Overview

overview

7

Static

static

3

2026-07-30...ar.exe

windows10-2004-x64

7

2026-07-30...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 06:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_99dffaa8ce2832317a92bd992255d2df_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 24.1MB
  • Sample260730-hmf8csem4y
  • SHA256 686fdacbe3679179d0539e62a7ee909f715907dbee68b5e8a0cb46101d014e00
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 31 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_99dffaa8ce2832317a92bd992255d2df_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_99dffaa8ce2832317a92bd992255d2df_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1436
    • C:\Users\Admin\AppData\Local\Temp\2026-07-30_99dffaa8ce2832317a92bd992255d2df_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-30_99dffaa8ce2832317a92bd992255d2df_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5928

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_asyncio.pyd
        • Size 72KB
        • SHA256 bac2870d61a72be50cabc968be924147132036185b3b538aa3b1b43d8c828a2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_bz2.pyd
        • Size 84KB
        • SHA256 178c6eeb30843e656cc407aaf53ae6d0f170966e4e0bdd2ee1bede73962275cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_ctypes.pyd
        • Size 124KB
        • SHA256 9ffdedd0f1f09f21870bd75c08d05c32994a1193be3955e367f260690a36cbd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_decimal.pyd
        • Size 251KB
        • SHA256 847e2b2c69ca623e0f96bbda0f421ca978fbb5925beec4cc5e4c5d9c966c4bbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_elementtree.pyd
        • Size 132KB
        • SHA256 9dead134ccd6c3c2e2bdbed8a02b5853200deb11aa2a22b926f9f2955d3f5143
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_hashlib.pyd
        • Size 65KB
        • SHA256 823717926adce6b36f9c13b6555eaeaf5714c4756828f11cffc1ce0bef970a7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_lzma.pyd
        • Size 156KB
        • SHA256 f6e0c786395ccc7b22f4c435b19f7073eb5974eb29e09f4c91060cab10450e6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_overlapped.pyd
        • Size 55KB
        • SHA256 0e6081da5bbf8fcd756b02153ab7fca12bd0bc04842abe5765f7409af4987b17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_queue.pyd
        • Size 32KB
        • SHA256 37622ca591fb8e45a894db9c0da99bfcb18a820a48f028e4949d9256b69247e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_socket.pyd
        • Size 83KB
        • SHA256 0e2c1089974a2757426dac3295201a33c990c36f3c09593f8a2b6e07fd36b99c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_ssl.pyd
        • Size 175KB
        • SHA256 81344e3e16cf6f2d5b24cc0cf92e95c5fd0592e4a3859bb00c3f5891e2482128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_tcl_data\encoding\cp1252.enc
        • Size 1KB
        • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        init.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_tcl_data\init.tcl
        • Size 25KB
        • SHA256 acacce15658dd7ce8f69b1e3d3a94770a22972a8e906eb3b61cd06f0ecd5db59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tclIndex
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_tcl_data\tclIndex
        • Size 7KB
        • SHA256 577f042bbe640e2739606a1f76098abdb8bd1d1f31526402fb82b21091644f65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_tkinter.pyd
        • Size 66KB
        • SHA256 96d318146ce3f329209799e4d547c28c0d4b5ab5040da19221ef815540b5f78e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_uuid.pyd
        • Size 27KB
        • SHA256 20557961ac93ae00829b0865018bcc565e41b52b103d2aa58405a0208ada148f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_wmi.pyd
        • Size 39KB
        • SHA256 af1077d6377d5a0aea123f0c324cc6d151ac4a29a84aae23a6936b6d1c64b70a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\base_library.zip
        • Size 1.3MB
        • SHA256 f8e98fe6dba42b8d47c0c162009f36791e6e4fee213f25f8f5d845900d6f9cd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _speedups.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\markupsafe\_speedups.cp312-win_amd64.pyd
        • Size 13KB
        • SHA256 b02f3c9828bb1c939085b492add30f65f742be2fd505f3b3c2456e43b57a4f73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\psutil\_psutil_windows.pyd
        • Size 67KB
        • SHA256 039e4d17d9b8399162ceb7a40177e66a7bac46fcd0f722813670af11eeae5c22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\pyexpat.pyd
        • Size 198KB
        • SHA256 fb0be386ab5bc1695e47e49220f52beee99239bbe85c1749694a8a696054865f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\python3.dll
        • Size 68KB
        • SHA256 7c3e2956271eff4949145d14635c0ca659db5ed19215201d2d8b3a4a3d3006f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\python312.dll
        • Size 6.6MB
        • SHA256 3b56fa10d3797c231468cee42caeaaaff40dbede7bc0d142ec4878493f48e07d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\select.pyd
        • Size 32KB
        • SHA256 fcac4646ff709ac07aee532c4612a19b7070f2dd6ef67ba09c743644e92f7376
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        INSTALLER
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER
        • Size 4B
        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
        • MD5 SHA1 SHA512
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\tcl86t.dll
        • Size 1.8MB
        • SHA256 808960f1810e03cfd153be3d9ee9bf01717904c8a23bdcf22d98ff766e33ab96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\tk86t.dll
        • Size 1.5MB
        • SHA256 aaa0f414484211caf42a0807a3afd70c53b172f59d05dfd9f1fc55244c26dc3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\unicodedata.pyd
        • Size 1.1MB
        • SHA256 e7fe7ae7342b1dec8dfe52a95d768039a46189209b9f42a21c4d2473faaa1753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\zlib1.dll
        • Size 144KB
        • SHA256 fc431c484e7d6f004d056ac215d6b7e3deb9c41a597065fc840b311e81adf1b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5928-1084-0x00007FF8C4210000-0x00007FF8C4239000-memory.dmp
        Download