Overview

overview

7

Static

static

3

2026-08-03...om.exe

windows10-2004-x64

7

2026-08-03...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 05:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_02ef69e8efe3bf3a3129573edaec9d39_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 8.6MB
  • Sample260803-fxjecssvfs
  • SHA256 bfaf0a9ce5572deed273705eaf9e724e2524ecf3c811372d643f5dc1fcf47029
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionpersistencepyinstaller

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 24 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_02ef69e8efe3bf3a3129573edaec9d39_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_02ef69e8efe3bf3a3129573edaec9d39_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2980
    • C:\Users\Admin\AppData\Local\Temp\2026-08-03_02ef69e8efe3bf3a3129573edaec9d39_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-03_02ef69e8efe3bf3a3129573edaec9d39_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4204
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "attrib +h C:\Users\Admin\AppData\Roaming\Windows_Service_Host"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:1560
        • C:\Windows\system32\attrib.exe
          attrib +h C:\Users\Admin\AppData\Roaming\Windows_Service_Host
          4⤵
          • Views/modifies file attributes
          PID:932
  • C:\Users\Admin\AppData\Roaming\Windows_Service_Host\win_service.exe
    C:\Users\Admin\AppData\Roaming\Windows_Service_Host\win_service.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4488
    • C:\Users\Admin\AppData\Roaming\Windows_Service_Host\win_service.exe
      C:\Users\Admin\AppData\Roaming\Windows_Service_Host\win_service.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of SetWindowsHookEx
      PID:1524
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4364

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29802\VCRUNTIME140.dll
          • Size 116KB
          • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29802\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29802\_bz2.pyd
          • Size 83KB
          • SHA256 f81dc49eac5ecc528e628175add2ff6bda695a93ea76671d7187155aa6326abb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29802\_ctypes.pyd
          • Size 122KB
          • SHA256 be9828a877e412b48d75addc4553d2d2a60ae762a3551f9731b50cae7d65b570
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29802\_lzma.pyd
          • Size 156KB
          • SHA256 a6e2a5bb7a33ad9054f178786a031a46ea560faeef1fb96259331500aae9154c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29802\_queue.pyd
          • Size 31KB
          • SHA256 3f57f29abd86d4dc8f4ca6c3f190ebb57d429143d98f0636ff5117e08ed81f9b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29802\_socket.pyd
          • Size 81KB
          • SHA256 7daff6aa3851a913ed97995702a5dfb8a27cb7cf00fb496597be777228d7564a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _wmi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29802\_wmi.pyd
          • Size 35KB
          • SHA256 1a105311a5ed88a31472b141b4b6daa388a1cd359fe705d9a7a4aba793c5749f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29802\base_library.zip
          • Size 1.3MB
          • SHA256 818edb1b670959248d1dc949b847acc9c1875c61285e3a22ace98d59879daf6b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29802\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python312.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29802\python312.dll
          • Size 6.6MB
          • SHA256 c98ba3354a7d1f69bdca42560feec933ccba93afcc707391049a065e1079cddb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29802\select.pyd
          • Size 29KB
          • SHA256 680df34fb908c49410ac5f68a8c05d92858acd111e62d1194d15bdce520bd6c3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI29802\unicodedata.pyd
          • Size 1.1MB
          • SHA256 10ffd5207eeff5a836b330b237d766365d746c30e01abf0fd01f78548d1f1b04
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win_service.exe
          • Path C:\Users\Admin\AppData\Roaming\Windows_Service_Host\win_service.exe
          • Size 8.6MB
          • SHA256 bfaf0a9ce5572deed273705eaf9e724e2524ecf3c811372d643f5dc1fcf47029
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download