Overview

overview

10

Static

static

10

2026-08-17...ar.exe

windows10-2004-x64

7

2026-08-17...ar.exe

windows11-ltsc_2024-x64

7

Resubmissions

17/08/2026, 07:13

260817-h2lfmavhkf10

17/08/2026, 04:47

260817-fewa7sem2w10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/08/2026, 04:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-17_4a418b4f343b1a87eb2eb8b8af23becf_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 18.8MB
  • Sample260817-fewa7sem2w
  • SHA256 b2364cfba9c307b6883669e3145246d0ae35431b4c1942ce2f6692707a6bcc06
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionspywarestealer

Malware Config

Signatures

  • Loads dropped DLL 58 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_4a418b4f343b1a87eb2eb8b8af23becf_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_4a418b4f343b1a87eb2eb8b8af23becf_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4348
    • C:\Users\Admin\AppData\Local\Temp\2026-08-17_4a418b4f343b1a87eb2eb8b8af23becf_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-17_4a418b4f343b1a87eb2eb8b8af23becf_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4792
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4556
        • C:\Windows\System32\wbem\WMIC.exe
          C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1036

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_asyncio.pyd
        • Size 70KB
        • SHA256 a5341a74bbec1ddc807c0236fcb6bfaceaf3b957eb69cdd9bca00657eb5e42b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_bz2.pyd
        • Size 83KB
        • SHA256 449058efc99fccb9e24d640084d845c78f3f86dd34c5c126cf69e523d6320d75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_cffi_backend.cp313-win_amd64.pyd
        • Size 175KB
        • SHA256 0e3d149b91fc7dc3367ab94620a5e13af6e419f423b31d4800c381468cb8ad85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_ctypes.pyd
        • Size 130KB
        • SHA256 5c0d5082fba1a2a3eb8d5e23073be25164c19f21304b09cecaab340dc7198815
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_decimal.pyd
        • Size 273KB
        • SHA256 4e27c06b84401039d10f800a0f06446b58508784ee366c7c8324d8fe9794e1a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_hashlib.pyd
        • Size 63KB
        • SHA256 52f29aebe9886e830dedc363cd64eb53b6830d84b26e14f1b6faa655a0900b5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_lzma.pyd
        • Size 155KB
        • SHA256 48f16b587c6faa44a9e073365b19599200b0f0a0ccb70121e76c2dac4ed53281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_multiprocessing.pyd
        • Size 37KB
        • SHA256 82253e2d6ec717b317e26ed7dd141aadaea6cb55a9d0fee022a67d52b404fd06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_overlapped.pyd
        • Size 55KB
        • SHA256 7983f811ccd9c99c6db34b653339605ea45eb384f5e88a8b23ccf9fa5f0170d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_queue.pyd
        • Size 34KB
        • SHA256 af8ac8ab8b39f53b5dc192fbf58ad704a709db34e69753b97b83d087202e3a36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_socket.pyd
        • Size 83KB
        • SHA256 bced17d6f081d81ea7cd92f1e071e38f8840e61ee0fe1524221b776bcfa78650
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_sqlite3.pyd
        • Size 126KB
        • SHA256 8cba8b163393162e4a689d44488410d43b1d1b0a907499d0f01dbccf9c4ac10e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_ssl.pyd
        • Size 177KB
        • SHA256 3301ff340d26495c95108199b67fdf3402742d13070af8b6bf4eb2e0c5e13781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_uuid.pyd
        • Size 26KB
        • SHA256 17c7856bda73348ca541d01ba4881e4b327b15fb3d2cb90a92ca2bf0e6c4bafe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_wmi.pyd
        • Size 38KB
        • SHA256 ebd252d21af9c84128fca04c994093a5bd6ee857f1581f06f4026fdd6a2c40e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\base_library.zip
        • Size 1.3MB
        • SHA256 8595f684fc78c38dadea5d8cdc5017263e7862954f3aadea92a60186ef067f88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\certifi\cacert.pem
        • Size 290KB
        • SHA256 c55b21f907f7f86d48add093552fb5651749ff5f860508ccbb423d6c1fbd80c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\charset_normalizer\md.cp313-win_amd64.pyd
        • Size 10KB
        • SHA256 1f8a5173d8bfe6c569e81c738b830800307ed4586d2ae9ac5cc13a468c6e1892
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
        • Size 122KB
        • SHA256 437ceb75e7bc7c72c9090558397ef3598b0bc7bc499434af5827028083d300ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\libssl-3.dll
        • Size 776KB
        • SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multidict.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\multidict\_multidict.cp313-win_amd64.pyd
        • Size 68KB
        • SHA256 0e92982b9b80c90ab773d501e9d129cee1a588281b40610779c2ab2fe719f355
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _helpers_c.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\propcache\_helpers_c.cp313-win_amd64.pyd
        • Size 71KB
        • SHA256 10fce012c8b327a5d309dfe800a2f6d1b027b75757b4b94163622237941dc32b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\pyexpat.pyd
        • Size 200KB
        • SHA256 554bbc65bfe8c19ba9bbd94f18977a8131109c6a4d64306778bd12250c2c5c56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\python3.DLL
        • Size 69KB
        • SHA256 fdd54b6c495e9278e73d68203fff0c300e416e704852908cf5b06666cffead51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\python313.dll
        • Size 5.8MB
        • SHA256 69fd86ea29370697c203f7e12830084f920f490766a8e3045af52c036a9ad529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\pywin32_system32\pywintypes313.dll
        • Size 133KB
        • SHA256 90ba935a0145ee9ae56267a365cc0088d34fa506b7afeb2bd1bd78cd33359605
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\select.pyd
        • Size 31KB
        • SHA256 6393121130a3e85d0f6562948024d8614c4c144b84ab102af711c638344d1599
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\sqlite3.dll
        • Size 1.5MB
        • SHA256 441363c5b15394ca4b117200800722d48042c04407d03aac0d1a0a967b7c68e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\unicodedata.pyd
        • Size 695KB
        • SHA256 071494856fdad0042964769aa2fb1de4ea95c2cfcbe27cc7132293c68d13d710
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\win32\win32api.pyd
        • Size 130KB
        • SHA256 b1b1bb33af9cc14749936b1f6bac36b2ffc494ec1a5fb8b12fc9180a6454f545
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _quoting_c.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\yarl\_quoting_c.cp313-win_amd64.pyd
        • Size 97KB
        • SHA256 904c6f2e3c58e7e42b6693c21266e436ec25015cd10540728bb55a6dbb5422f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4792-176-0x000002CDF7C50000-0x000002CDF7C51000-memory.dmp
        Download

        memory/4792-177-0x000002CDF7C50000-0x000002CDF7C51000-memory.dmp
        Download