Overview

overview

9

Static

static

3

2026-08-22...om.exe

windows10-2004-x64

9

2026-08-22...om.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 04:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-22_98d49baa9641910a5349ac2b98641324_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 28.5MB
  • Sample260823-ex46dssfma
  • SHA256 199bf679a4f3d3a85bc3b15ac70a3d47df79a3dcba174cf2a91fdb532b6c2f22
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
credential_accessdiscoverypersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • OS Credential Dumping: Security Account Manager 1 TTPs 2 IoCs

    Malicious Registry Hive Dumping.

    credential_access
  • Loads dropped DLL 22 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-22_98d49baa9641910a5349ac2b98641324_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-22_98d49baa9641910a5349ac2b98641324_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5956
    • C:\Users\Admin\AppData\Local\Temp\2026-08-22_98d49baa9641910a5349ac2b98641324_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-22_98d49baa9641910a5349ac2b98641324_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4728
      • C:\Windows\SYSTEM32\reg.exe
        reg save HKLM\SAM C:\Users\Admin\AppData\Local\Temp\SAM.save /y
        3⤵
        • OS Credential Dumping: Security Account Manager
        • Suspicious use of AdjustPrivilegeToken
        PID:2708
      • C:\Windows\SYSTEM32\reg.exe
        reg save HKLM\SECURITY C:\Users\Admin\AppData\Local\Temp\SECURITY.save /y
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2448
      • C:\Windows\SYSTEM32\reg.exe
        reg save HKLM\SYSTEM C:\Users\Admin\AppData\Local\Temp\SYSTEM.save /y
        3⤵
        • OS Credential Dumping: Security Account Manager
        • Suspicious use of AdjustPrivilegeToken
        PID:3440
      • C:\Windows\SYSTEM32\netsh.exe
        netsh wlan show profiles
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Network Configuration Discovery: Wi-Fi Discovery
        PID:1332

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _imaging.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\PIL\_imaging.cp313-win_amd64.pyd
        • Size 2.4MB
        • SHA256 010808cd1eb564aeaee8ba65ab2e20ae07f9bd9cbab8dba1d88931bc6842de0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imagingmath.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\PIL\_imagingmath.cp313-win_amd64.pyd
        • Size 24KB
        • SHA256 40316ab828ad316f653209d7ce3e0d97ebb036cbb39e57f613175be1e61dbd6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\_bz2.pyd
        • Size 82KB
        • SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\_ctypes.pyd
        • Size 128KB
        • SHA256 f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\_hashlib.pyd
        • Size 62KB
        • SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\_lzma.pyd
        • Size 154KB
        • SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\_queue.pyd
        • Size 32KB
        • SHA256 b9cf502dadcb124f693bf69ecd7077971e37174104dbda563022d74961a67e1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\_socket.pyd
        • Size 81KB
        • SHA256 35246b04c6c7001ca448554246445a845ce116814a29b18b617ea38752e4659b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\_sqlite3.pyd
        • Size 125KB
        • SHA256 3e625978d7c55f4b609086a872177c4207fb483c7715e2204937299531394f4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\_ssl.pyd
        • Size 177KB
        • SHA256 63ae2fefbfbbbc6ea39cde0a622579d46ff55134bc8c1380289a2976b61f603e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\_wmi.pyd
        • Size 37KB
        • SHA256 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\base_library.zip
        • Size 1.3MB
        • SHA256 e00ce1d08607868863c0516d8b500f8d1c0b3030d892dd551e5874336a05198b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        entry_points.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\numpy-2.5.1.dist-info\entry_points.txt
        • Size 220B
        • SHA256 ec26fade0c8bdac211a6c1dd003a65eb16885b925395423e93fcaa115af4052c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LICENSE.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\numpy-2.5.1.dist-info\licenses\LICENSE.txt
        • Size 44KB
        • SHA256 a804dff0ead9fadc5293456410bcbfc32bf024be9c4513459663fb7b442d2341
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LICENSE.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\numpy-2.5.1.dist-info\licenses\numpy\_core\include\numpy\libdivide\LICENSE.txt
        • Size 1KB
        • SHA256 d544761558b510866c21f7e8a2d5716fca76e0b98117e3b6b86314db7244d150
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dragon4_LICENSE.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\numpy-2.5.1.dist-info\licenses\numpy\_core\src\multiarray\dragon4_LICENSE.txt
        • Size 1KB
        • SHA256 b0fd592d4ead563148e3977e7b589169d46a5ef2ff133c755a81af880a3fc919
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        LICENSE.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\numpy-2.5.1.dist-info\licenses\numpy\linalg\lapack_lite\LICENSE.txt
        • Size 2KB
        • SHA256 19060ef465e1797d682ee0fc3081bd25ab1395e995e43d25c9d13c95d9a3cd6b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\python3.DLL
        • Size 68KB
        • SHA256 a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\python313.dll
        • Size 5.8MB
        • SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\select.pyd
        • Size 30KB
        • SHA256 78e5994c29d8851f28b5b12d59d742d876683aea58eceea1fb895b2036cdcdeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\sqlite3.dll
        • Size 1.5MB
        • SHA256 66771fbd64e2d3b8514dd0cd319a04ca86ce2926a70f7482ddec64049e21be38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI59562\unicodedata.pyd
        • Size 693KB
        • SHA256 2693c7ee4fba55dc548f641c0cb94485d0e18596ffef16541bd43a5104c28b20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download