Overview

overview

7

Static

static

3

2026-08-27...om.exe

windows10-2004-x64

7

2026-08-27...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/08/2026, 09:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-27_bfc1e737aeb5de5d9bba388ae2a1b2f8_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
  • Size 47.0MB
  • Sample260827-la2kbasdmb
  • SHA256 d678f92f067da2a39ab28d123b62b7499588680bda4bc562479d4ea9312926b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 30 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-27_bfc1e737aeb5de5d9bba388ae2a1b2f8_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-27_bfc1e737aeb5de5d9bba388ae2a1b2f8_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4240
    • C:\Users\Admin\AppData\Local\Temp\2026-08-27_bfc1e737aeb5de5d9bba388ae2a1b2f8_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-27_bfc1e737aeb5de5d9bba388ae2a1b2f8_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2992

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\MSVCP140.dll
        • Size 628KB
        • SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imaging.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\PIL\_imaging.pyd
        • Size 2.5MB
        • SHA256 16452bdc0cd84bbc8e034319e67f776ddc9d23767e6c589d89a5c973738d5fb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qsvgicon.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\PyQt6\Qt6\plugins\iconengines\qsvgicon.dll
        • Size 70KB
        • SHA256 95466615e7c0ddb9097e05d3197c98b6774d1e20bbd8e68bae03a82463a57deb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qgif.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\PyQt6\Qt6\plugins\imageformats\qgif.dll
        • Size 46KB
        • SHA256 57a621e4bb912996c44e1713c48d9cd4e013e69a789cbacfee0212639e377929
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qicns.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\PyQt6\Qt6\plugins\imageformats\qicns.dll
        • Size 54KB
        • SHA256 13c3a004cc764f9745cf2f1c6f8ea01d4b4413d90b5ece38c97114afef7bf394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qminimal.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\PyQt6\Qt6\plugins\platforms\qminimal.dll
        • Size 60KB
        • SHA256 b4220c0f5bdc7fadd1db68cf4cf270ed0f28206aa6006e2f38aeeacf2d56f7d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qoffscreen.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\PyQt6\Qt6\plugins\platforms\qoffscreen.dll
        • Size 111KB
        • SHA256 6cef891caf15f82be0e564e5167ea1aafb039f9f9becca6fc18d9967c0475784
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwindows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\PyQt6\Qt6\plugins\platforms\qwindows.dll
        • Size 976KB
        • SHA256 a6076030a5f0bf1b9254b0999e5260f66b1abd3b51214777e47a7c2e1d7cad81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qmodernwindowsstyle.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\PyQt6\Qt6\plugins\styles\qmodernwindowsstyle.dll
        • Size 223KB
        • SHA256 e6902591acf14d9a9abb96130eea6a1b5b6ee4dfb3d3908d40135f3dcf085e51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\PyQt6\QtCore.pyd
        • Size 2.5MB
        • SHA256 91dd5166110b88a4f4d3acda6fe6c10ed699882dd3602328a59e9f656cc766b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\PyQt6\QtGui.pyd
        • Size 2.2MB
        • SHA256 cf5ae37fd119fb29a53f1f2cea1362fdf036d940191be45d83da0f98ce8752b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\PyQt6\QtWidgets.pyd
        • Size 4.8MB
        • SHA256 4f81361816e94e1ae05f178085b22d5b9b19e417713b1966dd481a4017aa3b21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\PyQt6\sip.pyd
        • Size 110KB
        • SHA256 b3712a5326b899ba794082ad173f9b0cd0fce3a14de53f524b8c94c86d2d431d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\Qt6Core.dll
        • Size 10.0MB
        • SHA256 37fde8ebd11b474b806a1cf8d4564780dc51afdad3ac3611cd0aa92982f73687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 96b445dd611f30a3e3b938d981c2b13009d65294f48a8ac5f53dde8037132b53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\Qt6Widgets.dll
        • Size 6.3MB
        • SHA256 48deb69896f3185c8fe21221262670591ddc0ce9e7f2182be682e9f28208f7a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Geologica-VariableFont_CRSV,SHRP,slnt,wght.ttf
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\UI\Geologica-VariableFont_CRSV,SHRP,slnt,wght.ttf
        • Size 335KB
        • SHA256 38cce54fb27ae14ed217f7050d08cd2b906aa2c1b713d02e6ce6ab6cc6f9d1a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Unbounded-VariableFont_wght.ttf
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\UI\Unbounded-VariableFont_wght.ttf
        • Size 758KB
        • SHA256 c920c00876215ab1f902482a2fbb1eb307fe2cd5e7380ea307f7e4de1e064f72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app_icon.png
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\UI\app_icon.png
        • Size 16KB
        • SHA256 32694498756af46a05961d7e136738352565235ff0bf8ebc9befb8b16d521e5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\_bz2.pyd
        • Size 82KB
        • SHA256 ab34b804da5b8e814b2178754d095a4e8aead77eefd3668da188769392cdb5f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\_ctypes.pyd
        • Size 121KB
        • SHA256 b75560db79ba6fb56c393a4886eedd72e60df1e2f7f870fe2e356d08155f367b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\_elementtree.pyd
        • Size 125KB
        • SHA256 73b69bbf77237c7343dbd0cac22c6ab19feb8a49d56c78e34ce209da26c9692f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\_hashlib.pyd
        • Size 63KB
        • SHA256 30adfb86513282e59d7e27968e1ff6686e43b8559994a50c17be66d0789f82b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\_lzma.pyd
        • Size 155KB
        • SHA256 64ba475a28781dca81180a1b8722a81893704f8d8fac0b022c846fdcf95b15b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gui_app.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\gui_app.dll
        • Size 13.0MB
        • SHA256 d66c0bff08fcb7aa457167a99cd5775a0e8021b1ef698615fc7a18c357011c0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\libcrypto-3.dll
        • Size 4.9MB
        • SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\msvcp140_1.dll
        • Size 34KB
        • SHA256 206c931bf90fdad8816de3b5e2ef80b2bcaa9406c89ecc05fe6fddffe251e982
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\msvcp140_2.dll
        • Size 268KB
        • SHA256 d50d7883f20d1dc6191768d3746f52dd9cac89c346ffaed5be1f110c2f34a838
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\pyexpat.pyd
        • Size 193KB
        • SHA256 35134cca2dcf7c2b7e592b677833322b6b72a6a88afcd3935afe5907a282e89e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\python3.dll
        • Size 65KB
        • SHA256 a462a21b5f0c05f0f7ec030c4fde032a13b34a8576d661a8e66f9ad23767e991
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\python311.dll
        • Size 5.5MB
        • SHA256 5ecda62f6fd2822355c560412f6d90be46a7f763f0ffeec9854177904632ac2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4240_508021_f9MdURUGYRI\vcruntime140_1.dll
        • Size 48KB
        • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2992-121-0x00007FFE6B7D0000-0x00007FFE6BA09000-memory.dmp
        Download

        memory/2992-118-0x00007FFE66360000-0x00007FFE665EF000-memory.dmp
        Download

        memory/2992-113-0x00007FFE684A0000-0x00007FFE6897B000-memory.dmp
        Download

        memory/2992-108-0x00007FFE67E50000-0x00007FFE6849A000-memory.dmp
        Download