Overview

overview

10

Static

static

3

2026-08-07...om.exe

windows10-2004-x64

10

2026-08-07...om.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 03:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_6003f933f96e9d24f9aff210504536ac_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 45.4MB
  • Sample260807-efse9sfm71
  • SHA256 0de0974cd0950c2b3b76d052f7af6b5d0d8d3c5927df950d059cc28b7bb10412
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
darksiderattrojan

Malware Config

Signatures

  • Family: DarkSideRAT

    DarkSideRAT is a remote access trojan.

    trojandarksiderat
  • Detects DarkSideRAT 3 IoCs
  • Loads dropped DLL 35 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_6003f933f96e9d24f9aff210504536ac_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_6003f933f96e9d24f9aff210504536ac_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5920
    • C:\Users\Admin\AppData\Local\Temp\2026-08-07_6003f933f96e9d24f9aff210504536ac_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-07_6003f933f96e9d24f9aff210504536ac_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
        PID:2796
      • C:\Users\Admin\AppData\Local\Temp\2026-08-07_6003f933f96e9d24f9aff210504536ac_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-07_6003f933f96e9d24f9aff210504536ac_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3684
        • C:\Users\Admin\AppData\Local\Temp\2026-08-07_6003f933f96e9d24f9aff210504536ac_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-08-07_6003f933f96e9d24f9aff210504536ac_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
          3⤵
            PID:548

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            MSVCP140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\PyQt5\Qt5\bin\MSVCP140.dll
            • Size 576KB
            • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            MSVCP140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\PyQt5\Qt5\bin\MSVCP140_1.dll
            • Size 30KB
            • SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Core.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\PyQt5\Qt5\bin\Qt5Core.dll
            • Size 5.7MB
            • SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Gui.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\PyQt5\Qt5\bin\Qt5Gui.dll
            • Size 6.7MB
            • SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Qt5Widgets.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\PyQt5\Qt5\bin\Qt5Widgets.dll
            • Size 5.2MB
            • SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QtCore.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\PyQt5\QtCore.pyd
            • Size 2.4MB
            • SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QtGui.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\PyQt5\QtGui.pyd
            • Size 2.4MB
            • SHA256 a9408e3b15ff3030f0e9acb3429000d253d3bb7206f750091a7130325f6d0d72
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            QtWidgets.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\PyQt5\QtWidgets.pyd
            • Size 4.9MB
            • SHA256 a1e97a2ab434c6ae5e56491c60172e59cdcce42960734e8bdf5d851b79361071
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sip.cp313-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\PyQt5\sip.cp313-win_amd64.pyd
            • Size 117KB
            • SHA256 7a54c971af695af612a1cda68924a2170d4a2afe48dd32770b60fde5b2dd7dab
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\VCRUNTIME140.dll
            • Size 117KB
            • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\VCRUNTIME140_1.dll
            • Size 48KB
            • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\_bz2.pyd
            • Size 84KB
            • SHA256 b3dd7cea6d03342252834cebcc814af37d850b86d0627fa22b7f6990882f2f8b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\_ctypes.pyd
            • Size 130KB
            • SHA256 dfa65498c77e71f038883337d2b5ffd92508489e79e6ee5e96ddec4ecf2a7fa1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\_hashlib.pyd
            • Size 67KB
            • SHA256 1a3010b06c2fcd625dece3dd0883ca060e98b94adc062b06cb1a671cfc3b5caf
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\_lzma.pyd
            • Size 155KB
            • SHA256 f20be6a9fee8fb5d53170c4bc24a39b48d3c0ccbe8e2000e60ff7d65b77c6ea1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\_queue.pyd
            • Size 34KB
            • SHA256 1e349a13913370369059a4ae5951157112b5eba53ed4389c18ffc5e00af1a037
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\_socket.pyd
            • Size 84KB
            • SHA256 127a39d2198f17dd9b573904fe7e4040c7c8718753e6c4edee2ff6c35f487fac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\_ssl.pyd
            • Size 177KB
            • SHA256 faf716d309349dbd54efd7fb402bd42ed21a537614ac0da89ed92ba307ecbf15
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _wmi.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\_wmi.pyd
            • Size 38KB
            • SHA256 3be5e14e9a9dc49f099209dee98b9cb5e31ade3b0deab52277026bb14df5bdb6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd
            • Size 221KB
            • SHA256 58c25c988641247cc153a987d1080dceb65c3a5cea68be96f0ac5b29c700ab05
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\base_library.zip
            • Size 1.3MB
            • SHA256 61ded48fc1bc932811d44e127e3c4252ab8805af7a707cf307b6e98a3bf57b22
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cd.cp313-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\charset_normalizer\cd.cp313-win_amd64.pyd
            • Size 10KB
            • SHA256 77e1c9c2679ea4855d5b97dba2666c6b4cfe32636945f5bb8399ff2c7ef1b050
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\libcrypto-3.dll
            • Size 5.0MB
            • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\libssl-3.dll
            • Size 776KB
            • SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _psutil_windows.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\psutil\_psutil_windows.pyd
            • Size 69KB
            • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.DLL
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\python3.DLL
            • Size 70KB
            • SHA256 4ae581aa4e65fef9f92c84c428c990892da538b4d9289592df51fa31fd879770
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python313.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\python313.dll
            • Size 5.8MB
            • SHA256 41ec4fc4e5bc8b207258590238f7f050b13fdfee84c4a7b1ecff6e945d031a10
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            pywintypes313.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\pywin32_system32\pywintypes313.dll
            • Size 133KB
            • SHA256 ea82e185e0bed58485a8df23712b62224f5e486dbb84d946115cad17512065cb
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\select.pyd
            • Size 32KB
            • SHA256 9cc1ef0264060099503592db57ee7d7c1f8d6bea689b2ed125919c7a30b7ab7f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Lorem ipsum.txt
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
            • Size 1KB
            • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            ucrtbase.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\ucrtbase.dll
            • Size 1.1MB
            • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            win32security.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI59202\win32\win32security.pyd
            • Size 129KB
            • SHA256 b3440637936125aef9ad9b78c5f8f5041347a3d15b570abd69946b7a7eb8a1e4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/548-211-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/2796-5-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/2796-4-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/3684-241-0x0000000140000000-0x0000000142D78000-memory.dmp
            Download

            memory/3684-245-0x00007FFC2A1F0000-0x00007FFC2A453000-memory.dmp
            Download

            memory/3684-264-0x00007FFC288B0000-0x00007FFC28B15000-memory.dmp
            Download

            memory/3684-261-0x00007FFC29730000-0x00007FFC29C1C000-memory.dmp
            Download

            memory/3684-273-0x0000000140000000-0x0000000142D78000-memory.dmp
            Download

            memory/5920-19-0x0000000140000000-0x0000000142D78000-memory.dmp
            Download

            memory/5920-272-0x0000000140000000-0x0000000142D78000-memory.dmp
            Download