Overview

overview

7

Static

static

3

2026-08-03...om.exe

windows10-2004-x64

7

2026-08-03...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 02:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_4ead52fd99c8264ca0bb618eb7483827_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 73.8MB
  • Sample260804-dfct5s1bmb
  • SHA256 9415c2dd427d4c7f82cc45d5d2fc53c8c9b6c95a05247304a75edd15e2d6e1cb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 47 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_4ead52fd99c8264ca0bb618eb7483827_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_4ead52fd99c8264ca0bb618eb7483827_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Users\Admin\AppData\Local\Temp\2026-08-03_4ead52fd99c8264ca0bb618eb7483827_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-03_4ead52fd99c8264ca0bb618eb7483827_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:3124

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LIBBZ2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\LIBBZ2.dll
        • Size 81KB
        • SHA256 25a4aae35dd89709620106db311af5bca7c868182b961e106a895ae14d2fc98a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\VCRUNTIME140.dll
        • Size 121KB
        • SHA256 0205071c36c17f1efbd70178c852cb7d49985c484202752b8704b7ac6b184e60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 963e45edd064545962e216c12d68071ced94dc8e11862a18f07f14eb2690a57c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_asyncio.pyd
        • Size 70KB
        • SHA256 2a355ebdfc2a7435474bbf665280acff93da398a960db0c3acffc8692decf699
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_bz2.pyd
        • Size 35KB
        • SHA256 12c6fda28fa6e2668197469896dd6f812365e3875e1e73e4f9bc497a9a1728fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_ctypes.pyd
        • Size 138KB
        • SHA256 3061c3be3f1332b8a66b5aa9fc64a5a787a1bfcb9dd04c8fa47fd45ea841dc3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_hashlib.pyd
        • Size 61KB
        • SHA256 8941d8794b85b80c5c3b707833e99368d3078a3d2395ab6c982c5b589b80b16e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_lzma.pyd
        • Size 47KB
        • SHA256 fd6ceb04e4261fd42a3bcaf1023cb3972378cc0ad4e8104146047daf603440fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_overlapped.pyd
        • Size 54KB
        • SHA256 9c9613fb877fc29e397832f209c0cc3cca4f6eb5133aeb8ea68fd16f0789c925
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_queue.pyd
        • Size 32KB
        • SHA256 a7151c60366865a9799b993f594688acad1500d88ebe4ce6d6f9b40994ed2afa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_socket.pyd
        • Size 84KB
        • SHA256 7988496a531a50633c89c5946496c658cee39c4690c34e01a5338ccd0f001f90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_ssl.pyd
        • Size 181KB
        • SHA256 abbe88f20333fc1f5335503f87fb1bf218950024b3ea80421e6fded595c45d25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_uuid.pyd
        • Size 25KB
        • SHA256 caf05a3bddc8cb8e009cace841cc511c84c7da1ce327de18f93871ba2a8806a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\_wmi.pyd
        • Size 37KB
        • SHA256 fc3b226422d3a9613c6c42d2003aa4812ef8f3780f8aaab72005338adb45977c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_parser.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\aiohttp\_http_parser.cp313-win_amd64.pyd
        • Size 248KB
        • SHA256 e1110ebc886bf425e125ff72b17fa7b29cb7ac3ac1615fec16ac81dd9c7aa52b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_writer.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\aiohttp\_http_writer.cp313-win_amd64.pyd
        • Size 45KB
        • SHA256 02833dd9af3b82c7d9df4e6738734f3907e102be546c10bd75ab0e365e9ce97e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mask.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\aiohttp\_websocket\mask.cp313-win_amd64.pyd
        • Size 35KB
        • SHA256 3250dcd0b2afc2a52bd95f7d048fe49eca14a7fb1f22b196f8455a843f1d70bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        reader_c.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\aiohttp\_websocket\reader_c.cp313-win_amd64.pyd
        • Size 138KB
        • SHA256 db186e7ac43b0e4e28110e65016ec71900885ccd5387c46860b8ffe2f2686c9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\base_library.zip
        • Size 1.3MB
        • SHA256 ba4a6d9519df4c8037b136b175f9244abbebf5b3c3aab53e4e3258364c1e18af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ffi.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\ffi.dll
        • Size 40KB
        • SHA256 de64ed1334d84d617cc47a9037b334740e930d75015a768e2825f474782aa839
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\libcrypto-3-x64.dll
        • Size 7.0MB
        • SHA256 9241728d008d9c73f7886eb5032b59b7532b08e164dcc0abc08e86dc8c7fa43a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        liblzma.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\liblzma.dll
        • Size 195KB
        • SHA256 960b67b5188e142ae86e7a3ad0ad417a6c50e7a511b19155ad46061f46d0857f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\libssl-3-x64.dll
        • Size 1.3MB
        • SHA256 a1c1216a0c4e9be5a77a1457ed47d349c26d56ec0f157fc770c9b9da5efea020
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multidict.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\multidict\_multidict.cp313-win_amd64.pyd
        • Size 78KB
        • SHA256 d20eb8153da9ecfd280788f8c6dcfb3e3703c847df22d70d72568c380b63a1d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _helpers_c.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\propcache\_helpers_c.cp313-win_amd64.pyd
        • Size 60KB
        • SHA256 1c3eafe00c2a0e1dd93647a01ebf1874fb2265cb09f58619761f814dc8599f3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\python3.DLL
        • Size 68KB
        • SHA256 fc3a7878604878b1144540cb6fb105841170bfb44cd8a4c42e7f3dd8e90b7c8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\python313.dll
        • Size 6.8MB
        • SHA256 e1c7a0f81abcb01050fb6c2f31435be16b83d736adf9cbb34bad2325590dc20c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\select.pyd
        • Size 30KB
        • SHA256 9519a53452e47f6cc4257a341f5a7a914c7a6b8f9494395c67eef937e4fdd2e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\ucrtbase.dll
        • Size 1.1MB
        • SHA256 fbed69a52fdcf571dd37fe4cc63cb86ed3732b5b998807f14968788027c00754
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\unicodedata.pyd
        • Size 692KB
        • SHA256 d27821c75d386b080f3a3b0d0c334e6a7f92e99aafdb9e57d4b235f6fc6da6b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _quoting_c.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\yarl\_quoting_c.cp313-win_amd64.pyd
        • Size 81KB
        • SHA256 40e5131ebda53a875049518b994ceb263ba187ccbc8e80c9d7f764e687b491e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10722\zlib.dll
        • Size 99KB
        • SHA256 74db91bbc59b23545fd1960ea323f9211fc74434e77e0944056b00d6b05976da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download