Overview

overview

9

Static

static

3

2026-08-01...om.exe

windows10-2004-x64

9

2026-08-01...om.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 00:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_3e841dc08ad3035ed34566981270044f_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
  • Size 12.2MB
  • Sample260802-baafqaar3s
  • SHA256 da5e83d00e25f0e528181b9625e074049e176b93a34196e4fb4c7137e00a817c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 41 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 6 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_3e841dc08ad3035ed34566981270044f_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_3e841dc08ad3035ed34566981270044f_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4508
    • C:\Users\Admin\AppData\Local\Temp\2026-08-01_3e841dc08ad3035ed34566981270044f_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-01_3e841dc08ad3035ed34566981270044f_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4872
      • C:\Users\Admin\AppData\Roaming\JennyMod\ChromeWeb.exe
        "C:\Users\Admin\AppData\Roaming\JennyMod\ChromeWeb.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4364
        • C:\Users\Admin\AppData\Roaming\JennyMod\ChromeWeb.exe
          C:\Users\Admin\AppData\Roaming\JennyMod\ChromeWeb.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:4312
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\delete.bat" "
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3648
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1 -n 4
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4212

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        delete.bat
        • Path C:\Users\Admin\AppData\Local\Temp\delete.bat
        • Size 187B
        • SHA256 f10cfaabb0213bfd99598a9b9884686e652b728751a8e9275a0125cb994d2abd
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        81d243bd2c585b0f4821__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\81d243bd2c585b0f4821__mypyc.pyd
        • Size 194KB
        • SHA256 83997f49b62faef4add650888ee4ded785ceca51f16421fdfe8e75c00df783f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        JennyMod.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\JennyMod.dll
        • Size 16.1MB
        • SHA256 0554cce1237b8494b10b51737c8c0497cdcbe13e2d413fe3266f401888a3e072
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imaging.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\PIL\_imaging.pyd
        • Size 2.5MB
        • SHA256 6dfd10a98bc81a1999e2b5ddb8be8c1cfb9a2c8e10258c56a52ee0d8930d3d7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\_bz2.pyd
        • Size 84KB
        • SHA256 0ec5bdf4c688c1d2bda00f61e1f9e1369188c1019173a5412981f6569a997347
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\_ctypes.pyd
        • Size 124KB
        • SHA256 ed4170b2c2c302639301a01c6aac4c5575e6e4c936edc803d3ba6c34444e35e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\_hashlib.pyd
        • Size 65KB
        • SHA256 dfacbb48ade3d53780ff1e6875da90930a4a5d593e21984779079bd6f98f3768
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\_lzma.pyd
        • Size 156KB
        • SHA256 ed997ca4956fe7e27cc702adaa8d31136312361d285b7b845c8829d8c5a89ae8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\_queue.pyd
        • Size 32KB
        • SHA256 eb4070d87384565985a59a7139e0903b120044059cb0934a9a425c360e93a34c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\_socket.pyd
        • Size 83KB
        • SHA256 961dc7c65a28c174688e2f6b7803a615b9c034849a17cfc6527a27ccb2eeadb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\_ssl.pyd
        • Size 174KB
        • SHA256 78728b5e06037e3adfe922b59bb1dd19dea391e9ca02e21caab3cdc832111036
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\charset_normalizer\cd.pyd
        • Size 10KB
        • SHA256 2d9d0ace05e7d12e6923bf9ffa05a5c25016bfefb12da5e7b6162f125cbafd87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\charset_normalizer\md.pyd
        • Size 10KB
        • SHA256 85708ec481ffec487b78d62d10da93c048cf29f1e6ab36d8b854567822f30b89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\python312.dll
        • Size 6.6MB
        • SHA256 b6227a506a9963e7c8182785a54e14a193af51f7b277a61dda04492b499f49ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\select.pyd
        • Size 32KB
        • SHA256 e6bff4f35ab49a84f9e5ccd4b26eff30e1b2d7adb67d91911c4b84bfabcc28b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4508_040531_S4GBgvX-SEg\unicodedata.pyd
        • Size 1.1MB
        • SHA256 a443f6132d63a683ea3ef463cfe00987e0cf94d02c9e14350795f1a521d05f50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ChromeWeb.exe
        • Path C:\Users\Admin\AppData\Roaming\JennyMod\ChromeWeb.exe
        • Size 12.2MB
        • SHA256 da5e83d00e25f0e528181b9625e074049e176b93a34196e4fb4c7137e00a817c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download