Overview

overview

10

Static

static

3

2026-08-10...ar.exe

windows10-2004-x64

10

2026-08-10...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 17:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_0d15114427e4eb3b83ef36147397ea0e_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 36.6MB
  • Sample260810-v7mbbshe88
  • SHA256 8b00aec6e9e4aad07e4e49da3d04d86fcac155b2543d2bbe71681f93080361a3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Credentials
  • Protocol

    ftp
  • Host

    onlymath2.ipdisk.co.kr
  • Port

    21
  • Username

    admin
  • Password

    admin00

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_0d15114427e4eb3b83ef36147397ea0e_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_0d15114427e4eb3b83ef36147397ea0e_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4532
    • C:\Users\Admin\AppData\Local\Temp\2026-08-10_0d15114427e4eb3b83ef36147397ea0e_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-10_0d15114427e4eb3b83ef36147397ea0e_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1204
      • C:\Users\Admin\AppData\Local\Temp\샵샵워드.exe
        C:\Users\Admin\AppData\Local\Temp\샵샵워드.exe up
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1064
        • C:\Users\Admin\AppData\Local\Temp\샵샵워드.exe
          C:\Users\Admin\AppData\Local\Temp\샵샵워드.exe up
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          PID:5928

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        qt_help_en.qm
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10642\PyQt5\Qt5\translations\qt_help_en.qm
        • Size 16B
        • SHA256 9959b510b15d18937848ad13007e30459d2e993c67e564badbfc18f935695c85
        • MD5 SHA1 SHA512
        Submit Download

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\Qt5\bin\MSVCP140.dll
        • Size 576KB
        • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\Qt5\bin\MSVCP140_1.dll
        • Size 30KB
        • SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\Qt5\bin\Qt5Core.dll
        • Size 5.7MB
        • SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\Qt5\bin\Qt5Gui.dll
        • Size 6.7MB
        • SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\Qt5\bin\Qt5Widgets.dll
        • Size 5.2MB
        • SHA256 3788c669d4b645e5a576de9fc77fca776bf516d43c89143dc2ca28291ba14358
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\Qt5\bin\VCRUNTIME140_1.dll
        • Size 43KB
        • SHA256 1f0f5f2ce671e0f68cf96176721df0e5e6f527c8ca9cfa98aa875b5a3816d460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qminimal.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\Qt5\plugins\platforms\qminimal.dll
        • Size 824KB
        • SHA256 05d1e7364dd2a672df3ca44dd6fd85bed3d3dc239dcfe29bfb464f10b4daa628
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qoffscreen.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\Qt5\plugins\platforms\qoffscreen.dll
        • Size 736KB
        • SHA256 54097626faae718a4bc8e436c85b4ded8f8fb7051b2b9563a29aee4ed5c32b7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwebgl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\Qt5\plugins\platforms\qwebgl.dll
        • Size 470KB
        • SHA256 9c3b2fa2383eeed92bb5810bdcf893ae30fa654a30b453ab2e49a95e1ccf1631
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\QtCore.pyd
        • Size 2.4MB
        • SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\QtGui.pyd
        • Size 2.4MB
        • SHA256 a9408e3b15ff3030f0e9acb3429000d253d3bb7206f750091a7130325f6d0d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\QtWidgets.pyd
        • Size 4.9MB
        • SHA256 a1e97a2ab434c6ae5e56491c60172e59cdcce42960734e8bdf5d851b79361071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\sip.cp313-win_amd64.pyd
        • Size 117KB
        • SHA256 e63580748533698abdafaff1210f5bb0247b36ee987d0180076eaaa46245c0d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qaxcontainer.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\uic\widget-plugins\qaxcontainer.py
        • Size 1KB
        • SHA256 05a12b2e2e8e2aff1c776bafbe3f307f7adb9cfe75b45e2e985f94a95be3c5af
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        qscintilla.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\uic\widget-plugins\qscintilla.py
        • Size 1KB
        • SHA256 f12e7b7755fefd3da1c85cc68c82f8e15a92dad8edf19463b72bdfd385d9e860
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        qtcharts.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\uic\widget-plugins\qtcharts.py
        • Size 1KB
        • SHA256 df2906cef4849b9594a7c9b8a26dbbffa3e5bcfb23e3ef3392b2caa4e87bc177
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        qtprintsupport.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\uic\widget-plugins\qtprintsupport.py
        • Size 1KB
        • SHA256 13fff8ad30973e088b7e28ff3ce5c158629e799946a5e66599d04471c9668547
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        qtquickwidgets.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\uic\widget-plugins\qtquickwidgets.py
        • Size 1KB
        • SHA256 f994cead886a504de88efcb45af6ec5ba23e78ed64d6783132e2188736697c4c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        qtwebenginewidgets.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\uic\widget-plugins\qtwebenginewidgets.py
        • Size 1KB
        • SHA256 3adbca72b8b8ea7b96b2d9457fa374b967e759571bca26a7fbefc66a2dbcc296
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        qtwebkit.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\PyQt5\uic\widget-plugins\qtwebkit.py
        • Size 2KB
        • SHA256 9e7072acf8677b0eeff267d2e74d885d4e5f1375e0858a2e333067d06b465d4a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\_bz2.pyd
        • Size 83KB
        • SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\_ctypes.pyd
        • Size 130KB
        • SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\_elementtree.pyd
        • Size 132KB
        • SHA256 fe09d0408aab3a6faa71467f78433df4c7f3ad0b033bb72ec43bde85abf6dcfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\_lzma.pyd
        • Size 155KB
        • SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\_socket.pyd
        • Size 83KB
        • SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\_ssl.pyd
        • Size 177KB
        • SHA256 3301ff340d26495c95108199b67fdf3402742d13070af8b6bf4eb2e0c5e13781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\base_library.zip
        • Size 1.3MB
        • SHA256 3576ea92dedd4e935413ed9a4181294a4a7c24c1e286e76f681f8031901797e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\libssl-3.dll
        • Size 776KB
        • SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\pyexpat.pyd
        • Size 200KB
        • SHA256 554bbc65bfe8c19ba9bbd94f18977a8131109c6a4d64306778bd12250c2c5c56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\python3.DLL
        • Size 69KB
        • SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\python313.dll
        • Size 5.8MB
        • SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\select.pyd
        • Size 31KB
        • SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        updata.ui
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45322\updata.ui
        • Size 4KB
        • SHA256 2e67a27b95f252d17ff15a546bb56c867120fc52dedabfe1a186a1c896ce6f61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1204-202-0x00007FFDE3280000-0x00007FFDE34E5000-memory.dmp
        Download

        memory/1204-166-0x00007FFDE50D0000-0x00007FFDE5333000-memory.dmp
        Download

        memory/1204-197-0x00007FFDE3BB0000-0x00007FFDE40F1000-memory.dmp
        Download

        memory/1204-214-0x000002AD643C0000-0x000002AD643D0000-memory.dmp
        Download

        memory/1204-199-0x00007FFDE4100000-0x00007FFDE45EC000-memory.dmp
        Download

        memory/5928-524-0x00007FFDE29C0000-0x00007FFDE2C23000-memory.dmp
        Download

        memory/5928-525-0x00007FFDE1940000-0x00007FFDE1E2C000-memory.dmp
        Download

        memory/5928-526-0x00007FFDE13F0000-0x00007FFDE1931000-memory.dmp
        Download

        memory/5928-527-0x00007FFDE0AC0000-0x00007FFDE0D25000-memory.dmp
        Download