Overview

overview

9

Static

static

3

2026-08-22...om.exe

windows10-2004-x64

9

2026-08-22...om.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 13:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-22_04e62d9510207b6dcbda1bec29dbf976_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
  • Size 11.5MB
  • Sample260823-qlqdmsgq6z
  • SHA256 e97c48ee81fccebdc59bf3348c4f53a700d277e3a40cdf142ca478323740f079
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
credential_accessexecutionpersistencespywarestealer

Malware Config

Signatures

  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Detects executables using Telegram Chat Bot 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a command shell one-liner 1 TTPs 12 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-22_04e62d9510207b6dcbda1bec29dbf976_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-22_04e62d9510207b6dcbda1bec29dbf976_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4932
    • C:\Users\Admin\AppData\Local\Temp\2026-08-22_04e62d9510207b6dcbda1bec29dbf976_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-22_04e62d9510207b6dcbda1bec29dbf976_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5792
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:5648
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:4592
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SysUpdate_1959" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-22_04e62d9510207b6dcbda1bec29dbf976_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe" /sc onlogon /delay 0001:00 /ru SYSTEM /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4572
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "SysUpdate_1959" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-22_04e62d9510207b6dcbda1bec29dbf976_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe" /sc onlogon /delay 0001:00 /ru SYSTEM /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:548
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemTemp\svchost.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemTemp\svchost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2788
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemTemp\svchost.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemTemp\svchost.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5652
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "ver"
            5⤵
            • Executes a command shell one-liner
            PID:952
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "ver"
            5⤵
            • Executes a command shell one-liner
            PID:2068
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SysUpdate_8069" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemTemp\svchost.exe" /sc onlogon /delay 0001:00 /ru SYSTEM /f"
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3264
            • C:\Windows\system32\schtasks.exe
              schtasks /create /tn "SysUpdate_8069" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemTemp\svchost.exe" /sc onlogon /delay 0001:00 /ru SYSTEM /f
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2196
  • C:\Users\Admin\AppData\Local\Temp\2026-08-22_04e62d9510207b6dcbda1bec29dbf976_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-22_04e62d9510207b6dcbda1bec29dbf976_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3300
    • C:\Users\Admin\AppData\Local\Temp\2026-08-22_04e62d9510207b6dcbda1bec29dbf976_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-22_04e62d9510207b6dcbda1bec29dbf976_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5620
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:5184
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:4676
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SysUpdate_5253" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-22_04e62d9510207b6dcbda1bec29dbf976_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe" /sc onlogon /delay 0001:00 /ru SYSTEM /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3436
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "SysUpdate_5253" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-22_04e62d9510207b6dcbda1bec29dbf976_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe" /sc onlogon /delay 0001:00 /ru SYSTEM /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:3288
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemTemp\svchost.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemTemp\svchost.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3840
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemTemp\svchost.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemTemp\svchost.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2128
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:4408
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:5644
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SysUpdate_9534" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemTemp\svchost.exe" /sc onlogon /delay 0001:00 /ru SYSTEM /f"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4412
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "SysUpdate_9534" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemTemp\svchost.exe" /sc onlogon /delay 0001:00 /ru SYSTEM /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1664

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        SystemInfo.txt
        • Path C:\Users\Admin\AppData\Local\Temp\memWARE_Admin\SystemInfo.txt
        • Size 113B
        • SHA256 8b50d82c82c2f389a5cf5cfb01ace09f155d81272ff8d85565e39361a5cedbd8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        euc-cn.enc
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3300_558228__j701c_1Otw\tcl\encoding\euc-cn.enc
        • Size 83KB
        • SHA256 546392237f47d71cee1daa1aae287d94d93216a1fabd648b50f59ddce7e8ae35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SystemHelper.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\SystemHelper.dll
        • Size 14.9MB
        • SHA256 865c3d334eedd5df9c210da0fde059b22decd3275541b078c3850ce1c792cf85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\VCRUNTIME140.dll
        • Size 94KB
        • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\_bz2.pyd
        • Size 78KB
        • SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\_ctypes.pyd
        • Size 117KB
        • SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\_hashlib.pyd
        • Size 57KB
        • SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\_lzma.pyd
        • Size 149KB
        • SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\_queue.pyd
        • Size 26KB
        • SHA256 9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\_socket.pyd
        • Size 72KB
        • SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\_sqlite3.pyd
        • Size 91KB
        • SHA256 728d21be4d47dd664caf9fa60c1369fe059bc0498edd383b27491d0dee23e439
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\_ssl.pyd
        • Size 152KB
        • SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\_uuid.pyd
        • Size 20KB
        • SHA256 c74aaeec487457139b47c0ab56e01922bfae6debef562800e5b9b6baf1ec9d6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\certifi\cacert.pem
        • Size 234KB
        • SHA256 9cc2a774b5198dcff14d9be1e66091f538975d867ce029a96bce15a55dfd730f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\charset_normalizer\cd.pyd
        • Size 111KB
        • SHA256 1bde9df22733f4bad955abaa50afd3f4522d32f8c3f3609b5354c3612329773f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\charset_normalizer\md.pyd
        • Size 194KB
        • SHA256 3d56c85d19c471e270005ff4069733e6957d885c49bd58b23ecbd3c711d024e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\libssl-1_1.dll
        • Size 678KB
        • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\psutil\_psutil_windows.pyd
        • Size 65KB
        • SHA256 e10b73d6e13a5ae2624630f3d8535c5091ef403db6a00a2798f30874938ee996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\python3.dll
        • Size 60KB
        • SHA256 8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\python310.dll
        • Size 4.2MB
        • SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\select.pyd
        • Size 25KB
        • SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\sqlite3.dll
        • Size 1.4MB
        • SHA256 831ba87cb1a91d4581f0abbcc4966c6f4b332536f70cf481f609c44cc3d987c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4932_856409_bGhEihR93b8\unicodedata.pyd
        • Size 1.1MB
        • SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        svchost.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SystemTemp\svchost.exe
        • Size 11.5MB
        • SHA256 e97c48ee81fccebdc59bf3348c4f53a700d277e3a40cdf142ca478323740f079
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download