697b11a23cc9db3f4e43f7f8664
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ada92cb5d92a588d1b93__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\ada92cb5d92a588d1b93__mypyc.pyd
        • Size 221KB
        • SHA256 0213d5350fabcd96e30fd5f64111d6fef1daeb308568c69716b6650dadf9ce9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\charset_normalizer\cd.pyd
        • Size 10KB
        • SHA256 6ede47b9f5dcda16a05a9692019847ad8b7d4d46768e92e96b1f676eba7aba51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        checker.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\checker.dll
        • Size 42.6MB
        • SHA256 b90d268d213566f17a0031b969f42cfe65ed2e4445b85cb7125330396099350a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementpath.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\lxml\_elementpath.pyd
        • Size 141KB
        • SHA256 6fe3eba4285106fd31f8988d1530135356f682645da87f8e7ac1052a5e96142e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        etree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\lxml\etree.pyd
        • Size 3.8MB
        • SHA256 39a86c59fd6b509975c4a85fb57eb68c86d4d7fa2a5d2152c152158121f01b62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\python313.dll
        • Size 5.8MB
        • SHA256 78b1dd211c0e66a0603df48da2c9b67a915ab3258701b9285d3faa255ed8dc25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\select.pyd
        • Size 31KB
        • SHA256 81f124b01a85882e362a42e94a13c0eff2f4ccd72d461821dc5457a789554413
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\sqlite3.dll
        • Size 1.5MB
        • SHA256 afb50a080d3c79d9c89d134b006fb2b0779b5ffeeb703762d163141b15eb03bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3020_181907_aktU4ivrqx0\unicodedata.pyd
        • Size 695KB
        • SHA256 3f462ee6e7743a87e5791181936539642e3761c55de3de980a125f91fe21f123
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download