Overview

overview

7

Static

static

3

2026-08-05...ar.exe

windows10-2004-x64

7

2026-08-05...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/08/2026, 22:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-05_4ba35621b51920f94b0fcea0cec67f93_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 49.3MB
  • Sample260805-2d281sxflb
  • SHA256 6d84d96e86e7cdbb8fd29e429d8b45d08d27efd958afe6bff4502377c992d319
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-05_4ba35621b51920f94b0fcea0cec67f93_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-05_4ba35621b51920f94b0fcea0cec67f93_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5520
    • C:\Users\Admin\AppData\Local\Temp\2026-08-05_4ba35621b51920f94b0fcea0cec67f93_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-05_4ba35621b51920f94b0fcea0cec67f93_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1392

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\MSVCP140.dll
        • Size 576KB
        • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\MSVCP140_1.dll
        • Size 30KB
        • SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt5\QtCore.pyd
        • Size 2.4MB
        • SHA256 203bb6236f23f57ad8cdab5bbf4537a4abbc0b0879cf2893a8dc930e679dd846
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt5\QtGui.pyd
        • Size 2.4MB
        • SHA256 2ca28d29ec4f2f50b4ccc70c7d6399b314151bc38852833d2d30097773bb1c00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtSvg.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt5\QtSvg.pyd
        • Size 114KB
        • SHA256 b1e2eb37a22016b4a06b9aef0d1f0c7c762461a6bb2ac9b68002d6c59c1a49fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt5\QtWidgets.pyd
        • Size 4.9MB
        • SHA256 e4a06fe65b02c568db984771fb9a46ea95a8e4353ea85c942f954cba02dec635
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtXml.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt5\QtXml.pyd
        • Size 218KB
        • SHA256 dd90c70a16e55dc95a709dee855d08f323ed4753cfb2922f89227b08a91a8935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt5\sip.pyd
        • Size 120KB
        • SHA256 59dfdf5cc110b8fcf340f9cd146b1c288bcd3d092d6a192a922f5a0dc9ce7907
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Qt5Core.dll
        • Size 5.7MB
        • SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Qt5Gui.dll
        • Size 6.7MB
        • SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Svg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Qt5Svg.dll
        • Size 322KB
        • SHA256 7348cfc6444438b8845fb3f59381227325d40ca2187d463e82fc7b8e93e38db5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Qt5Widgets.dll
        • Size 5.2MB
        • SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Xml.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Qt5Xml.dll
        • Size 208KB
        • SHA256 ebdf91f0310ab67a79abd2385fa428205856f81e3a753e6e47c31d5946ddd590
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
        • Size 123KB
        • SHA256 2995ef03e784c68649fa7898979cbb2c1737f691348fae15f325d9fc524df8ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
        • Size 77KB
        • SHA256 1db7b4f6ae31c4d35ef874eb328f735c96a2457677a3119e9544ee2a79bc1016
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _win32sysloader.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_win32sysloader.pyd
        • Size 14KB
        • SHA256 b155b2f3310e35f2ae40c89726453cbdba48632a854192d78a9a7b634c310255
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiarray_umath.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy\core\_multiarray_umath.pyd
        • Size 2.6MB
        • SHA256 b1efdf792a3d2cc30e7dcc3bdd911cbcfd52d47031c7c6de8dace521311c93fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\python3.dll
        • Size 57KB
        • SHA256 5039f5b1e44f14a6f3939e17eeda56818ca0cecacfdf978f903a349abbcea23b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pythoncom38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pythoncom38.dll
        • Size 657KB
        • SHA256 3890c952d049677351d50b940793e82fb9f065ac77a97cd228c187616be1687e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pywintypes38.dll
        • Size 133KB
        • SHA256 d2df2f815ab392812399143d6cb661c807449fa8409fd126f39f656769b8a728
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd
        • Size 26KB
        • SHA256 940fb90fd78b5be4d72279dcf9c24a8b1fcf73999f39909980b12565a7921281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd
        • Size 1.0MB
        • SHA256 5578c3054f8846be86e686fb73b62b1f931d3ed1a7859b87925a96774371dba4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32gui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32gui.pyd
        • Size 213KB
        • SHA256 8e6c586b84cb7d83dea4a68c3f7342ce6fca499edc7e5c346a1d6616351915a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5520_134304425460999409\VCRUNTIME140.dll
        • Size 99KB
        • SHA256 ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5520_134304425460999409\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5520_134304425460999409\python38.dll
        • Size 4.0MB
        • SHA256 13f7c38dc27777a507d4b7f0bd95d9b359925f6f5bf8d0465fe91e0976b610c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5520_134304425460999409\vcruntime140_1.dll
        • Size 43KB
        • SHA256 7b8f70dd3bdae110e61823d1ca6fd8955a5617119f5405cdd6b14cad3656dfc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5520_134304425460999409\win32api.pyd
        • Size 130KB
        • SHA256 da256a6eeb9c5512e869ca5452ec373a7c3aa8be13afeb76fd650738a5adfbec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32print.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5520_134304425460999409\win32print.pyd
        • Size 72KB
        • SHA256 5a258c27850213d4491701649b8fb4cb826eec935b90828f11969bead5fa2926
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1392-184-0x00007FFA7FB60000-0x00007FFA80040000-memory.dmp
        Download

        memory/1392-185-0x00007FFA7EF50000-0x00007FFA7F491000-memory.dmp
        Download

        memory/1392-190-0x00007FFA7E1D0000-0x00007FFA7E430000-memory.dmp
        Download

        memory/1392-193-0x00007FFA7DF60000-0x00007FFA7E1C4000-memory.dmp
        Download