Overview

overview

7

Static

static

3

2026-08-30...om.exe

windows10-2004-x64

2026-08-30...om.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    1s
  • max time network
    7s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/08/2026, 09:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    2026-08-30_7230d121a18b3481bfea85ec8077d0d0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 7.0MB
  • Sample260831-lrbefsfg22
  • SHA256 99522c84d79f78bc1430f78159dc3d88d057375d4ce3a2b57b2b40e686663774
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasionexecution

Malware Config

Signatures

  • Loads dropped DLL 4 IoCs
  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-30_7230d121a18b3481bfea85ec8077d0d0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-30_7230d121a18b3481bfea85ec8077d0d0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2944
    • C:\Users\Admin\AppData\Local\Temp\2026-08-30_7230d121a18b3481bfea85ec8077d0d0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-30_7230d121a18b3481bfea85ec8077d0d0_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:264
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /f /im wininit.exe
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:824
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im wininit.exe
          4⤵
          • Kills process with taskkill
          PID:4756
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c taskkill /f /im svchost.exe
        3⤵
        • Executes a command shell one-liner
        PID:864
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im svchost.exe
          4⤵
          • Kills process with taskkill
          PID:5340

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b802\VCRUNTIME140.dll
        • Size 174KB
        • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b802\_bz2.pyd
        • Size 84KB
        • SHA256 261545bd24f15a783fc0c82568b766a4ab569dde14507a81701cccf5293e6e54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b802\_lzma.pyd
        • Size 155KB
        • SHA256 ee224aacf5cf9c9974a1b842aac8d89d5d9b7eeebbf4d76619ae0ce4da8ecd96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b802\base_library.zip
        • Size 1.3MB
        • SHA256 97647e1f799dd0fda2f32e482b883a492ab8e4848a40388e80e61b5dd80a040c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000b802\python313.dll
        • Size 5.9MB
        • SHA256 e820bf024efd2b56bb2b82791e6b6ddc7303f070f8e72cba7637482a8a906238
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download