Overview

overview

9

Static

static

3

2026-09-13...om.exe

windows10-2004-x64

9

2026-09-13...om.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/09/2026, 16:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-13_3c0706f28456f3e868c9019687e058d1_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
  • Size 22.6MB
  • Sample260913-tmalcsak4w
  • SHA256 cadcea4f6e3bbbd67c02724f3232690308d638fdfc37de15ea798fd28455344a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_3c0706f28456f3e868c9019687e058d1_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_3c0706f28456f3e868c9019687e058d1_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2256
    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_3c0706f28456f3e868c9019687e058d1_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-13_3c0706f28456f3e868c9019687e058d1_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4028
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:2692
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "cscript temp_error.vbs"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1096
        • C:\Windows\system32\cscript.exe
          cscript temp_error.vbs
          4⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:4868
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4252
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1380
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
        3⤵
        • Executes a command shell one-liner
        • System Network Configuration Discovery: Wi-Fi Discovery
        • Suspicious use of WriteProcessMemory
        PID:3512
        • C:\Windows\system32\netsh.exe
          netsh wlan show profiles
          4⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Network Configuration Discovery: Wi-Fi Discovery
          PID:2412

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        2
        T1059

        Visual Basic

        1
        T1059.005

        Windows Command Shell

        1
        T1059.003

        Persistence

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Defense Evasion

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Browser Information Discovery

        1
        T1217

        System Information Discovery

        1
        T1082

        System Network Configuration Discovery

        2
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Wi-Fi Discovery

        1
        T1016.002

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Web Service

        1
        T1102

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        edge_history.txt
        • Path C:\Users\Admin\AppData\Local\Temp\SystemCache_Admin_271405438378808\Browser\Edge\edge_history.txt
        • Size 250B
        • SHA256 b7b37ba5bedd2744fd576ae4ddf79347213e8253d6c3ce029ab3ae8a29a47c4c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        minecraft_tokens.txt
        • Path C:\Users\Admin\AppData\Local\Temp\SystemCache_Admin_271405438378808\Gaming\Minecraft\minecraft_tokens.txt
        • Size 140B
        • SHA256 c0ac0832ba7cfff119ece0f15f6c8b858e7b7b1646851ce787c7116de143806a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        screenshot_20260913_201955.png
        • Path C:\Users\Admin\AppData\Local\Temp\SystemCache_Admin_271405438378808\Media\Screenshots\screenshot_20260913_201955.png
        • Size 391KB
        • SHA256 4f34efdefa5d8208cceef2a10029c657bf82157d799502deca1d8ef30d664f8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        discord_tokens.txt
        • Path C:\Users\Admin\AppData\Local\Temp\SystemCache_Admin_271405438378808\Social\Discord\discord_tokens.txt
        • Size 136B
        • SHA256 c3c7cf35324498c5790a2d8c0b766b9635c4c6095c623e85587c4c15c962c46b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        processes_list.txt
        • Path C:\Users\Admin\AppData\Local\Temp\SystemCache_Admin_271405438378808\System\processes_list.txt
        • Size 9KB
        • SHA256 70351207c02a3a24de8809a07046c628eacb97d4075852bc1273d82100869d9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        system_info.json
        • Path C:\Users\Admin\AppData\Local\Temp\SystemCache_Admin_271405438378808\System\system_info.json
        • Size 856B
        • SHA256 b0ad2739c1f1418d702b4b1fd5f68da4159a21b93175a5ee5dcb4e73a0064434
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wifi_profiles.txt
        • Path C:\Users\Admin\AppData\Local\Temp\SystemCache_Admin_271405438378808\System\wifi_profiles.txt
        • Size 137B
        • SHA256 81735e10cd333d4185dea3368ba50f4ddc737c479a1f88df9e0245dc6a7707a9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\2.dll
        • Size 45.4MB
        • SHA256 21af4cb6a96cbe0c13cea665b7703d527dfc0800646d9e0bb00090e82cf91773
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\VCRUNTIME140.dll
        • Size 96KB
        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\_asyncio.pyd
        • Size 62KB
        • SHA256 aebc378db08617ea81a0a3a3bc044bcc7e6303e314630392dd51bab12f879bd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\_bz2.pyd
        • Size 81KB
        • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\_ctypes.pyd
        • Size 120KB
        • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\_hashlib.pyd
        • Size 62KB
        • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\_lzma.pyd
        • Size 154KB
        • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\_overlapped.pyd
        • Size 48KB
        • SHA256 a083e83f609ed7a2fc18a95d44d8f91c9dc74842f33e19e91988e84db94c3b5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\_queue.pyd
        • Size 30KB
        • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\_socket.pyd
        • Size 76KB
        • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\_sqlite3.pyd
        • Size 115KB
        • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\_ssl.pyd
        • Size 155KB
        • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\charset_normalizer\cd.pyd
        • Size 113KB
        • SHA256 ac9465bbf4a1698015cf306bed26a101677010d89acdd10f7f63dedbaf271798
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\charset_normalizer\md.pyd
        • Size 195KB
        • SHA256 f398758fbce16b001e0799c1698d2a623751b8dd4e9ff0d6f4845ea6270f672f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\libffi-8.dll
        • Size 34KB
        • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\libssl-1_1.dll
        • Size 686KB
        • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multidict.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\multidict\_multidict.pyd
        • Size 77KB
        • SHA256 f92555975df808e8f4ba64e60af52ba32ccdebc69aa4dcca23d54d098dcb5d74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _helpers_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\propcache\_helpers_c.pyd
        • Size 59KB
        • SHA256 665a77de007b7f37699ba3f97fb58f7664b64d5c047eaf40720bf888d6846caa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\psutil\_psutil_windows.pyd
        • Size 69KB
        • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\python3.dll
        • Size 64KB
        • SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\python311.dll
        • Size 5.5MB
        • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\pywintypes311.dll
        • Size 132KB
        • SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\select.pyd
        • Size 28KB
        • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\sqlite3.dll
        • Size 1.4MB
        • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\unicodedata.pyd
        • Size 1.1MB
        • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\vcruntime140_1.dll
        • Size 37KB
        • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\win32api.pyd
        • Size 135KB
        • SHA256 cd9ec02d502dc1548233aa2efe9fcbf47e4677b28c169553f36194a50f55ff28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32profile.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\win32profile.pyd
        • Size 26KB
        • SHA256 0f8a175d6c730071f4b8abfaa2a4e516ff34d06202cc6d99b1ad30efcf92e327
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32security.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\win32security.pyd
        • Size 129KB
        • SHA256 f781801e130db6a1f17466e37edb77e88804a8137b86d23aa8c5856672e6f4cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _quoting_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2256_980569_JooV3B-YjLY\yarl\_quoting_c.pyd
        • Size 79KB
        • SHA256 793a36ef4d73480f85520e370c50d215838f1dd9a2e4a569dbcaa0bff831ad4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download