Overview

overview

7

Static

static

3

2026-08-18...ar.exe

windows10-2004-x64

7

2026-08-18...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/08/2026, 14:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-18_fd7f4d95ab6b796e3d3308cf3f89729a_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 22.4MB
  • Sample260818-rntdratelb
  • SHA256 82159742ce09ee6234414540161459d321a2d81eac2444773a3ec1b45ae91c33
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionspywarestealer

Malware Config

Signatures

  • Loads dropped DLL 62 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-18_fd7f4d95ab6b796e3d3308cf3f89729a_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-18_fd7f4d95ab6b796e3d3308cf3f89729a_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4296
    • C:\Users\Admin\AppData\Local\Temp\2026-08-18_fd7f4d95ab6b796e3d3308cf3f89729a_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-18_fd7f4d95ab6b796e3d3308cf3f89729a_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5824
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:6064
        • C:\Windows\System32\wbem\WMIC.exe
          C:\Windows\System32\wbem\WMIC.exe csproduct get uuid
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3352
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        PID:4552

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\_asyncio.pyd
        • Size 69KB
        • SHA256 23614fe3099f41b1384c771b1afdd30ac6768ad1cd5f4e8ca212b5761e52ab9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\_bz2.pyd
        • Size 82KB
        • SHA256 a52fa7bb81955b62a09fa80763e96856776481f2b2ab2c1a53aa21ab63dd550c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\_cffi_backend.cp313-win_amd64.pyd
        • Size 175KB
        • SHA256 0e3d149b91fc7dc3367ab94620a5e13af6e419f423b31d4800c381468cb8ad85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\_ctypes.pyd
        • Size 128KB
        • SHA256 a43966bc05cb4423953dd1a6981f1ae3b683ebb57700eb00c663530bd6191a9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\_hashlib.pyd
        • Size 62KB
        • SHA256 975403308d64c8db265bf83fdd59fc7b6f2bc70b5417a1cc08e22878a55d2ece
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\_lzma.pyd
        • Size 155KB
        • SHA256 8a876c7f740771df71033accf8899863102962adf38dd7a84494cdef5e8142a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\_overlapped.pyd
        • Size 54KB
        • SHA256 382675ad16403816a4d46e9d55ba3e6fdd708dd3d2c7deed88253423287f73c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\_queue.pyd
        • Size 32KB
        • SHA256 68b704d7ec8a63eb6c90d0793d730f2b7628178cbbbe286a0a79645ae22bf454
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\_socket.pyd
        • Size 81KB
        • SHA256 bf545f886e353fe14b88456f4f7174ef109a4149b5fa3d5044453a5b20c9aeef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\_ssl.pyd
        • Size 177KB
        • SHA256 32ac6a3f5db74a897804e8f896857d896bc93584efb19f845026b38249066c56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\_uuid.pyd
        • Size 25KB
        • SHA256 001736ba937b2d6c3940e29cf2179ed870f65b470be39e6955ff9df275d69863
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\_wmi.pyd
        • Size 36KB
        • SHA256 195ed20d802fd83fa000d3798cf4f042838ba52ba7b83b179278c2587e83a14c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\base_library.zip
        • Size 1.3MB
        • SHA256 743dbf858416f38d111b6eb447b427ffe623c9bdb82cb191818cf47f3fd2dd3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\certifi\cacert.pem
        • Size 290KB
        • SHA256 c55b21f907f7f86d48add093552fb5651749ff5f860508ccbb423d6c1fbd80c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\charset_normalizer\md.cp313-win_amd64.pyd
        • Size 10KB
        • SHA256 1f8a5173d8bfe6c569e81c738b830800307ed4586d2ae9ac5cc13a468c6e1892
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
        • Size 122KB
        • SHA256 437ceb75e7bc7c72c9090558397ef3598b0bc7bc499434af5827028083d300ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _rust.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\cryptography\hazmat\bindings\_rust.pyd
        • Size 7.9MB
        • SHA256 e25fa336e695553ac4afa83ede76094d03dc519061b56abbf6b1b5f98e721581
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multidict.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\multidict\_multidict.cp313-win_amd64.pyd
        • Size 46KB
        • SHA256 c7f0521b9df3b895151ca4565ffb83dac2a462b683ee44027c973296a9b8b57e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\psutil\_psutil_windows.pyd
        • Size 65KB
        • SHA256 9c7fc855d9d1614e70705c7dcc6f4ac3cdcab5adfeb6a67d382f5ade09eadc15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\pyexpat.pyd
        • Size 196KB
        • SHA256 2659dc19542f63d87c78d130dd3a94a6bd698acf1a53799718dbc469e3f78fb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\python3.dll
        • Size 68KB
        • SHA256 08186e24d2d5792fb77a83ab9442721e9a5120fe7471324ce050ea7adb1f76db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\python313.dll
        • Size 5.8MB
        • SHA256 dd23e04004d01dbf974f73de1f7ba83a848c546a72ae780455b34d25c36967e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\pywin32_system32\pywintypes313.dll
        • Size 133KB
        • SHA256 90ba935a0145ee9ae56267a365cc0088d34fa506b7afeb2bd1bd78cd33359605
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\select.pyd
        • Size 30KB
        • SHA256 3415d80ba3e02b483a60a76c6898fd69a8813abb92545babf55d2a72292d040c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        INSTALLER
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\setuptools\_vendor\wheel-0.45.1.dist-info\INSTALLER
        • Size 4B
        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
        • MD5 SHA1 SHA512
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\unicodedata.pyd
        • Size 693KB
        • SHA256 e876d9b63ead908a2773b1781fff6f46414515b0356436c7ea44c33596573caa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\win32\win32api.pyd
        • Size 130KB
        • SHA256 b1b1bb33af9cc14749936b1f6bac36b2ffc494ec1a5fb8b12fc9180a6454f545
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _quoting_c.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI42962\yarl\_quoting_c.cp313-win_amd64.pyd
        • Size 94KB
        • SHA256 1ddb9fc16b1afbb73e1415054dd13e187369b1d456ddcd31bd88bbd3e5006c3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5824-190-0x00000234BEF40000-0x00000234BEF41000-memory.dmp
        Download