Overview

overview

7

Static

static

3

2026-08-03...om.exe

windows10-2004-x64

7

2026-08-03...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    159s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 15:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_1d4a33ff3024c27cecf0fc8901a32791_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
  • Size 88.6MB
  • Sample260803-sdps9atvgw
  • SHA256 a4d166505f8b2635590d6f44bc9086a4d0e1eb64e6b9c8b95761af32f639123a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 24 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_1d4a33ff3024c27cecf0fc8901a32791_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_1d4a33ff3024c27cecf0fc8901a32791_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\Users\Admin\AppData\Local\Temp\2026-08-03_1d4a33ff3024c27cecf0fc8901a32791_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-03_1d4a33ff3024c27cecf0fc8901a32791_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of WriteProcessMemory
      PID:5336
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:1032
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x0000000000000500 0x00000000000004FC
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1844

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\MSVCP140_1.dll
        • Size 34KB
        • SHA256 206c931bf90fdad8816de3b5e2ef80b2bcaa9406c89ecc05fe6fddffe251e982
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qminimal.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\PyQt6\Qt6\plugins\platforms\qminimal.dll
        • Size 60KB
        • SHA256 c4f03a873f96edd8ab9c3016883f1705669743ba48d1ecbc5132704db48319c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qoffscreen.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\PyQt6\Qt6\plugins\platforms\qoffscreen.dll
        • Size 111KB
        • SHA256 7a3f14ab1f373e96e706db6f3f2d88a4eb7132f3d03e139fdc84a303ca974e22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwindows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\PyQt6\Qt6\plugins\platforms\qwindows.dll
        • Size 983KB
        • SHA256 dd126e2a47f7f3d4a855981e9d4012076058b1440f6900b9a07aa950e4e4f20a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qmodernwindowsstyle.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\PyQt6\Qt6\plugins\styles\qmodernwindowsstyle.dll
        • Size 225KB
        • SHA256 093e3ac68dfdac52a2667a2f7ba00b336392f9d6bde08430494ef54dbd120541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\PyQt6\QtCore.pyd
        • Size 2.5MB
        • SHA256 91dd5166110b88a4f4d3acda6fe6c10ed699882dd3602328a59e9f656cc766b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\PyQt6\QtGui.pyd
        • Size 2.2MB
        • SHA256 cf5ae37fd119fb29a53f1f2cea1362fdf036d940191be45d83da0f98ce8752b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\PyQt6\QtWidgets.pyd
        • Size 4.8MB
        • SHA256 4f81361816e94e1ae05f178085b22d5b9b19e417713b1966dd481a4017aa3b21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\PyQt6\sip.pyd
        • Size 110KB
        • SHA256 b3712a5326b899ba794082ad173f9b0cd0fce3a14de53f524b8c94c86d2d431d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\Qt6Core.dll
        • Size 10.0MB
        • SHA256 fae4778a42e93adc82b831c879c886a05147e9cc26760808d21116be5547259b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 8fceee959a670372aaa5763287c2ef7924cd9ecdbe2c29cf4b6c12a63079c503
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\Qt6Widgets.dll
        • Size 6.3MB
        • SHA256 4d603bff620ae0830d15c25a787f9f10ed3f972d998f1f17c9c4f83937280399
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\VCRUNTIME140.dll
        • Size 96KB
        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\_ctypes.pyd
        • Size 120KB
        • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\_socket.pyd
        • Size 76KB
        • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\libffi-8.dll
        • Size 34KB
        • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\msvcp140.dll
        • Size 628KB
        • SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\msvcp140_2.dll
        • Size 268KB
        • SHA256 d50d7883f20d1dc6191768d3746f52dd9cac89c346ffaed5be1f110c2f34a838
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\python3.dll
        • Size 64KB
        • SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\python311.dll
        • Size 5.5MB
        • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\select.pyd
        • Size 28KB
        • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\vcruntime140_1.dll
        • Size 37KB
        • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ViGEmClient.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2788_230568_9tSU3EBGJ8w\vgamepad\win\vigem\client\x64\ViGEmClient.dll
        • Size 127KB
        • SHA256 2bf0cb1d809039573c922737d298a1653d4dbc61408060ff45a9bcfde82e97d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5336-214-0x00007FFBD2890000-0x00007FFBD2D6B000-memory.dmp
        Download

        memory/5336-212-0x00007FFBD0EF0000-0x00007FFBD153D000-memory.dmp
        Download