Overview

overview

8

Static

static

3

2026-07-30...om.exe

windows10-2004-x64

8

2026-07-30...om.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    16s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 23:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_a4260b2945e53ca9c7600d2f0a5519ef_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
  • Size 36.2MB
  • Sample260730-3f66eshc44
  • SHA256 e1f1548c58b4d30e906748c27edabe942a1266d55b5e58788afdf146a6cd9fea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 51 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 33 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 19 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a4260b2945e53ca9c7600d2f0a5519ef_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a4260b2945e53ca9c7600d2f0a5519ef_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6116
    • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a4260b2945e53ca9c7600d2f0a5519ef_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-30_a4260b2945e53ca9c7600d2f0a5519ef_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      2⤵
      • Drops file in Drivers directory
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls||clear
        3⤵
        • Executes a command shell one-liner
        PID:5504
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3752
        • C:\Windows\system32\netsh.exe
          netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:3152
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:248
        • C:\Windows\system32\netsh.exe
          netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:3028
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ipconfig /flushdns"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1308
        • C:\Windows\system32\ipconfig.exe
          ipconfig /flushdns
          4⤵
          • Gathers network information
          PID:5976
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        PID:4312
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2388
        • C:\Windows\system32\netsh.exe
          netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:4732
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5052
        • C:\Windows\system32\netsh.exe
          netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          PID:5140
      • C:\Windows\SYSTEM32\certutil.exe
        certutil -delstore Root keyauth.win
        3⤵
          PID:1556
        • C:\Windows\SYSTEM32\certutil.exe
          certutil -addstore Root C:\Users\Admin\AppData\Local\Temp\tmp6vsr70nz.crt
          3⤵
            PID:3796
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "ipconfig /flushdns"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5740
            • C:\Windows\system32\ipconfig.exe
              ipconfig /flushdns
              4⤵
              • Gathers network information
              PID:1596
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5360
            • C:\Windows\system32\netsh.exe
              netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:5380
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1176
            • C:\Windows\system32\netsh.exe
              netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:1532
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh interface ipv4 add address "name=Loopback Pseudo-Interface 1" address=162.159.133.234 mask=255.255.255.255"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4972
            • C:\Windows\system32\netsh.exe
              netsh interface ipv4 add address "name=Loopback Pseudo-Interface 1" address=162.159.133.234 mask=255.255.255.255
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:1996
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh interface portproxy add v4tov4 listenaddress=162.159.133.234 listenport=443 connectaddress=127.0.0.1 connectport=443"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:904
            • C:\Windows\system32\netsh.exe
              netsh interface portproxy add v4tov4 listenaddress=162.159.133.234 listenport=443 connectaddress=127.0.0.1 connectport=443
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:700
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh interface portproxy show all"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2264
            • C:\Windows\system32\netsh.exe
              netsh interface portproxy show all
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:3760
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "sc stop WinDivert"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2380
            • C:\Windows\system32\sc.exe
              sc stop WinDivert
              4⤵
              • Launches sc.exe
              PID:4108
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "sc delete WinDivert"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2988
            • C:\Windows\system32\sc.exe
              sc delete WinDivert
              4⤵
              • Launches sc.exe
              PID:4352
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "sc create WinDivert type= kernel start= demand binPath= "C:\Windows\WinDivert64.sys" DisplayName= "WinDivert Network Driver""
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4588
            • C:\Windows\system32\sc.exe
              sc create WinDivert type= kernel start= demand binPath= "C:\Windows\WinDivert64.sys" DisplayName= "WinDivert Network Driver"
              4⤵
              • Launches sc.exe
              PID:2768
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "sc start WinDivert"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3724
            • C:\Windows\system32\sc.exe
              sc start WinDivert
              4⤵
              • Launches sc.exe
              PID:1628
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:6104
            • C:\Windows\system32\netsh.exe
              netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:3680
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2556
            • C:\Windows\system32\netsh.exe
              netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234
              4⤵
              • Event Triggered Execution: Netsh Helper DLL
              PID:3576
      • C:\Windows\WinDivert64.sys
        C:\Windows\WinDivert64.sys
        1⤵
        • Executes dropped EXE
        PID:4600

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\VCRUNTIME140.dll
            • Size 94KB
            • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _brotli.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\_brotli.pyd
            • Size 801KB
            • SHA256 791e7195d7df47a21466868f3d7386cff13f16c51fcd0350bf4028e96278dff1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\_bz2.pyd
            • Size 78KB
            • SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\_ctypes.pyd
            • Size 117KB
            • SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\_hashlib.pyd
            • Size 57KB
            • SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\_lzma.pyd
            • Size 149KB
            • SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\_queue.pyd
            • Size 26KB
            • SHA256 9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\_socket.pyd
            • Size 72KB
            • SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\_ssl.pyd
            • Size 152KB
            • SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ascii.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\chardet\pipeline\ascii.pyd
            • Size 10KB
            • SHA256 1f5f478184100659ac1e4b180e5d015804526e063f4d4e1b3737c5a2a18fe00d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ascii__mypyc.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\chardet\pipeline\ascii__mypyc.pyd
            • Size 32KB
            • SHA256 70ab0f5daf3a2ed5c8f7171df1d700c2534c70a5de8e9c6d8904f23db831c061
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            confusion__mypyc.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\chardet\pipeline\confusion__mypyc.pyd
            • Size 72KB
            • SHA256 57f6a61193a03cdd8d8af8ebfeb43b33f678eb57410673c538a406b92d794194
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            escape__mypyc.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\chardet\pipeline\escape__mypyc.pyd
            • Size 53KB
            • SHA256 a7525d02d144951b027b80765081272af3064c884a203563ae407299ad0ba3db
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            magic__mypyc.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\chardet\pipeline\magic__mypyc.pyd
            • Size 57KB
            • SHA256 ba30bc97e002674d91454f5a51c7742b9c0d1c9500063a716c6429a878ee5c6b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            orchestrator.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\chardet\pipeline\orchestrator.pyd
            • Size 10KB
            • SHA256 5227e0a6b9bc555971f3f0c4d5014b9abfefbe62a6e82d9e0b9d34d48d0e7c3e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            orchestrator__mypyc.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\chardet\pipeline\orchestrator__mypyc.pyd
            • Size 107KB
            • SHA256 f7c07fb34f30149c9af30429fcb62e984c4754c6b9152526e117ef310c744e3d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            statistical__mypyc.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\chardet\pipeline\statistical__mypyc.pyd
            • Size 42KB
            • SHA256 f10337124df615bda37abb48258214ad3d0a4dc8a3ecce8a71c75d360466ed35
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            structural__mypyc.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\chardet\pipeline\structural__mypyc.pyd
            • Size 76KB
            • SHA256 0a45748cc7785b6663342263e8100263914dcbbf645c5349bf26660f4ad19fc2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            utf1632__mypyc.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\chardet\pipeline\utf1632__mypyc.pyd
            • Size 56KB
            • SHA256 47420e0dc3e6074e2b3238ef09836b1aee95c501103257985119f1a159911f7f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            utf8__mypyc.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\chardet\pipeline\utf8__mypyc.pyd
            • Size 36KB
            • SHA256 b2dea84c835e43de9bd11c22cfd04e4141c2639b91f137b80d895e90bfba83c3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            validity__mypyc.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\chardet\pipeline\validity__mypyc.pyd
            • Size 31KB
            • SHA256 0f2e1427c2ff8d86f9bbdad39e9e5cd29107916dcd5e276050be05ea9217e3c3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\libcrypto-1_1.dll
            • Size 3.3MB
            • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-7.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\libffi-7.dll
            • Size 32KB
            • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\libssl-1_1.dll
            • Size 678KB
            • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _psutil_windows.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\psutil\_psutil_windows.pyd
            • Size 69KB
            • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            injector.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\pyinjector\injector.pyd
            • Size 20KB
            • SHA256 10575c0fe3fa9dabeddb0f65beb38e3d99081245de46c6770994ed28dbba397e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\python3.dll
            • Size 60KB
            • SHA256 8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python310.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\python310.dll
            • Size 4.2MB
            • SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\select.pyd
            • Size 25KB
            • SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_6116_349221_5YXsa9veZYk\unicodedata.pyd
            • Size 1.1MB
            • SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/4600-136-0x0000000000010000-0x000000000001E000-memory.dmp
            Download