Overview

overview

7

Static

static

3

2026-07-27...om.exe

windows10-2004-x64

7

2026-07-27...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 08:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_0bb9abaa47bc64f8ccccb39454591106_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 75.8MB
  • Sample260727-kpxz1azamd
  • SHA256 badebec117e3ceb3fef3e4edf5d7a5daea967e8199fda68cff8de6af371bdfc4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
credential_accessdiscoveryexecutionspywarestealer

Malware Config

Signatures

  • Loads dropped DLL 53 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_0bb9abaa47bc64f8ccccb39454591106_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_0bb9abaa47bc64f8ccccb39454591106_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4428
    • C:\Users\Admin\AppData\Local\Temp\2026-07-27_0bb9abaa47bc64f8ccccb39454591106_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-27_0bb9abaa47bc64f8ccccb39454591106_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1720
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:1556
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:464

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _raw_aes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\Cryptodome\Cipher\_raw_aes.pyd
        • Size 34KB
        • SHA256 889f9b558a47a4333bfd3e3814eaec2328ac8648722d912c7873fdea62fcf886
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_aesni.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\Cryptodome\Cipher\_raw_aesni.pyd
        • Size 15KB
        • SHA256 6c9a2bed5c1bd9acd8bcea7f5f20f7fa63e4465b0914ae70250bd59a8028333c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cpuid_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\Cryptodome\Util\_cpuid_c.pyd
        • Size 10KB
        • SHA256 e7e6f27d5203768e6454b4066847a3af02548c811146da047c4a53b1edaf32e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imaging.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\PIL\_imaging.cp311-win_amd64.pyd
        • Size 2.5MB
        • SHA256 16452bdc0cd84bbc8e034319e67f776ddc9d23767e6c589d89a5c973738d5fb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\VCRUNTIME140.dll
        • Size 106KB
        • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_asyncio.pyd
        • Size 63KB
        • SHA256 2b772076c2dba91fb4f61182b929485cc6c660baab4bce6e08aa18e414c69641
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_bz2.pyd
        • Size 82KB
        • SHA256 ebcac51449f323ae3ae961a33843029c34b6a82138ccd9214cf99f98dd2148c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_cffi_backend.cp311-win_amd64.pyd
        • Size 175KB
        • SHA256 9dcbe427f86795a5dfc19d74e9b5f3d0994ff0221b1a111877ed11eccd42e026
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_ctypes.pyd
        • Size 120KB
        • SHA256 b1214d7b7efd9d4b0f465ec3463512a1cbc5f59686267030f072e6ce4b2a95cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_decimal.pyd
        • Size 247KB
        • SHA256 c70f05f6bc564fe400527b30c29461e9642fb973f66eec719d282d3d0b402f93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_elementtree.pyd
        • Size 125KB
        • SHA256 c2dcbeafd39f8134dcb15a51f825035f71b6e956cd13a2745c00626253148b5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_hashlib.pyd
        • Size 63KB
        • SHA256 241322647ba9f94bdc3ae387413ffb57ae14c8cf88bd564a31fe193c6ca43e37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_lzma.pyd
        • Size 155KB
        • SHA256 f74aaf0aa08cf90eb1eb23a474ccb7cb706b1ede7f911daf7ae68480765bdf11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_multiprocessing.pyd
        • Size 33KB
        • SHA256 b49fe3b3efd833aaad131ce25706126b569d1a1f2eba4d470ec98ffdfa722767
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_overlapped.pyd
        • Size 49KB
        • SHA256 24f9971debbd864e3ba615a89d2c5b0e818f9ab2be4081499bc877761992c814
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_queue.pyd
        • Size 31KB
        • SHA256 ac177cd84c12e03e3a68bca30290bc0b8f173eee518ef1fa6a9dce3a3e755a93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_socket.pyd
        • Size 77KB
        • SHA256 eaabf6b78840daeaf96b5bdbf06adf0e4e2994dfeee5c5e27fefd824dbda5220
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_sqlite3.pyd
        • Size 117KB
        • SHA256 1d4e17237a10b68d16634fc9698edf342b40478d92fa15d574d212c7a44b05bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\_ssl.pyd
        • Size 157KB
        • SHA256 680ad2de8a6cff927822c1d7dd22112a3e8a824e82a7958ee409a7b9ce45ec70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ada92cb5d92a588d1b93__mypyc.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\ada92cb5d92a588d1b93__mypyc.cp311-win_amd64.pyd
        • Size 216KB
        • SHA256 fc17eb621ecf2325e3c2d7501d3ee2c3848e3c7fec7027fda7c7fa1782874743
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\base_library.zip
        • Size 1.4MB
        • SHA256 46664f8a8d63da221bdf07ed6c18eafd6d7eb4bc2d474fca658bf8b0a8e6511f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _rust.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\cryptography\hazmat\bindings\_rust.pyd
        • Size 9.4MB
        • SHA256 813b101f70efb79c388239ce82ac891e195a1e19eeaeb43c32d9bf425e7b51b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\libssl-1_1.dll
        • Size 688KB
        • SHA256 d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\pyexpat.pyd
        • Size 194KB
        • SHA256 c1ed7017ce55119df27563d470e7dc3fb29234a7f3cd5fc82d317b6fe559300b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\python3.DLL
        • Size 65KB
        • SHA256 95086ac060ffe6933ac04a6aa289b1c7d321f14380315e24ba0d6c4adfa0842b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\python311.dll
        • Size 5.5MB
        • SHA256 c4844b05e3a936b130adedb854d3c04d49ee54edb43e9d36f8c4ae94ccb78400
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pythoncom311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\pywin32_system32\pythoncom311.dll
        • Size 665KB
        • SHA256 f20794876cd77d37d893512bdd8f2112bb791e134ebf2697c9034fa32eb93c11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\pywin32_system32\pywintypes311.dll
        • Size 132KB
        • SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\select.pyd
        • Size 29KB
        • SHA256 13e4d9a734a453a3613e11b6a518430099ad7e3d874ea407d1f9625b7f60268a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\sqlite3.dll
        • Size 1.4MB
        • SHA256 919572560c314e46b1dba56418bbb50e1620c0af328aec394eaff580c58f2fc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\unicodedata.pyd
        • Size 1.1MB
        • SHA256 e36d14cf49ca2af44fae8f278e883341167bc380099dac803276a11e57c9cfa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\win32\win32api.pyd
        • Size 135KB
        • SHA256 cd9ec02d502dc1548233aa2efe9fcbf47e4677b28c169553f36194a50f55ff28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32crypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI44282\win32\win32crypt.pyd
        • Size 122KB
        • SHA256 57b37eae88743fe71226365880f8870b2082a8df9775c28019f58c25f75a05c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1720-235-0x00007FF97C360000-0x00007FF97F69D000-memory.dmp
        Download

        memory/1720-239-0x00007FF97C360000-0x00007FF97F69D000-memory.dmp
        Download