Overview

overview

9

Static

static

3

2026-08-08...om.exe

windows10-2004-x64

9

2026-08-08...om.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    157s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 04:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_a705091e463cae299a541a8212b283f4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
  • Size 67.2MB
  • Sample260808-ffdgsazhpf
  • SHA256 efa5a028d3af3a5f11c46543159304fb538f9e54e0a908a46c81c237aa89c586
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
persistenceprivilege_escalation

Malware Config

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Loads dropped DLL 30 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_a705091e463cae299a541a8212b283f4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_a705091e463cae299a541a8212b283f4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1388
    • C:\Users\Admin\AppData\Local\Temp\2026-08-08_a705091e463cae299a541a8212b283f4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-08_a705091e463cae299a541a8212b283f4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5556
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_a705091e463cae299a541a8212b283f4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_a705091e463cae299a541a8212b283f4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3284
    • C:\Users\Admin\AppData\Local\Temp\2026-08-08_a705091e463cae299a541a8212b283f4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-08_a705091e463cae299a541a8212b283f4_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1528

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        agent_persist_results.json
        • Path C:\Users\Admin\AppData\Local\Temp\agent_persist_results.json
        • Size 1KB
        • SHA256 383ab937d2152c698fc5944e16efa71081a4b26dfe10c5c07fea87d8ae56f099
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Agent.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1388_743538_MfP_jmfVOhs\Agent.dll
        • Size 25.2MB
        • SHA256 aa1bbac9457ebcc134a75d063ad0f70a9b804e1a9c9b6fa5d9fad142ad959fb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1388_743538_MfP_jmfVOhs\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1388_743538_MfP_jmfVOhs\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1388_743538_MfP_jmfVOhs\_bz2.pyd
        • Size 85KB
        • SHA256 f0643f805a011efc704df472bb431ba231e6ae31fb7ba71328df1b6f1a9e1aa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1388_743538_MfP_jmfVOhs\_lzma.pyd
        • Size 157KB
        • SHA256 3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1388_743538_MfP_jmfVOhs\_queue.pyd
        • Size 35KB
        • SHA256 4fd91087253a1507a5e5068eb366e77826efc27a568707ed4796d638df1fcf1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1388_743538_MfP_jmfVOhs\_socket.pyd
        • Size 85KB
        • SHA256 6a016011e78e2476eb19dbe7330b373b9e2c66ff6c0be9bd64ff008ee53647ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1388_743538_MfP_jmfVOhs\_sqlite3.pyd
        • Size 129KB
        • SHA256 23370d813030202ae481b114fa042ddff6edd31cdaa6bba4616718ecf0628ff4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1388_743538_MfP_jmfVOhs\_wmi.pyd
        • Size 39KB
        • SHA256 2aec82cd41bfc201fd04143023c7493f117436041f66120ddcd4a24b131ca9db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1388_743538_MfP_jmfVOhs\_zstd.pyd
        • Size 491KB
        • SHA256 74f64a5d724cad1c10ca9ba579b6af198178406b0a4f061685326e79cffa3eea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1388_743538_MfP_jmfVOhs\psutil\_psutil_windows.pyd
        • Size 69KB
        • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1388_743538_MfP_jmfVOhs\python3.dll
        • Size 72KB
        • SHA256 27972cedfa8ca9f6835a2cbbff95336b15773a05b10067e3b084409095341068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1388_743538_MfP_jmfVOhs\python314.dll
        • Size 6.4MB
        • SHA256 f1722bd369d79fecbc85f3ed2790c30c330b9413fd74332f95b086e60dfacc2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1388_743538_MfP_jmfVOhs\sqlite3.dll
        • Size 1.5MB
        • SHA256 bb00c81138ad27581bee5f37aa0a225e22baee0ef67ad92f5726081c7140bfc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download