Overview

overview

7

Static

static

3

2026-07-27...om.exe

windows10-2004-x64

7

2026-07-27...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 08:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_9e28d1b7077736f866cc42e1704d07f9_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
  • Size 41.2MB
  • Sample260727-j22chsaa57
  • SHA256 8fa8983c6651b9f5d1f7daa271eadd3e9e871c1d78239f8157015e3a892917e3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 36 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_9e28d1b7077736f866cc42e1704d07f9_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_9e28d1b7077736f866cc42e1704d07f9_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Users\Admin\AppData\Local\Temp\2026-07-27_9e28d1b7077736f866cc42e1704d07f9_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-27_9e28d1b7077736f866cc42e1704d07f9_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1572

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        qminimal.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\PyQt6\Qt6\plugins\platforms\qminimal.dll
        • Size 61KB
        • SHA256 9d10186aa74cdb50e499b69a6a78e0a0b0398615fb1f0a4769b909539bf4fab4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qoffscreen.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\PyQt6\Qt6\plugins\platforms\qoffscreen.dll
        • Size 112KB
        • SHA256 41781308ce8cee4cd05a4ed8958761fe48dc2c5159bd114c942b953bc91f2c1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\PyQt6\QtCore.pyd
        • Size 2.5MB
        • SHA256 9306ceffdc3b663f90fc446800be4ab870887c0bf3c38dc16b00e070e519d895
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\PyQt6\QtGui.pyd
        • Size 2.2MB
        • SHA256 78f1acd16154a241101ead83c845388394526b9e4ddc7bdc914d22d96710f7bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\PyQt6\QtWidgets.pyd
        • Size 4.9MB
        • SHA256 a5e78921d92d4b4975edbd441369ef7ab689e336d1b40d8555728880f0503fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\PyQt6\sip.pyd
        • Size 109KB
        • SHA256 59f93c8dca30b5c8600f98988c6eff678cc38323df367aaceef408f3859c0b0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\Qt6Core.dll
        • Size 9.6MB
        • SHA256 9fbea00b87ceae5f9e319c23010eacb903ed460c661b9b1b17bcabd02bf1eec2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 63c31e9f79faee8e6ac3919f13be59d293c4fa5f091d200cb683c9f1ea4e6ae7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\Qt6Widgets.dll
        • Size 6.3MB
        • SHA256 6c139cf501fd4a4cf2b690520df79dd02687df061d51eb6b3c91757d503ef909
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\_bz2.pyd
        • Size 85KB
        • SHA256 f0643f805a011efc704df472bb431ba231e6ae31fb7ba71328df1b6f1a9e1aa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\_hashlib.pyd
        • Size 67KB
        • SHA256 052f824d5e3a046aa401efef86307c0c7746a0d8ff85c855d4225d6fe565bb07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\_lzma.pyd
        • Size 157KB
        • SHA256 3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\_queue.pyd
        • Size 35KB
        • SHA256 4fd91087253a1507a5e5068eb366e77826efc27a568707ed4796d638df1fcf1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\_socket.pyd
        • Size 85KB
        • SHA256 6a016011e78e2476eb19dbe7330b373b9e2c66ff6c0be9bd64ff008ee53647ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\_ssl.pyd
        • Size 179KB
        • SHA256 1edd9575243ae8322f6a21e9eecc933701c5820f05e7b0ebc0b51cb80592da77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\_zstd.pyd
        • Size 491KB
        • SHA256 74f64a5d724cad1c10ca9ba579b6af198178406b0a4f061685326e79cffa3eea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\charset_normalizer\md.pyd
        • Size 10KB
        • SHA256 394271ca355a08eff4e268efef85f3f817bcc7d8661ac655cb47f24132e7eedf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\charset_normalizer\md__mypyc.pyd
        • Size 120KB
        • SHA256 7d28dad4be5242b16e17e75d94bb1117451754f95c8749aae554caa6973d1c6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\libssl-3.dll
        • Size 776KB
        • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\msvcp140.dll
        • Size 540KB
        • SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\msvcp140_1.dll
        • Size 34KB
        • SHA256 2dd670f874562fbdca5b022df1943d70a57ba91fde559280e3a1daebe4db2380
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\msvcp140_2.dll
        • Size 272KB
        • SHA256 1d60da3ac2b06482912ca852fa7047436e6e474b4cfffa3bf77f4598cfbf454c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        premium.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\premium.dll
        • Size 17.9MB
        • SHA256 3428b8d7f034344812fbd18fba6232131d2e9cb77261b36057e3f79d011555f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\python3.dll
        • Size 72KB
        • SHA256 27972cedfa8ca9f6835a2cbbff95336b15773a05b10067e3b084409095341068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\python314.dll
        • Size 6.4MB
        • SHA256 f1722bd369d79fecbc85f3ed2790c30c330b9413fd74332f95b086e60dfacc2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\select.pyd
        • Size 32KB
        • SHA256 5c4103eef14aebd195425d42196895ffb87bf6a25ab4651242bebf0a6b25cf1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\unicodedata.pyd
        • Size 740KB
        • SHA256 552317719cb70d92b73d9cd0d54c314ebab2f4dd1c468221e49c3190f24a4e7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2156_378419_KfYaABxtRCY\vcruntime140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1572-183-0x00007FFEB8450000-0x00007FFEB8A96000-memory.dmp
        Download

        memory/1572-186-0x00007FFEB8AA0000-0x00007FFEB8F80000-memory.dmp
        Download

        memory/1572-192-0x00000194FEBE0000-0x00000194FEE6D000-memory.dmp
        Download

        memory/1572-197-0x00000194FEBE0000-0x00000194FEE6D000-memory.dmp
        Download