Overview

overview

7

Static

static

3

2026-08-10...om.exe

windows10-2004-x64

7

2026-08-10...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/08/2026, 01:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_d96edb3b91f439e1908e153111acd494_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
  • Size 18.5MB
  • Sample260810-b91rysde26
  • SHA256 8dba9a91cce5557492158d4038fc37c0816f2104220dbe400c5221caf7255276
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 50 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_d96edb3b91f439e1908e153111acd494_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_d96edb3b91f439e1908e153111acd494_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Users\Admin\AppData\Local\Temp\2026-08-10_d96edb3b91f439e1908e153111acd494_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-10_d96edb3b91f439e1908e153111acd494_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        PID:4084

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Loader.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\Loader.dll
        • Size 32.0MB
        • SHA256 3520781422e3d558c55797b07cf83c88cc338e4ac0386489fc7e48ca9d5df028
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imaging.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\PIL\_imaging.pyd
        • Size 2.5MB
        • SHA256 16a7c881fd3624c8428078ce24460861e91fc5cc43de1b3614dc2531fe327e2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imagingft.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\PIL\_imagingft.pyd
        • Size 2.1MB
        • SHA256 2c5951d8d3d6f2640545afcdd059f21f65e8571e24789f76790c18d501bf505c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\VCRUNTIME140.dll
        • Size 94KB
        • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _brotli.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\_brotli.pyd
        • Size 801KB
        • SHA256 791e7195d7df47a21466868f3d7386cff13f16c51fcd0350bf4028e96278dff1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\_bz2.pyd
        • Size 78KB
        • SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\_cffi_backend.pyd
        • Size 175KB
        • SHA256 c379126647af2cbfb592d6a921f6218da59b886e2a56e9b82f8159aced6f1100
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\_ctypes.pyd
        • Size 117KB
        • SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\_elementtree.pyd
        • Size 119KB
        • SHA256 16480ede0430be5249481a9bfb843eb0ef98f93b467a5428352fc23cc8c9051d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\_hashlib.pyd
        • Size 57KB
        • SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\_lzma.pyd
        • Size 149KB
        • SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\_queue.pyd
        • Size 26KB
        • SHA256 9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\_socket.pyd
        • Size 72KB
        • SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\_ssl.pyd
        • Size 152KB
        • SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ascii__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\chardet\pipeline\ascii__mypyc.pyd
        • Size 32KB
        • SHA256 70ab0f5daf3a2ed5c8f7171df1d700c2534c70a5de8e9c6d8904f23db831c061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        confusion__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\chardet\pipeline\confusion__mypyc.pyd
        • Size 72KB
        • SHA256 57f6a61193a03cdd8d8af8ebfeb43b33f678eb57410673c538a406b92d794194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orchestrator.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\chardet\pipeline\orchestrator.pyd
        • Size 10KB
        • SHA256 5227e0a6b9bc555971f3f0c4d5014b9abfefbe62a6e82d9e0b9d34d48d0e7c3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orchestrator__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\chardet\pipeline\orchestrator__mypyc.pyd
        • Size 107KB
        • SHA256 f7c07fb34f30149c9af30429fcb62e984c4754c6b9152526e117ef310c744e3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\libssl-1_1.dll
        • Size 678KB
        • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sodium.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\nacl\_sodium.pyd
        • Size 396KB
        • SHA256 57822e7aed944269943bcb855fc14560a5b6ae38869de4e3d00c380a5119ecc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\psutil\_psutil_windows.pyd
        • Size 69KB
        • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\pyexpat.pyd
        • Size 187KB
        • SHA256 e2146bed9720eb94388532551444f434d3195310fa7bd117253e7df81a8e187e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\python3.dll
        • Size 60KB
        • SHA256 8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\python310.dll
        • Size 4.2MB
        • SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\pywintypes310.dll
        • Size 132KB
        • SHA256 d14a89c503599be257b733cafdd66ff8d0e77bc657360dee921d40374820c415
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\select.pyd
        • Size 25KB
        • SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\unicodedata.pyd
        • Size 1.1MB
        • SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\vcruntime140_1.dll
        • Size 36KB
        • SHA256 04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32security.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2688_641337_JJQFpSgo66g\win32security.pyd
        • Size 129KB
        • SHA256 35686c5ec1fda6b12691151fc4f98670183e4edca72575b7aac0f53034104120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download