Overview

overview

10

Static

static

10

2026-07-20...om.exe

windows10-2004-x64

2026-07-20...om.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    53s
  • max time network
    65s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 14:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    2026-07-20_0bab60471a07571d47f1915a4b420198_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 109.7MB
  • Sample260720-r7fa8sdy2m
  • SHA256 ee2cab7fb6026f3960efd865b4486e029b4196e6d27c7dfea0f8604d7cafc3ea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionspywarestealer

Malware Config

Signatures

  • Disables Task Manager via registry modification
    defense_evasion
  • Loads dropped DLL 62 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_0bab60471a07571d47f1915a4b420198_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_0bab60471a07571d47f1915a4b420198_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:824
    • C:\Users\Admin\AppData\Local\Temp\2026-07-20_0bab60471a07571d47f1915a4b420198_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-20_0bab60471a07571d47f1915a4b420198_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1128
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1496
        • C:\Windows\system32\reg.exe
          reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
          4⤵
            PID:2332
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c shutdown /s /t 15
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5648
          • C:\Windows\system32\shutdown.exe
            shutdown /s /t 15
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4488
    • C:\Windows\System32\PickerHost.exe
      C:\Windows\System32\PickerHost.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:860
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa3a2a055 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:4952
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:6020
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k CameraMonitor
        1⤵
          PID:2120

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              MSVCP140.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\PyQt5\Qt5\bin\MSVCP140.dll
              • Size 576KB
              • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSVCP140_1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\PyQt5\Qt5\bin\MSVCP140_1.dll
              • Size 30KB
              • SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Qt5Core.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\PyQt5\Qt5\bin\Qt5Core.dll
              • Size 5.7MB
              • SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCRUNTIME140_1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\PyQt5\Qt5\bin\VCRUNTIME140_1.dll
              • Size 43KB
              • SHA256 1f0f5f2ce671e0f68cf96176721df0e5e6f527c8ca9cfa98aa875b5a3816d460
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QtCore.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\PyQt5\QtCore.pyd
              • Size 2.4MB
              • SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              sip.cp313-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\PyQt5\sip.cp313-win_amd64.pyd
              • Size 117KB
              • SHA256 7a54c971af695af612a1cda68924a2170d4a2afe48dd32770b60fde5b2dd7dab
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCRUNTIME140.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\VCRUNTIME140.dll
              • Size 117KB
              • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _asyncio.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_asyncio.pyd
              • Size 69KB
              • SHA256 dbeae7cb6f256998f9d8de79d08c74d716d819eb4473b2725dbe2d53ba88000a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _bz2.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_bz2.pyd
              • Size 82KB
              • SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ctypes.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_ctypes.pyd
              • Size 128KB
              • SHA256 f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _hashlib.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_hashlib.pyd
              • Size 62KB
              • SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _lzma.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_lzma.pyd
              • Size 154KB
              • SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _overlapped.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_overlapped.pyd
              • Size 54KB
              • SHA256 404353d7b867749fa2893033bd1ebf2e3f75322d4015725d697cfa5e80ec9d0f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _queue.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_queue.pyd
              • Size 32KB
              • SHA256 b9cf502dadcb124f693bf69ecd7077971e37174104dbda563022d74961a67e1e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _socket.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_socket.pyd
              • Size 81KB
              • SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ssl.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_ssl.pyd
              • Size 177KB
              • SHA256 63ae2fefbfbbbc6ea39cde0a622579d46ff55134bc8c1380289a2976b61f603e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _wmi.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\_wmi.pyd
              • Size 37KB
              • SHA256 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd
              • Size 221KB
              • SHA256 58c25c988641247cc153a987d1080dceb65c3a5cea68be96f0ac5b29c700ab05
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              base_library.zip
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\base_library.zip
              • Size 1.3MB
              • SHA256 17423bd1901664f67d9f0e77cf33a7b72f30d3381e8aca9c2e6407e778fc0e2b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cd.cp313-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\charset_normalizer\cd.cp313-win_amd64.pyd
              • Size 10KB
              • SHA256 77e1c9c2679ea4855d5b97dba2666c6b4cfe32636945f5bb8399ff2c7ef1b050
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libcrypto-3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\libcrypto-3.dll
              • Size 5.0MB
              • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libffi-8.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\libffi-8.dll
              • Size 38KB
              • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libssl-3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\libssl-3.dll
              • Size 774KB
              • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _multidict.cp313-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\multidict\_multidict.cp313-win_amd64.pyd
              • Size 78KB
              • SHA256 d20eb8153da9ecfd280788f8c6dcfb3e3703c847df22d70d72568c380b63a1d6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              python3.DLL
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\python3.DLL
              • Size 68KB
              • SHA256 a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              python313.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\python313.dll
              • Size 5.8MB
              • SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pywintypes313.dll
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\pywin32_system32\pywintypes313.dll
              • Size 133KB
              • SHA256 ea82e185e0bed58485a8df23712b62224f5e486dbb84d946115cad17512065cb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              select.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\select.pyd
              • Size 30KB
              • SHA256 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Lorem ipsum.txt
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
              • Size 1KB
              • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              unicodedata.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\unicodedata.pyd
              • Size 693KB
              • SHA256 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              win32api.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\win32\win32api.pyd
              • Size 135KB
              • SHA256 040d6a9ce12555d2585f89dce2aa4e25265c27dfa827eb9cae4c922e12ec731c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _quoting_c.cp313-win_amd64.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\_MEI8242\yarl\_quoting_c.cp313-win_amd64.pyd
              • Size 81KB
              • SHA256 40e5131ebda53a875049518b994ceb263ba187ccbc8e80c9d7f764e687b491e0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/1128-1229-0x00007FFCB1270000-0x00007FFCB14D3000-memory.dmp
              Download

              memory/1128-1270-0x00007FFCA7BA0000-0x00007FFCAAEDD000-memory.dmp
              Download

              memory/1128-1272-0x000001DB91450000-0x000001DB91610000-memory.dmp
              Download

              memory/1128-1274-0x000001DB91450000-0x000001DB91610000-memory.dmp
              Download