Overview

overview

7

Static

static

3

2026-08-17...ar.exe

windows10-2004-x64

7

2026-08-17...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/08/2026, 00:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-17_4a0a61995206e365a0e9675998cbc8fb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 16.7MB
  • Sample260818-as6ffasfre
  • SHA256 c2969e36e09a860e9de5b4cb1562712efad37cae6d6fe1c295eb009934b7e232
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Loads dropped DLL 38 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_4a0a61995206e365a0e9675998cbc8fb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_4a0a61995206e365a0e9675998cbc8fb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4992
    • C:\Users\Admin\AppData\Local\Temp\2026-08-17_4a0a61995206e365a0e9675998cbc8fb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-17_4a0a61995206e365a0e9675998cbc8fb_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1172
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2704
        • C:\Windows\System32\wbem\WMIC.exe
          C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5748
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        PID:5732
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:5608

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\VCRUNTIME140.dll
          • Size 117KB
          • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_asyncio.pyd
          • Size 70KB
          • SHA256 8cef0cd8333f88a9f9e52fa0d151b5f661d452efbcfc507dc28a46259b82596c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_bz2.pyd
          • Size 84KB
          • SHA256 5ba872caa7fcee0f4fb81c6e0201ceed9bd92a3624f16828dd316144d292a869
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cffi_backend.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_cffi_backend.cp313-win_amd64.pyd
          • Size 175KB
          • SHA256 0e3d149b91fc7dc3367ab94620a5e13af6e419f423b31d4800c381468cb8ad85
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_ctypes.pyd
          • Size 131KB
          • SHA256 199cd8d7db743c316771ef7bbf414ba9a9cdae1f974e90da6103563b2023538d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_hashlib.pyd
          • Size 63KB
          • SHA256 14765e83996fe6d50aedc11bb41d7c427a3e846a6a6293a4a46f7ea7e3f14148
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_lzma.pyd
          • Size 155KB
          • SHA256 6f48e7eba363cb67f3465a6c91b5872454b44fc30b82710dfa4a4489270ce95c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_overlapped.pyd
          • Size 56KB
          • SHA256 9ef177db14cfa3aa66193078c431a96b6ae70858e9dd774b3d3e3cb6e39d10a3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_queue.pyd
          • Size 33KB
          • SHA256 e4956834df819c1758d17c1c42a152306f7c0ea7b457ca24ce2f6466a6cb1caa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_socket.pyd
          • Size 82KB
          • SHA256 8daefaff53e6956f5aea5279a7c71f17d8c63e2b0d54031c3b9e82fcb0fb84db
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_ssl.pyd
          • Size 178KB
          • SHA256 21ca71b2c1766fc68734cb3d1e7c2c0439b86bcfb95e00b367c5fd48c59e617c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_uuid.pyd
          • Size 27KB
          • SHA256 99e97e0af615f43150778aaa44d82bc58b70bf595a8412cfafcc5d38be38bdfb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _wmi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\_wmi.pyd
          • Size 39KB
          • SHA256 ab87fe4b0cf5b2b17901905ea86367b9756c44845eb463e77435648f0f719354
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\base_library.zip
          • Size 1.3MB
          • SHA256 cd6b783cfc7c1bddba1538689fd4c6e0a78ad59e78a477bf564607fae7943497
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cacert.pem
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\certifi\cacert.pem
          • Size 290KB
          • SHA256 c55b21f907f7f86d48add093552fb5651749ff5f860508ccbb423d6c1fbd80c7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          md.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\charset_normalizer\md.cp313-win_amd64.pyd
          • Size 10KB
          • SHA256 1f8a5173d8bfe6c569e81c738b830800307ed4586d2ae9ac5cc13a468c6e1892
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          md__mypyc.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
          • Size 122KB
          • SHA256 437ceb75e7bc7c72c9090558397ef3598b0bc7bc499434af5827028083d300ca
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _rust.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\cryptography\hazmat\bindings\_rust.pyd
          • Size 7.9MB
          • SHA256 e25fa336e695553ac4afa83ede76094d03dc519061b56abbf6b1b5f98e721581
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\libcrypto-3.dll
          • Size 5.0MB
          • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\libssl-3.dll
          • Size 774KB
          • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multidict.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\multidict\_multidict.cp313-win_amd64.pyd
          • Size 46KB
          • SHA256 c7f0521b9df3b895151ca4565ffb83dac2a462b683ee44027c973296a9b8b57e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _psutil_windows.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\psutil\_psutil_windows.pyd
          • Size 65KB
          • SHA256 9c7fc855d9d1614e70705c7dcc6f4ac3cdcab5adfeb6a67d382f5ade09eadc15
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\pyexpat.pyd
          • Size 197KB
          • SHA256 b93e6083eb06137cc9191dac0d9cf4483e47192113d3ac2228b4549f737bac85
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\python3.DLL
          • Size 70KB
          • SHA256 4f93342b59addedbe45ebd973e6449ab85b11c0aab6ad7962124e293c5d03638
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python313.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\python313.dll
          • Size 5.8MB
          • SHA256 bf68cf819a1e865170430c10e91c18b427aef88db1da1742020443864aa2b749
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pywintypes313.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\pywin32_system32\pywintypes313.dll
          • Size 133KB
          • SHA256 90ba935a0145ee9ae56267a365cc0088d34fa506b7afeb2bd1bd78cd33359605
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\select.pyd
          • Size 31KB
          • SHA256 baee284995b22d495fd12fa8378077e470978db1522c61bfb9af37fb827f33d1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Lorem ipsum.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
          • Size 1KB
          • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\unicodedata.pyd
          • Size 694KB
          • SHA256 a67eec238162fde20ac24ca7df931792734aad0611be22d1b3a71bc15acf72f3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32api.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\win32\win32api.pyd
          • Size 130KB
          • SHA256 b1b1bb33af9cc14749936b1f6bac36b2ffc494ec1a5fb8b12fc9180a6454f545
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _quoting_c.cp313-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI49922\yarl\_quoting_c.cp313-win_amd64.pyd
          • Size 94KB
          • SHA256 1ddb9fc16b1afbb73e1415054dd13e187369b1d456ddcd31bd88bbd3e5006c3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1172-136-0x000001BEC9860000-0x000001BEC9861000-memory.dmp
          Download