Overview

overview

10

Static

static

3

2026-08-13...om.exe

windows10-2004-x64

10

2026-08-13...om.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 02:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_eb6a0ed7b8ac59c07d23885bca942389_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
  • Size 16.1MB
  • Sample260813-df88cayvht
  • SHA256 7c19fe94907ac48c2a914a93b00e3b4bf47876a3331d45c80ed305285a77dfe3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoverydarksiderattrojan

Malware Config

Signatures

  • Family: DarkSideRAT

    DarkSideRAT is a remote access trojan.

    trojandarksiderat
  • Detects DarkSideRAT 3 IoCs
  • Loads dropped DLL 23 IoCs
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_eb6a0ed7b8ac59c07d23885bca942389_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_eb6a0ed7b8ac59c07d23885bca942389_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Users\Admin\AppData\Local\Temp\2026-08-13_eb6a0ed7b8ac59c07d23885bca942389_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-13_eb6a0ed7b8ac59c07d23885bca942389_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe"
      2⤵
        PID:1184
      • C:\Users\Admin\AppData\Local\Temp\2026-08-13_eb6a0ed7b8ac59c07d23885bca942389_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-13_eb6a0ed7b8ac59c07d23885bca942389_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1828
        • C:\Users\Admin\AppData\Local\Temp\2026-08-13_eb6a0ed7b8ac59c07d23885bca942389_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-08-13_eb6a0ed7b8ac59c07d23885bca942389_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe"
          3⤵
            PID:5228
          • C:\Windows\SYSTEM32\tasklist.exe
            tasklist /fo csv /nh
            3⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:3748

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\_bz2.pyd
            • Size 85KB
            • SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _cffi_backend.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\_cffi_backend.pyd
            • Size 177KB
            • SHA256 2011ed3465ee2b732588c443c246f9c857288b8a0c59ea737100d230a5f8e346
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\_ctypes.pyd
            • Size 139KB
            • SHA256 25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\_hashlib.pyd
            • Size 67KB
            • SHA256 36ce760b9fac53fe51755f30a68d86f5fde89bf1b66c65c19e04aa3afa404ac2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\_lzma.pyd
            • Size 157KB
            • SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\_queue.pyd
            • Size 35KB
            • SHA256 bb53357b4e91ac23ed4061f15ff3e5e91a5b3be1cbb0c6cf294521ae5b4efa1c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\_socket.pyd
            • Size 85KB
            • SHA256 25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\_ssl.pyd
            • Size 186KB
            • SHA256 5c07572df2913618cfb851b608cb5f74d740fcce5c3f2e63dc0a2ba39ab35dad
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _uuid.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\_uuid.pyd
            • Size 27KB
            • SHA256 a09308efd309732e3745e70b4456235579c450cac32bed616dfb3913b56f6637
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _wmi.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\_wmi.pyd
            • Size 39KB
            • SHA256 0ab1fbcf18c95d70343012feb1aad61e1ba95aaed5b4a08e57fc5990e8a9a452
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _zstd.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\_zstd.pyd
            • Size 491KB
            • SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ada92cb5d92a588d1b93__mypyc.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\ada92cb5d92a588d1b93__mypyc.pyd
            • Size 218KB
            • SHA256 3048af5864e17f79410273b3074416d67473eae22b3d7d1b7b58f24a506f82ed
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cd.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\charset_normalizer\cd.pyd
            • Size 10KB
            • SHA256 032b490f6b42a0928b3cb6e17fd4caf8a6becaaf05739c4fe41267dcf890c278
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ClrLoader.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\clr_loader\ffi\dlls\amd64\ClrLoader.dll
            • Size 10KB
            • SHA256 07f62bcb1b70320f221ffb2cfc5ce6133815195f3e7cdb8d833222506188c2ac
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _rust.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\cryptography\hazmat\bindings\_rust.pyd
            • Size 9.5MB
            • SHA256 05fefb14b1cb1c90bcccce87e82d205f5f2396977bf911243972790ba2376849
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\libcrypto-3.dll
            • Size 6.0MB
            • SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\libssl-3.dll
            • Size 1.3MB
            • SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            main.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\main.dll
            • Size 28.0MB
            • SHA256 a4f5e4f0aac322e9d242070898b6b16c60f904cfa5e2ec81741aa81ca93047de
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\python3.dll
            • Size 72KB
            • SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python314.dll
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\python314.dll
            • Size 6.5MB
            • SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\select.pyd
            • Size 32KB
            • SHA256 fab1b4cee101359d82d72061b83cff1855337b3677b9fe01cd69f7548f4c496e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\onefile_1844_037235_P3WetfxfTkY\unicodedata.pyd
            • Size 741KB
            • SHA256 0d4f124b2d6622d276d777f7106972219f9b310edb5df8149c253da7c013d6d8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1184-1-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/1184-0-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/1828-83-0x0000000140000000-0x000000014102C000-memory.dmp
            Download

            memory/1828-142-0x0000000140000000-0x000000014102C000-memory.dmp
            Download

            memory/1844-2-0x0000000140000000-0x000000014102C000-memory.dmp
            Download

            memory/1844-199-0x0000000140000000-0x000000014102C000-memory.dmp
            Download

            memory/5228-89-0x0000000140000000-0x0000000140015000-memory.dmp
            Download