Overview

overview

7

Static

static

3

2026-08-23...ar.exe

windows10-2004-x64

7

2026-08-23...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/08/2026, 09:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-23_6d44d1710b5a79a41ea67ef251e45a9d_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 24.4MB
  • Sample260824-ldws8sem6v
  • SHA256 ef90160b67163251a5cf840df99fab3784945dd756cba5de61fa40acd4206d6f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 42 IoCs
  • Looks up external IP address via web service 1 TTPs 16 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_6d44d1710b5a79a41ea67ef251e45a9d_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_6d44d1710b5a79a41ea67ef251e45a9d_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Users\Admin\AppData\Local\Temp\2026-08-23_6d44d1710b5a79a41ea67ef251e45a9d_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-23_6d44d1710b5a79a41ea67ef251e45a9d_blankgrabber_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2192
      • C:\Windows\System32\Wbem\wmic.exe
        wmic process get description
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4888
      • C:\Windows\System32\Wbem\wmic.exe
        wmic process get description
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2832
      • C:\Windows\System32\Wbem\wmic.exe
        wmic process get description
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:716
      • C:\Windows\System32\Wbem\wmic.exe
        wmic process get description
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5592
      • C:\Windows\System32\Wbem\wmic.exe
        wmic process get description
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4340
      • C:\Windows\System32\Wbem\wmic.exe
        wmic process get description
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5076
      • C:\Windows\System32\Wbem\wmic.exe
        wmic process get description
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5472
      • C:\Windows\System32\Wbem\wmic.exe
        wmic process get description
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:1200
      • C:\Windows\System32\Wbem\wmic.exe
        wmic process get description
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2864
      • C:\Windows\System32\Wbem\wmic.exe
        wmic process get description
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:5112
      • C:\Windows\System32\Wbem\wmic.exe
        wmic process get description
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4608
      • C:\Windows\System32\Wbem\wmic.exe
        wmic process get description
        3⤵
          PID:2484
        • C:\Windows\System32\Wbem\wmic.exe
          wmic process get description
          3⤵
            PID:5996
          • C:\Windows\System32\Wbem\wmic.exe
            wmic process get description
            3⤵
              PID:2360
            • C:\Windows\System32\Wbem\wmic.exe
              wmic process get description
              3⤵
                PID:6048

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                VCRUNTIME140.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\VCRUNTIME140.dll
                • Size 117KB
                • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                VCRUNTIME140_1.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\VCRUNTIME140_1.dll
                • Size 48KB
                • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _asyncio.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\_asyncio.pyd
                • Size 71KB
                • SHA256 4c6d6690e91974804c1eaf77827ea63882711689baff0718a246796ff40b2a23
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _bz2.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\_bz2.pyd
                • Size 83KB
                • SHA256 55894b2b98d01f37b9a8cf4daf926d0161ff23c2fb31c56f9dbbac3a61932712
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _ctypes.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\_ctypes.pyd
                • Size 129KB
                • SHA256 5c4c489ac052795c27af063c96bc4db5ab250144d4839050cfa9bb3836b87c32
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _hashlib.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\_hashlib.pyd
                • Size 63KB
                • SHA256 78223aef72777efc93c739f5308a3fc5de28b7d10e6975b8947552a62592772b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _lzma.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\_lzma.pyd
                • Size 155KB
                • SHA256 e44dea262a24df69fd9b50b08d09ae6f8b051137ce0834640c977091a6f9fca8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _overlapped.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\_overlapped.pyd
                • Size 55KB
                • SHA256 c8a0e2c0d7f82cedb839d2c0b827cf139113faa4aba05f2345c80e2cf3335b8a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _queue.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\_queue.pyd
                • Size 34KB
                • SHA256 73cade82ee139459fe5841e5631274fc9caf7f579418b613f278125435653539
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _socket.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\_socket.pyd
                • Size 82KB
                • SHA256 62d0493ced6ca33e2fd8141649dd9889c23b2e9afc5fdf56edb4f888c88fb823
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _ssl.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\_ssl.pyd
                • Size 178KB
                • SHA256 e94f0195363c5c9babfc4c17ec6fb1aa8bbabf59e377db66ce6a79c4c58bbd07
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _wmi.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\_wmi.pyd
                • Size 39KB
                • SHA256 afad80f9e62a57814779cf3e48352b583c1a0697b11a23cc9db3f4e43f7f8664
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _http_parser.cp313-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\aiohttp\_http_parser.cp313-win_amd64.pyd
                • Size 257KB
                • SHA256 3caf323e12e71c66a554f827b02d16243e763e3f5aaa0732cb0070562e72278a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _http_writer.cp313-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\aiohttp\_http_writer.cp313-win_amd64.pyd
                • Size 47KB
                • SHA256 e28d7e152821255ae6c06d87c4e3f57d23ef220f5894b6fddd8a272a43e0581e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                mask.cp313-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\aiohttp\_websocket\mask.cp313-win_amd64.pyd
                • Size 34KB
                • SHA256 3edac8fc8446babbc6b958c658c8fe34dd5dfc4f4681ebeede445ac2d715b043
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                base_library.zip
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\base_library.zip
                • Size 1.3MB
                • SHA256 1a4dbbffdb5292d566ba43b7c0fc8f96d4ea3b7b0d68560e38280847fa27c0f6
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                cacert.pem
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\certifi\cacert.pem
                • Size 290KB
                • SHA256 c55b21f907f7f86d48add093552fb5651749ff5f860508ccbb423d6c1fbd80c7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                md.cp313-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\charset_normalizer\md.cp313-win_amd64.pyd
                • Size 10KB
                • SHA256 1f8a5173d8bfe6c569e81c738b830800307ed4586d2ae9ac5cc13a468c6e1892
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                md__mypyc.cp313-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
                • Size 122KB
                • SHA256 437ceb75e7bc7c72c9090558397ef3598b0bc7bc499434af5827028083d300ca
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libcrypto-3.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\libcrypto-3.dll
                • Size 5.0MB
                • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libffi-8.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\libffi-8.dll
                • Size 38KB
                • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                libssl-3.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\libssl-3.dll
                • Size 774KB
                • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _multidict.cp313-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\multidict\_multidict.cp313-win_amd64.pyd
                • Size 46KB
                • SHA256 9470add15fae0be67f79d2abe2e9eefe6b573cc2254b688565161b8e7561e6ab
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _helpers_c.cp313-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\propcache\_helpers_c.cp313-win_amd64.pyd
                • Size 71KB
                • SHA256 41b041dfdaddc024154ac1d3e1dd0d679e47e5eec979f459f62f395331339c36
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _psutil_windows.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\psutil\_psutil_windows.pyd
                • Size 65KB
                • SHA256 9c7fc855d9d1614e70705c7dcc6f4ac3cdcab5adfeb6a67d382f5ade09eadc15
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                INSTALLER
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\pycparser-2.22.dist-info\INSTALLER
                • Size 4B
                • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
                • MD5 SHA1 SHA512
                Submit Download

                pyexpat.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\pyexpat.pyd
                • Size 197KB
                • SHA256 3a4830342ab562e41ab93b4bc2dc45fe0ab760815e7c3ec4a7fddc914ec99982
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python3.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\python3.dll
                • Size 70KB
                • SHA256 c1de4bfe57dc4a5be8c72c865d617dc39dfd8162fcd2ce1fac9f401cf9efb504
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                python313.dll
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\python313.dll
                • Size 5.8MB
                • SHA256 78b1dd211c0e66a0603df48da2c9b67a915ab3258701b9285d3faa255ed8dc25
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                select.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\select.pyd
                • Size 31KB
                • SHA256 81f124b01a85882e362a42e94a13c0eff2f4ccd72d461821dc5457a789554413
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                METADATA
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\setuptools-75.8.2.dist-info\METADATA
                • Size 6KB
                • SHA256 428dad4cd3fd19bf348a93f43bffdc7bf60bc2442761bfcbdac636fd074840ab
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Lorem ipsum.txt
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                • Size 1KB
                • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                unicodedata.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\unicodedata.pyd
                • Size 695KB
                • SHA256 3f462ee6e7743a87e5791181936539642e3761c55de3de980a125f91fe21f123
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _quoting_c.cp313-win_amd64.pyd
                • Path C:\Users\Admin\AppData\Local\Temp\_MEI24002\yarl\_quoting_c.cp313-win_amd64.pyd
                • Size 94KB
                • SHA256 1ddb9fc16b1afbb73e1415054dd13e187369b1d456ddcd31bd88bbd3e5006c3e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                namespace_packages.txt
                • Path \??\c:\users\admin\appdata\local\temp\_mei24002\zope.event-5.0.dist-info\namespace_packages.txt
                • Size 5B
                • SHA256 429507be93b8c08b990de120298f2a642b43fad02e901d1f9ff7fabadce56fdf
                • MD5 SHA1 SHA512
                Submit Download

                memory/2192-1137-0x0000020667AC0000-0x0000020667C84000-memory.dmp
                Download