Overview

overview

7

Static

static

3

2026-07-30...om.exe

windows10-2004-x64

7

2026-07-30...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 17:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_323e0184358d18ece5393a08a23bdad9_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
  • Size 14.6MB
  • Sample260730-wjszmstgrd
  • SHA256 31bea5e9f7584f3353c28ed2fe1dd5795933829bddd7fdd503e67b19f0ceb33c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 31 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_323e0184358d18ece5393a08a23bdad9_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_323e0184358d18ece5393a08a23bdad9_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Users\Admin\AppData\Local\Temp\2026-07-30_323e0184358d18ece5393a08a23bdad9_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-30_323e0184358d18ece5393a08a23bdad9_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1892
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c
        3⤵
        • Executes a command shell one-liner
        PID:6096
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls & mode 43,20
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2312
        • C:\Windows\system32\mode.com
          mode 43,20
          4⤵
            PID:4492
    • C:\Windows\system32\ctfmon.exe
      /QuitInfo:0000000000000274;0000000000000278;
      1⤵
        PID:1264
      • C:\Windows\system32\ctfmon.exe
        /QuitInfo:0000000000000274;0000000000000278;
        1⤵
        • Checks SCSI registry key(s)
        PID:1756

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            81d243bd2c585b0f4821__mypyc.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\81d243bd2c585b0f4821__mypyc.pyd
            • Size 211KB
            • SHA256 5b80e8963c54771f2d923eb0469a7a293cabf172bdcff8ef2f28804948c4ec8c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\VCRUNTIME140.dll
            • Size 94KB
            • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _brotli.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\_brotli.pyd
            • Size 801KB
            • SHA256 791e7195d7df47a21466868f3d7386cff13f16c51fcd0350bf4028e96278dff1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\_bz2.pyd
            • Size 78KB
            • SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _cffi_backend.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\_cffi_backend.pyd
            • Size 175KB
            • SHA256 c379126647af2cbfb592d6a921f6218da59b886e2a56e9b82f8159aced6f1100
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\_ctypes.pyd
            • Size 117KB
            • SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\_hashlib.pyd
            • Size 57KB
            • SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\_lzma.pyd
            • Size 149KB
            • SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\_queue.pyd
            • Size 26KB
            • SHA256 9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\_socket.pyd
            • Size 72KB
            • SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\_ssl.pyd
            • Size 152KB
            • SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _win32sysloader.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\_win32sysloader.pyd
            • Size 14KB
            • SHA256 7832c2fbd64aafe3255e482155331a1a90f0312973ffa4abc875f20b28c95c01
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cacert.pem
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\certifi\cacert.pem
            • Size 233KB
            • SHA256 16be3f6feb15408195dcfe3aa1a75ef9db72f646b96ebbefdc68f56255f799f8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cd.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\charset_normalizer\cd.pyd
            • Size 10KB
            • SHA256 54ed1a662d7b02ac19d8227badf17a2d6924395474c1cce5a2314eacf4f544a0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\libcrypto-1_1.dll
            • Size 3.3MB
            • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-7.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\libffi-7.dll
            • Size 32KB
            • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-1_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\libssl-1_1.dll
            • Size 678KB
            • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            main.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\main.dll
            • Size 29.5MB
            • SHA256 b0a9923ea6a6f9f2c0fd028c2a943bac214f0d6c21b2e119ca709df15a21df13
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _sodium.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\nacl\_sodium.pyd
            • Size 396KB
            • SHA256 57822e7aed944269943bcb855fc14560a5b6ae38869de4e3d00c380a5119ecc7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _psutil_windows.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\psutil\_psutil_windows.pyd
            • Size 69KB
            • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            injector.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\pyinjector\injector.pyd
            • Size 20KB
            • SHA256 10575c0fe3fa9dabeddb0f65beb38e3d99081245de46c6770994ed28dbba397e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\python3.dll
            • Size 60KB
            • SHA256 8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python310.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\python310.dll
            • Size 4.2MB
            • SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pywintypes310.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\pywintypes310.dll
            • Size 132KB
            • SHA256 7a7e9bce1b56932dcc1d27edd05adbaeab82a201a15e0f24d2d32fbd99c1b682
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\select.pyd
            • Size 25KB
            • SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\unicodedata.pyd
            • Size 1.1MB
            • SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vcruntime140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\vcruntime140_1.dll
            • Size 36KB
            • SHA256 04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            win32api.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\win32api.pyd
            • Size 131KB
            • SHA256 d2c0726bbc6707aec4e86743496b719cb8c6654dd77f6670290ef1beebb2a02e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            win32security.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\win32security.pyd
            • Size 132KB
            • SHA256 b0cebc35da5125433df59337b82be652a722cfb3dd8c8525f9f250770ecbbbf0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            win32service.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_4648_958657_HzUyVHB6zog\win32service.pyd
            • Size 58KB
            • SHA256 c918f8939479b0414ccd050428c70dd4bea10eb25f19282df945b9e54772f8b8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download