Overview

overview

10

Static

static

3

2026-08-03...om.exe

windows10-2004-x64

10

2026-08-03...om.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 02:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_16192a418327b9db3a49338167203bd7_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
  • Size 37.0MB
  • Sample260803-dftgwsbl2v
  • SHA256 47f7546afad4973c2abc9e2ea4e79626092827fc6c3ca102336046a5844cfad3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
blankgrabberstealer

Malware Config

Signatures

  • Family: blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber
  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Loads dropped DLL 41 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_16192a418327b9db3a49338167203bd7_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_16192a418327b9db3a49338167203bd7_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Users\Admin\AppData\Local\Temp\2026-08-03_16192a418327b9db3a49338167203bd7_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-03_16192a418327b9db3a49338167203bd7_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2564

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\MSVCP140.dll
        • Size 628KB
        • SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\MSVCP140_2.dll
        • Size 268KB
        • SHA256 d50d7883f20d1dc6191768d3746f52dd9cac89c346ffaed5be1f110c2f34a838
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\PyQt6\QtCore.pyd
        • Size 2.4MB
        • SHA256 7ec13026cac563d927ee9cef2fbea5e51fdc2233cc3b8115f0ac077daddf6707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\PyQt6\QtGui.pyd
        • Size 2.1MB
        • SHA256 af423b8bcecee28099c0ab6816595aa6e9fae5bbee399c2cff661839cf1bafe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\PyQt6\QtWidgets.pyd
        • Size 4.8MB
        • SHA256 3daad2162489819f55f3013d9250362271bbabba51712224576b970ed9f3bf0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\PyQt6\sip.pyd
        • Size 110KB
        • SHA256 b3712a5326b899ba794082ad173f9b0cd0fce3a14de53f524b8c94c86d2d431d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\Qt6Core.dll
        • Size 6.1MB
        • SHA256 009c9ec26dcf18236a9213e76c7ea51c51197b943b061387e415d8651ef2ec8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\Qt6Gui.dll
        • Size 8.6MB
        • SHA256 f67734847a4a29116332781a1322b629658185e44173975822d145eb4cda3b8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\Qt6Widgets.dll
        • Size 6.3MB
        • SHA256 262476e4516e98eff35850ad86e313b3b9105f3807e315a2db6af3e9b6f9888b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\VCRUNTIME140.dll
        • Size 106KB
        • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\_bz2.pyd
        • Size 82KB
        • SHA256 403e76fe18515a5ea3227cf5f919aa2f32ac3233853c9fb71627f2251c554d09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\_cffi_backend.pyd
        • Size 175KB
        • SHA256 9dcbe427f86795a5dfc19d74e9b5f3d0994ff0221b1a111877ed11eccd42e026
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\_ctypes.pyd
        • Size 120KB
        • SHA256 e28d4e46e5d10b5fdcf0292f91e8fd767e33473116247cd5d577e4554d7a4c0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\_hashlib.pyd
        • Size 63KB
        • SHA256 21d59958e2ad1b944c4811a71e88de08c05c5ca07945192ab93da5065fac8926
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\_lzma.pyd
        • Size 155KB
        • SHA256 ad0440ca6998e18f5cc917d088af3fea2c0ff0febce2b5e2b6c0f1370f6e87b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\_queue.pyd
        • Size 31KB
        • SHA256 06c36ec0749d041e6957c3cd7d2d510628b6abe28cee8c9728412d9ce196a8a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\_socket.pyd
        • Size 77KB
        • SHA256 301c47c4016dac27811f04f4d7232f24852ef7675e9a4500f0601703ed8f06af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\_ssl.pyd
        • Size 172KB
        • SHA256 4727b60962efacfd742dca21341a884160cf9fcf499b9afa3d9fdbcc93fb75d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ada92cb5d92a588d1b93__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\ada92cb5d92a588d1b93__mypyc.pyd
        • Size 216KB
        • SHA256 fc17eb621ecf2325e3c2d7501d3ee2c3848e3c7fec7027fda7c7fa1782874743
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\charset_normalizer\cd.pyd
        • Size 10KB
        • SHA256 0fb7f617fc9961bd11ea78666d0252a726f6f5c4ba0e2d432f965d1efc320169
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _rust.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\cryptography\hazmat\bindings\_rust.pyd
        • Size 9.4MB
        • SHA256 813b101f70efb79c388239ce82ac891e195a1e19eeaeb43c32d9bf425e7b51b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\libcrypto-3.dll
        • Size 4.9MB
        • SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\libssl-3.dll
        • Size 771KB
        • SHA256 41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        main.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\main.dll
        • Size 16.4MB
        • SHA256 4a2c43e44b50d9a63f62408c1ae8589716f6505ab19c542f2c53d7c2678f445c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\msvcp140_1.dll
        • Size 34KB
        • SHA256 206c931bf90fdad8816de3b5e2ef80b2bcaa9406c89ecc05fe6fddffe251e982
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\python3.dll
        • Size 65KB
        • SHA256 e45452efa356db874f2e5ff08c9cc0fe22528609e5d341f8fb67ba48885ab77d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\python311.dll
        • Size 5.5MB
        • SHA256 53a969094231b9032abe4148939ce08a3a4e4b30b0459fc7d90c89f65e8dcd4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\select.pyd
        • Size 29KB
        • SHA256 8a9a103bc417dede9f6946d9033487c410937e1761d93c358c1600b82f0a711f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1676_507488_m3MmLsXn09c\unicodedata.pyd
        • Size 1.1MB
        • SHA256 1a965c1904da88989468852fdc749b520cce46617b9190163c8df19345b59560
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        .integrity_hash
        • Path C:\Users\Admin\AppData\Roaming\.arcane_realms\.integrity_hash
        • Size 2B
        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
        • MD5 SHA1 SHA512
        Submit Download

        memory/2564-162-0x0000021A92EE0000-0x0000021A93103000-memory.dmp
        Download

        memory/2564-158-0x00007FFF44A80000-0x00007FFF44CE5000-memory.dmp
        Download

        memory/2564-153-0x00007FFF42010000-0x00007FFF424E3000-memory.dmp
        Download

        memory/2564-151-0x00007FFF413A0000-0x00007FFF419E6000-memory.dmp
        Download

        memory/2564-197-0x0000021A92EE0000-0x0000021A93103000-memory.dmp
        Download

        memory/2564-201-0x0000021A92EE0000-0x0000021A93103000-memory.dmp
        Download