Overview

overview

7

Static

static

3

2026-08-19...om.exe

windows10-2004-x64

7

2026-08-19...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/08/2026, 01:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-19_5706fec4e43d2eaf929d14d3b1480099_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
  • Size 11.6MB
  • Sample260819-b8dwssce57
  • SHA256 8037547886d9e8435e994f5983964298c97bdf94b0db852550aca362e68875eb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 37 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-19_5706fec4e43d2eaf929d14d3b1480099_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-19_5706fec4e43d2eaf929d14d3b1480099_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:408
    • C:\Users\Admin\AppData\Local\Temp\2026-08-19_5706fec4e43d2eaf929d14d3b1480099_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-19_5706fec4e43d2eaf929d14d3b1480099_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      PID:4432

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _Salsa20.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\Crypto\Cipher\_Salsa20.pyd
        • Size 24KB
        • SHA256 433310a5fdc3df5f19f905237751156001c69d7805789d6178c6acbb31e90105
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_cbc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\Crypto\Cipher\_raw_cbc.pyd
        • Size 22KB
        • SHA256 cb3ce4f65c9e18be6cbb504d79b594b51f38916e390dad73de4177fe88ce9c37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_cfb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\Crypto\Cipher\_raw_cfb.pyd
        • Size 23KB
        • SHA256 6ca8711c8095bbc475d84f81fc8dfff7cd722ffe98e0c5430631ae067913a11f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_ctr.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\Crypto\Cipher\_raw_ctr.pyd
        • Size 25KB
        • SHA256 ddf0b165c1c4eff98c4ac11e08c7beadcdd8cc76f495980a21df85ba4368762a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_ecb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\Crypto\Cipher\_raw_ecb.pyd
        • Size 21KB
        • SHA256 55cf117455aa2059367d89e508f5e2ad459545f38d01e8e7b7b0484897408980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_ocb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\Crypto\Cipher\_raw_ocb.pyd
        • Size 28KB
        • SHA256 2b4c6f82c9406c7763a0a064e99e5cbcfff8d71c3b6c9be28009341de3b98eb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_ofb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\Crypto\Cipher\_raw_ofb.pyd
        • Size 22KB
        • SHA256 cdff737d7239fe4f39d76683d931c970a8550c27c3f7162574f2573aee755952
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _BLAKE2s.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\Crypto\Hash\_BLAKE2s.pyd
        • Size 24KB
        • SHA256 7e4b78275516aa6bdea350940df89c0c94fd0ee70ab3f6a9bac6550783a96cad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _MD5.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\Crypto\Hash\_MD5.pyd
        • Size 25KB
        • SHA256 867d830e7c3699df4fa42b0791c0eb6ab7bba0b984549c374851bf5cf4981669
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _SHA1.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\Crypto\Hash\_SHA1.pyd
        • Size 28KB
        • SHA256 43d2b19a5bf18232ec7b182dd251c3e0dfda9a8951f849916f9a31143eacad73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _SHA256.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\Crypto\Hash\_SHA256.pyd
        • Size 32KB
        • SHA256 447e3da0363159eb7d6b309a780dd5af66c3ee274f4b24feccda14e65c397a09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ghash_clmul.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\Crypto\Hash\_ghash_clmul.pyd
        • Size 23KB
        • SHA256 7db2d4b4493bc364f59bb0704b1607578a82ea177889872ab6c22206bfc5b105
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ghash_portable.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\Crypto\Hash\_ghash_portable.pyd
        • Size 23KB
        • SHA256 0cff345186087ef40d384d656d9f0635098b3f934da6115a39bdc6b607fb483b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _scrypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\Crypto\Protocol\_scrypt.pyd
        • Size 22KB
        • SHA256 0550731cf26fcfca74f7e56fadcbe83589d9c894b0136984ed89bdcbfcd9e22c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cpuid_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\Crypto\Util\_cpuid_c.pyd
        • Size 21KB
        • SHA256 1105d31ba776f1421cef3b58fe54e00cff1c71cc041038b36ed342f884616a37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _strxor.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\Crypto\Util\_strxor.pyd
        • Size 21KB
        • SHA256 ee59933eba41bca29b66af9421ba53ffc90223ac88ccd35056503af52a2813fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\_bz2.pyd
        • Size 84KB
        • SHA256 65f610646d10d5babea080e060d244b546ec52c54012e5e937dc72dcc2e2e7bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\_cffi_backend.pyd
        • Size 177KB
        • SHA256 53de34afc3939d81bf2498b77425c52e2c3f3164f8cfe2543d3acc8f24134488
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\_ctypes.pyd
        • Size 124KB
        • SHA256 0e56107a891100535f2da79d85a5ae65ff1227b4765bd108f8593ac1a1110d81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\_hashlib.pyd
        • Size 67KB
        • SHA256 03d233dbace599168eaffec823de6ed7beec8c2a4ebfe9b8a3d8e042a59af3ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\_lzma.pyd
        • Size 157KB
        • SHA256 e3deecc1f59a3b811c608861decd84de1e8df8bafd5e2b39188861318c5a38cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\_queue.pyd
        • Size 32KB
        • SHA256 48e76e0ad63f6932b4a77b5819f41c1e7595636ca8d9e824f0943a14b8bb5035
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\_socket.pyd
        • Size 83KB
        • SHA256 3efa4636cf9e350856f6927d67a4c2564bf9bd2758a00bbf17d3aece5b60016d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\_ssl.pyd
        • Size 175KB
        • SHA256 0bc527d2dbc50009f43b2ed5d5982c4f63f4b647647ffa9eda612dcda80f6040
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_token_stealer.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\chrome_token_stealer.dll
        • Size 17.2MB
        • SHA256 3d1eaadc209f791e19a9a60ba14e436cef7e92951314c0cf5703544013d47450
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\libssl-3.dll
        • Size 776KB
        • SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\python312.dll
        • Size 6.6MB
        • SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\select.pyd
        • Size 32KB
        • SHA256 d4d7181b11db0bd22a6cd5cda6f8583d1f5c77615fd0a6ca33350619d6e0438a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_408_562900_Yi_DyavgdA0\unicodedata.pyd
        • Size 1.1MB
        • SHA256 208ee1cd3cbad0828433ca7246b05be2b1ff5569983d27d296c0b38888585488
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download