Overview

overview

7

Static

static

3

2026-08-07...om.exe

windows10-2004-x64

7

2026-08-07...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 01:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_10e95f4ffa1ee49a583342c34368ff63_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
  • Size 45.0MB
  • Sample260808-cbdefaxhkb
  • SHA256 d8f010a0dbee164aff996366e0d0dcb224e0d07e4b94ae1e7a3fb028b81bb35f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 51 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_10e95f4ffa1ee49a583342c34368ff63_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_10e95f4ffa1ee49a583342c34368ff63_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6372
    • C:\Users\Admin\AppData\Local\Temp\2026-08-07_10e95f4ffa1ee49a583342c34368ff63_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-07_10e95f4ffa1ee49a583342c34368ff63_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls||clear
        3⤵
        • Executes a command shell one-liner
        PID:6704

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\VCRUNTIME140.dll
        • Size 94KB
        • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _brotli.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\_brotli.pyd
        • Size 801KB
        • SHA256 791e7195d7df47a21466868f3d7386cff13f16c51fcd0350bf4028e96278dff1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\_bz2.pyd
        • Size 78KB
        • SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\_ctypes.pyd
        • Size 117KB
        • SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\_hashlib.pyd
        • Size 57KB
        • SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\_lzma.pyd
        • Size 149KB
        • SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\_queue.pyd
        • Size 26KB
        • SHA256 9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\_socket.pyd
        • Size 72KB
        • SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\_ssl.pyd
        • Size 152KB
        • SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ascii.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\chardet\pipeline\ascii.pyd
        • Size 10KB
        • SHA256 1f5f478184100659ac1e4b180e5d015804526e063f4d4e1b3737c5a2a18fe00d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ascii__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\chardet\pipeline\ascii__mypyc.pyd
        • Size 32KB
        • SHA256 70ab0f5daf3a2ed5c8f7171df1d700c2534c70a5de8e9c6d8904f23db831c061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        confusion__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\chardet\pipeline\confusion__mypyc.pyd
        • Size 72KB
        • SHA256 57f6a61193a03cdd8d8af8ebfeb43b33f678eb57410673c538a406b92d794194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        escape__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\chardet\pipeline\escape__mypyc.pyd
        • Size 53KB
        • SHA256 a7525d02d144951b027b80765081272af3064c884a203563ae407299ad0ba3db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        magic__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\chardet\pipeline\magic__mypyc.pyd
        • Size 57KB
        • SHA256 ba30bc97e002674d91454f5a51c7742b9c0d1c9500063a716c6429a878ee5c6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orchestrator.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\chardet\pipeline\orchestrator.pyd
        • Size 10KB
        • SHA256 5227e0a6b9bc555971f3f0c4d5014b9abfefbe62a6e82d9e0b9d34d48d0e7c3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orchestrator__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\chardet\pipeline\orchestrator__mypyc.pyd
        • Size 107KB
        • SHA256 f7c07fb34f30149c9af30429fcb62e984c4754c6b9152526e117ef310c744e3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        statistical__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\chardet\pipeline\statistical__mypyc.pyd
        • Size 42KB
        • SHA256 f10337124df615bda37abb48258214ad3d0a4dc8a3ecce8a71c75d360466ed35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        structural__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\chardet\pipeline\structural__mypyc.pyd
        • Size 76KB
        • SHA256 0a45748cc7785b6663342263e8100263914dcbbf645c5349bf26660f4ad19fc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        utf1632__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\chardet\pipeline\utf1632__mypyc.pyd
        • Size 56KB
        • SHA256 47420e0dc3e6074e2b3238ef09836b1aee95c501103257985119f1a159911f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        utf8__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\chardet\pipeline\utf8__mypyc.pyd
        • Size 36KB
        • SHA256 b2dea84c835e43de9bd11c22cfd04e4141c2639b91f137b80d895e90bfba83c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        validity__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\chardet\pipeline\validity__mypyc.pyd
        • Size 31KB
        • SHA256 0f2e1427c2ff8d86f9bbdad39e9e5cd29107916dcd5e276050be05ea9217e3c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\libssl-1_1.dll
        • Size 678KB
        • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\psutil\_psutil_windows.pyd
        • Size 69KB
        • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        injector.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\pyinjector\injector.pyd
        • Size 20KB
        • SHA256 10575c0fe3fa9dabeddb0f65beb38e3d99081245de46c6770994ed28dbba397e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\python3.dll
        • Size 60KB
        • SHA256 8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\python310.dll
        • Size 4.2MB
        • SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\select.pyd
        • Size 25KB
        • SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_6372_736320_MXI5APlRuLo\unicodedata.pyd
        • Size 1.1MB
        • SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2972-125-0x00000253F9E50000-0x00000253FA0D9000-memory.dmp
        Download