Overview

overview

7

Static

static

3

2026-08-11...om.exe

windows10-2004-x64

7

2026-08-11...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/08/2026, 03:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-11_6cfe58614716edc4beed7676ef2a5375_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 33.8MB
  • Sample260811-dj4r2acb44
  • SHA256 07b5cd73df7661dd4cd233ae3fbad042ea880fd6ac700817442a9cd13526e219
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-11_6cfe58614716edc4beed7676ef2a5375_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-11_6cfe58614716edc4beed7676ef2a5375_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5868
    • C:\Users\Admin\AppData\Local\Temp\2026-08-11_6cfe58614716edc4beed7676ef2a5375_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-11_6cfe58614716edc4beed7676ef2a5375_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4424
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\RuntimeBroker.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\RuntimeBroker.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4604
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\RuntimeBroker.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\RuntimeBroker.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Checks SCSI registry key(s)
          • Suspicious use of SetWindowsHookEx
          PID:4632
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\RuntimeBroker.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\RuntimeBroker.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:468
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\RuntimeBroker.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\System32\RuntimeBroker.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks SCSI registry key(s)
      • Suspicious use of SetWindowsHookEx
      PID:5932

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI46042\zlib1.dll
        • Size 106KB
        • SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2_image.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4682\pygame\SDL2_image.dll
        • Size 122KB
        • SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2_mixer.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4682\pygame\SDL2_mixer.dll
        • Size 285KB
        • SHA256 2a0fc5e9f72c2eaec3240cb82b7594a58ccda609485981f256b94d0a4dd8d6f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2_ttf.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4682\pygame\SDL2_ttf.dll
        • Size 1.5MB
        • SHA256 fcdfabdfce868eb33f7514025ff59c1bb6c418f1bcd6ace2300a9cd4053e1d63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        freetype.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4682\pygame\freetype.dll
        • Size 639KB
        • SHA256 1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libjpeg-9.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4682\pygame\libjpeg-9.dll
        • Size 238KB
        • SHA256 3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libogg-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4682\pygame\libogg-0.dll
        • Size 25KB
        • SHA256 57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libopus-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4682\pygame\libopus-0.dll
        • Size 359KB
        • SHA256 771cae79410f7fcc4f993a105a18c4ed9e8cbddd6f807a42228d95f575808806
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libpng16-16.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4682\pygame\libpng16-16.dll
        • Size 206KB
        • SHA256 e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imaging.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\PIL\_imaging.cp312-win_amd64.pyd
        • Size 2.5MB
        • SHA256 c8c519ec72bf75b2945b4fc4afa854af2fca8b970a403134f9ddda3e164d85e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\_bz2.pyd
        • Size 84KB
        • SHA256 0ec5bdf4c688c1d2bda00f61e1f9e1369188c1019173a5412981f6569a997347
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\_ctypes.pyd
        • Size 124KB
        • SHA256 ed4170b2c2c302639301a01c6aac4c5575e6e4c936edc803d3ba6c34444e35e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\_hashlib.pyd
        • Size 65KB
        • SHA256 dfacbb48ade3d53780ff1e6875da90930a4a5d593e21984779079bd6f98f3768
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\_lzma.pyd
        • Size 156KB
        • SHA256 ed997ca4956fe7e27cc702adaa8d31136312361d285b7b845c8829d8c5a89ae8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\_queue.pyd
        • Size 32KB
        • SHA256 eb4070d87384565985a59a7139e0903b120044059cb0934a9a425c360e93a34c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\_socket.pyd
        • Size 83KB
        • SHA256 961dc7c65a28c174688e2f6b7803a615b9c034849a17cfc6527a27ccb2eeadb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\_ssl.pyd
        • Size 174KB
        • SHA256 78728b5e06037e3adfe922b59bb1dd19dea391e9ca02e21caab3cdc832111036
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\_wmi.pyd
        • Size 38KB
        • SHA256 4f6361517b4e127642d4e641ddbfa060b3d32da8ac7fc7a35a51c02680933084
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ada92cb5d92a588d1b93__mypyc.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\ada92cb5d92a588d1b93__mypyc.cp312-win_amd64.pyd
        • Size 222KB
        • SHA256 df5ea1b515f4e6677196f3d8c2f40a00b008d8e09152d08425f794e1b55f890d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\base_library.zip
        • Size 1.3MB
        • SHA256 648417b645db18eeae47144dad5d4cd84a21dbb235d69bedb6f87107d0b5fe6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\charset_normalizer\cd.cp312-win_amd64.pyd
        • Size 10KB
        • SHA256 be1d8801c9785a52e5bc1b0c77ceca2c88041a5d9b9bac7162d767f712ea10e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\pygame\SDL2.dll
        • Size 2.4MB
        • SHA256 520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\pygame\base.cp312-win_amd64.pyd
        • Size 30KB
        • SHA256 59fd2c87c8261f8de69fb70f881b41a13e522119503ae18fc068d607b4754bfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bufferproxy.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\pygame\bufferproxy.cp312-win_amd64.pyd
        • Size 18KB
        • SHA256 7b1de4a711ac3b8c870a70d1b5db3a3684efd5ab258c4e1c42e715bd6e0a500c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        color.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\pygame\color.cp312-win_amd64.pyd
        • Size 35KB
        • SHA256 f1532048d8d89e0aff5a79f0dd96edaf7e75665c0292032c2b69a90374b4582a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        constants.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\pygame\constants.cp312-win_amd64.pyd
        • Size 49KB
        • SHA256 99ef70bf473e1241a433f33dc7ec89dff64c831999de68612f2e642fd4a1d5dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        display.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\pygame\display.cp312-win_amd64.pyd
        • Size 44KB
        • SHA256 6ce7e1f477c4aa614b1231b1a2ce345662bb36ed590157d48e219219f7459970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        math.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\pygame\math.cp312-win_amd64.pyd
        • Size 75KB
        • SHA256 515e2cf7344b6daedd464f567ca99978a47da14719b7f5a092c69a252b16c5f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rect.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\pygame\rect.cp312-win_amd64.pyd
        • Size 44KB
        • SHA256 38d709cb73a98dd54d666689212bfdddc2a68fcc4541c3b59a741815e4688b7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rwobject.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\pygame\rwobject.cp312-win_amd64.pyd
        • Size 19KB
        • SHA256 b658da9b9b207f73325b9e9b84029258e64e324b8935671ce79b49f28a26b87e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        surface.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\pygame\surface.cp312-win_amd64.pyd
        • Size 234KB
        • SHA256 bc64469279ac571f08173b2a09da78f1c0af3276e531fdf12ec3f9e9eca8fdde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        surflock.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\pygame\surflock.cp312-win_amd64.pyd
        • Size 13KB
        • SHA256 6c0c944037dc7a23e4ca6683d58085752453faf3be1e776a0ebd33f3d0fda8d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\python312.dll
        • Size 6.6MB
        • SHA256 b6227a506a9963e7c8182785a54e14a193af51f7b277a61dda04492b499f49ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\select.pyd
        • Size 32KB
        • SHA256 e6bff4f35ab49a84f9e5ccd4b26eff30e1b2d7adb67d91911c4b84bfabcc28b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\ucrtbase.dll
        • Size 1.3MB
        • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI58682\unicodedata.pyd
        • Size 1.1MB
        • SHA256 a443f6132d63a683ea3ef463cfe00987e0cf94d02c9e14350795f1a521d05f50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4424-234-0x00007FFF4ABF0000-0x00007FFF4AE5C000-memory.dmp
        Download

        memory/4632-575-0x00007FFF49DA0000-0x00007FFF4A00C000-memory.dmp
        Download

        memory/4632-577-0x00007FFF49DA0000-0x00007FFF4A00C000-memory.dmp
        Download

        memory/4632-585-0x00007FFF49DA0000-0x00007FFF4A00C000-memory.dmp
        Download

        memory/5932-576-0x00007FFF49B30000-0x00007FFF49D9C000-memory.dmp
        Download

        memory/5932-578-0x00007FFF49B30000-0x00007FFF49D9C000-memory.dmp
        Download