Overview

overview

10

Static

static

3

2026-08-17...om.exe

windows10-2004-x64

10

2026-08-17...om.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 16:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-17_18dcb18cddd92bcdf7a7b37c12d81396_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 24.0MB
  • Sample260817-tr3spsek7x
  • SHA256 6d4b33119747d65ee9f013124b48b01c436a976d25bbb02cf2fb25bb00ca6745
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
darksiderattrojan

Malware Config

Signatures

  • Family: DarkSideRAT

    DarkSideRAT is a remote access trojan.

    trojandarksiderat
  • Detects DarkSideRAT 3 IoCs
  • Loads dropped DLL 26 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_18dcb18cddd92bcdf7a7b37c12d81396_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_18dcb18cddd92bcdf7a7b37c12d81396_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Users\Admin\AppData\Local\Temp\2026-08-17_18dcb18cddd92bcdf7a7b37c12d81396_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-17_18dcb18cddd92bcdf7a7b37c12d81396_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
        PID:3332
      • C:\Users\Admin\AppData\Local\Temp\2026-08-17_18dcb18cddd92bcdf7a7b37c12d81396_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-17_18dcb18cddd92bcdf7a7b37c12d81396_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:5548
        • C:\Users\Admin\AppData\Local\Temp\2026-08-17_18dcb18cddd92bcdf7a7b37c12d81396_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-08-17_18dcb18cddd92bcdf7a7b37c12d81396_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
          3⤵
            PID:3036

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\VCRUNTIME140.dll
            • Size 174KB
            • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\VCRUNTIME140_1.dll
            • Size 48KB
            • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\_bz2.pyd
            • Size 86KB
            • SHA256 b938073c85cf6b9fe80556d7899ed1901e5e60b7adea2832442376239fb36b36
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\_ctypes.pyd
            • Size 139KB
            • SHA256 408cc4e7a22ffa418ca52f5e13fe9268a3c50a2bc9de02b0530b555ef591bc5a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\_hashlib.pyd
            • Size 67KB
            • SHA256 5933ef5eda7c0bca0b3874a6e2c5f13b91b8f2cfc29bc46160df3212a1dbee79
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\_lzma.pyd
            • Size 157KB
            • SHA256 d2abf8db7fb0cf6285663b177991691a41b37e215c3d71fd087a98d8ec1bee63
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _queue.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\_queue.pyd
            • Size 35KB
            • SHA256 2fd8668f52b34d0e71ae48784bd2e7d35e5d99df6f641edb0fc279235a187c8e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\_socket.pyd
            • Size 85KB
            • SHA256 02265dd0d0287f3ffd287ea5d8e3c918a5a056e8ef2c4529857f5e84ec9e2519
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\_ssl.pyd
            • Size 186KB
            • SHA256 4cfb154c7cc525d57020c0e64f2dd876a78b46cd38419446392478de6b7b13b8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _tkinter.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\_tkinter.pyd
            • Size 69KB
            • SHA256 ee3eb2cdac591821cf71cda8035a6bc9b148d92996dd45b24e3ae3715613315d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _uuid.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\_uuid.pyd
            • Size 27KB
            • SHA256 fbfd7fe8583b346ba20b174b2510c0830237f5092bdf9fc26da9d6b25b018385
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _wmi.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\_wmi.pyd
            • Size 39KB
            • SHA256 b6fd41f079da0c0054829855360e88b8b762f5c42bb474c2fa02eae367839ad2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _zstd.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\_zstd.pyd
            • Size 491KB
            • SHA256 33c6eca99470c3eb9d776b617c550ad41b002a668336f062a9ab7be677a7409a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\base_library.zip
            • Size 1.3MB
            • SHA256 f7449efe02305c6a7afbb1f8a1a552d697a216ce4110185adb3bb7885f77b317
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cd.cp314-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\charset_normalizer\cd.cp314-win_amd64.pyd
            • Size 116KB
            • SHA256 2b13c97ad1682cb3d01ed156b3ff57ce5abdba6f500a93da85ac86b3afdf3a51
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            md.cp314-win_amd64.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\charset_normalizer\md.cp314-win_amd64.pyd
            • Size 195KB
            • SHA256 64192ffea885e9cbeb799499b38d821ea5858b0c3631673fbfccdce39880947e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            gui.py
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\gui.py
            • Size 19KB
            • SHA256 191b32c272da6e6973b708fa22e33106c3da68bd7615aafe64250042152ce642
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\libcrypto-3.dll
            • Size 6.0MB
            • SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\libssl-3.dll
            • Size 1.3MB
            • SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libtommath.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\libtommath.dll
            • Size 93KB
            • SHA256 bf18448a56de62e56adb5a50040c08648f0bcf556217de90eca283490ee8c0c3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python314.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\python314.dll
            • Size 6.5MB
            • SHA256 0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            select.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\select.pyd
            • Size 32KB
            • SHA256 722328e7fad8048057fc966474ba73966d2ceebaa32e7344cce09640ab4dc9bd
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Lorem ipsum.txt
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
            • Size 1KB
            • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tcl90.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\tcl90.dll
            • Size 3.2MB
            • SHA256 ecf6c76a725d082a0f00c5940d39a5a71087d0e9d166eaa07d1d6b122a195020
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tcl9tk90.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\tcl9tk90.dll
            • Size 2.1MB
            • SHA256 6e81d58860701540042b8168af929c54437b3f4143bf1b8f6114e56c3b9a8df0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ucrtbase.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\ucrtbase.dll
            • Size 1.1MB
            • SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            unicodedata.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\unicodedata.pyd
            • Size 741KB
            • SHA256 280b09bd97b598d18c0ed9542dc18ed35fa57a16e84f8e65fd9c6e96516c28d6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            zlib1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI17162\zlib1.dll
            • Size 114KB
            • SHA256 6bc87ac126b343f794ff14254d2cb6fbfbeef5476c0272e7297c5b4e8acfc353
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1716-45-0x0000000140000000-0x0000000141811000-memory.dmp
            Download

            memory/1716-201-0x0000000140000000-0x0000000141811000-memory.dmp
            Download

            memory/1716-204-0x0000000140000000-0x0000000141811000-memory.dmp
            Download

            memory/3036-153-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/3332-8-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/3332-9-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/5548-202-0x0000000140000000-0x0000000141811000-memory.dmp
            Download

            memory/5548-203-0x0000000140000000-0x0000000141811000-memory.dmp
            Download

            memory/5548-148-0x0000000140000000-0x0000000141811000-memory.dmp
            Download