Overview

overview

8

Static

static

3

2026-08-13...ar.exe

windows10-2004-x64

8

2026-08-13...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 03:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_ad9417147f4394a3123ced9150f82e68_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 14.4MB
  • Sample260813-ef91ba1dpf
  • SHA256 9451ea3fd20a814147ac17147c28a917b3c3fcf55263debc96995220c1937602
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
command_and_controldiscoverylateral_movement

Malware Config

Signatures

  • Outbound SSH connection to private host 3 TTPs 1 IoCs

    SSH is used for remote access. Internal traffic may indicate local host discovery or lateral movement.

    command_and_controllateral_movement
  • Loads dropped DLL 27 IoCs
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Network Service Discovery 1 TTPs 1 IoCs

    Attempt to gather information on host's network.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_ad9417147f4394a3123ced9150f82e68_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_ad9417147f4394a3123ced9150f82e68_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2448
    • C:\Users\Admin\AppData\Local\Temp\2026-08-13_ad9417147f4394a3123ced9150f82e68_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-13_ad9417147f4394a3123ced9150f82e68_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Outbound SSH connection to private host
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4064
      • C:\Windows\SYSTEM32\arp.exe
        arp -a
        3⤵
        • Network Service Discovery
        PID:3820
      • C:\Windows\SYSTEM32\notepad.exe
        notepad.exe
        3⤵
          PID:964

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\VCRUNTIME140.dll
          • Size 116KB
          • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _brotli.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\_brotli.cp312-win_amd64.pyd
          • Size 802KB
          • SHA256 788acbfd0edd6ca3ef3e97a9487eeaea86515642c71cb11bbcf25721e6573ec8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\_bz2.pyd
          • Size 83KB
          • SHA256 cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\_ctypes.pyd
          • Size 122KB
          • SHA256 6c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _elementtree.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\_elementtree.pyd
          • Size 130KB
          • SHA256 798e8ddfc45495c26593a0550554e32a62cbdd9da5556e25da7231a0bf8fd274
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\_hashlib.pyd
          • Size 64KB
          • SHA256 43acecdc00dd5f9a19b48ff251106c63c975c732b9a2a7b91714642f76be074d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\_lzma.pyd
          • Size 156KB
          • SHA256 a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\_queue.pyd
          • Size 31KB
          • SHA256 0a6acfd24dfbaa777460c6d003f71af473d5415607807973a382512f77d075fa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\_socket.pyd
          • Size 81KB
          • SHA256 67aca001d36f2fce6d88dbf46863f60c0b291395b6777c22b642198f98184ba3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\_ssl.pyd
          • Size 174KB
          • SHA256 fa5e6fe9545f83704f78316e27446a0026fbebb9c0c3c63faed73a12d89784d4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _wmi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\_wmi.pyd
          • Size 36KB
          • SHA256 73b7ee3156ef63d6eb7df9900ef3d200a276df61a70d08bd96f5906c39a3ac32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\base_library.zip
          • Size 1.3MB
          • SHA256 9b7c66de984130027b738ffb19da649897af7cfbdf61262f2ce356916d39ac83
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cacert.pem
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\certifi\cacert.pem
          • Size 292KB
          • SHA256 94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          md.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\charset_normalizer\md.cp312-win_amd64.pyd
          • Size 10KB
          • SHA256 611e1b4b9ed6788640f550771744d83e404432830bb8e3063f0b8ec3b98911af
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          md__mypyc.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\charset_normalizer\md__mypyc.cp312-win_amd64.pyd
          • Size 122KB
          • SHA256 c6bb8cad80b8d7847c52931f11d73ba64f78615218398b2c058f9b218ff21ca9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\libcrypto-3.dll
          • Size 5.0MB
          • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\libssl-3.dll
          • Size 774KB
          • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _psutil_windows.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\psutil\_psutil_windows.pyd
          • Size 69KB
          • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyarmor_runtime.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\pyarmor_runtime_000000\pyarmor_runtime.pyd
          • Size 624KB
          • SHA256 a10c83e9c3f1db9ab3540a1284299f54d51ce3c0266f664a706f7d41e5aa770a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\pyexpat.pyd
          • Size 197KB
          • SHA256 d32d7722d6ed2b2780c039d63af044554c0ba9cf6e6efef28ebc79cb443d2da0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\python3.DLL
          • Size 66KB
          • SHA256 25a39e721c26e53bec292395d093211bba70465280acfa2059fa52957ec975b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python312.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\python312.dll
          • Size 6.6MB
          • SHA256 c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\select.pyd
          • Size 30KB
          • SHA256 00bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ucrtbase.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\ucrtbase.dll
          • Size 977KB
          • SHA256 d804ea40eacfc22a5e029b66d6d4f83d81f76a7ead80313b33839253f90af6b7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24482\unicodedata.pyd
          • Size 1.1MB
          • SHA256 bf669344d1b1c607d10304be47d2a2fb572e043109181e2c5c1038485af0c3d7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/4064-133-0x00000000648C0000-0x000000006496B000-memory.dmp
          Download