Overview

overview

9

Static

static

3

2026-09-23...om.exe

windows10-2004-x64

9

2026-09-23...om.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 01:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-23_d6cff2ae4619c9139f22d29585303d60_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
  • Size 29.4MB
  • Sample260924-bfb7haae66
  • SHA256 c283e7be4247b7611a5cdb980229e10d8ff6d26b85ca7a32ec48d1ba66b1c7b8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10

Malware Config

Signatures

  • Detects Windows executables referencing non-Windows User-Agents 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_d6cff2ae4619c9139f22d29585303d60_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_d6cff2ae4619c9139f22d29585303d60_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3496
    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_d6cff2ae4619c9139f22d29585303d60_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-23_d6cff2ae4619c9139f22d29585303d60_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:236
      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_d6cff2ae4619c9139f22d29585303d60_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
        C:\Users\Admin\AppData\Local\Temp\2026-09-23_d6cff2ae4619c9139f22d29585303d60_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe --watchdog \\.\pipe\keysteam_guard_80c9ca3353c6a784 236
        3⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2736

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\MSVCP140.dll
        • Size 628KB
        • SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\PyQt6\QtCore.pyd
        • Size 2.5MB
        • SHA256 91dd5166110b88a4f4d3acda6fe6c10ed699882dd3602328a59e9f656cc766b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\PyQt6\QtGui.pyd
        • Size 2.2MB
        • SHA256 cf5ae37fd119fb29a53f1f2cea1362fdf036d940191be45d83da0f98ce8752b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\PyQt6\QtWidgets.pyd
        • Size 4.8MB
        • SHA256 4f81361816e94e1ae05f178085b22d5b9b19e417713b1966dd481a4017aa3b21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\PyQt6\sip.pyd
        • Size 108KB
        • SHA256 80e3122ad70cc48f71388f18b9094eb655c0950e129463967e33f7d102b78f4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\Qt6Core.dll
        • Size 9.9MB
        • SHA256 22c113a5644b875b2c85482723cd5d2e6a3a4029169778fcc78adde08ef3b6aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 19265a4e76efc12ef5f5bcf59be6c6a5b9b59ec4c89660797738bd2da7f719cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\Qt6Widgets.dll
        • Size 6.2MB
        • SHA256 e6d0b7e2e697de6ad985b97f9ed8b381c1c2172fcae87b6ab08455b3b7330f32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\VCRUNTIME140.dll
        • Size 101KB
        • SHA256 6479a96fc774f47d75545f86b84f0a8ee76936c948088c4258a6fa2b67ed0fbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\_asyncio.pyd
        • Size 58KB
        • SHA256 d256c474198a2b32a92025d2ff66c2a01ffbf9dbf1fd233a44fcd7b1fd088f66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\_bz2.pyd
        • Size 71KB
        • SHA256 0b9b8e209afbfda4240e8eae5e3c8fcdc6fb7251fea919da6fbff0257b604ec6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\_hashlib.pyd
        • Size 53KB
        • SHA256 993764a3c3ed455d4e19466b7e196228a379e78db667fb67056fbf869b3b2c1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\_lzma.pyd
        • Size 143KB
        • SHA256 178fafcf33ad4ea7ccda131c49e618f5842c1733d36b93f680d2679b98f76174
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\_overlapped.pyd
        • Size 43KB
        • SHA256 1b2a3c4b4c37fec65c5c3855a987218eaaf38002c8da85c7c2349153f6334379
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\_socket.pyd
        • Size 70KB
        • SHA256 6b877c9623f0508699095710fdcc7a35eb393dc9d147093756a6367dfc169859
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\_ssl.pyd
        • Size 161KB
        • SHA256 e32b6e5aacda207bb66fa138d9aabe6fb160ac36592126c4bd54769a1c888635
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\_wmi.pyd
        • Size 25KB
        • SHA256 162f0c333b76399930abadbaa18c9d7f3be384cc8c9ddd47183af8c9a7701c75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_parser.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\aiohttp\_http_parser.pyd
        • Size 254KB
        • SHA256 2851a840224d139cc3c73534597b1c29b1ee6094661e27def04b3cd66d4199c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_writer.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\aiohttp\_http_writer.pyd
        • Size 43KB
        • SHA256 4831aaf297de92c195335564e4b13d3df50e3e88f25b22532c5b576ecb3a3a1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\libcrypto-3-x64.dll
        • Size 5.7MB
        • SHA256 a608bf4e6838a57239c4cf42098fd60bc6cdae9ca03b7724cc655d32e2e24296
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\libssl-3-x64.dll
        • Size 914KB
        • SHA256 3b11f35c92e93f5ad86d33a3f1d01df5a9f4fa563f48ebc08dbb7892fb8f1d03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        main.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\main.dll
        • Size 29.6MB
        • SHA256 2d556e0f5b5ea09db993f871d8060297e4212b93f1513ce4e9cbb70d86369e43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\msvcp140_1.dll
        • Size 34KB
        • SHA256 206c931bf90fdad8816de3b5e2ef80b2bcaa9406c89ecc05fe6fddffe251e982
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\msvcp140_2.dll
        • Size 268KB
        • SHA256 d50d7883f20d1dc6191768d3746f52dd9cac89c346ffaed5be1f110c2f34a838
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multidict.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\multidict\_multidict.pyd
        • Size 81KB
        • SHA256 e46e2f423b83b0d94587b9b6dcced0bd10cb3b581de948b83b264ad4cb8d2b4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _helpers_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\propcache\_helpers_c.pyd
        • Size 64KB
        • SHA256 56076d1e6a317c70a5d1dc9971d48e2b5fe56b86d40d09eccdee23117ce34c3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\python3.dll
        • Size 55KB
        • SHA256 eb7472494513e2b57f15f81a50e4596ff7922f12d3999624bc40239a29880887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\python312.dll
        • Size 6.7MB
        • SHA256 2ceda4ff7bbdfa79d1ebd4629c68c707febcffe8b885587d1a0ac7503041b0cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\select.pyd
        • Size 18KB
        • SHA256 58503a5603357320a8bfc5c4e939b67f9a0726a3bbe15b8597f590e238dfaa37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\unicodedata.pyd
        • Size 1.1MB
        • SHA256 f630045054d5224b3f01a1e6f46e603ba79dd829be288af1e19b453665d0c21c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\vcruntime140_1.dll
        • Size 28KB
        • SHA256 9d5339860bdafd3ac4c3dbafa985370ebc21bfce23bab4e0bed381008272d27b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _quoting_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3496_247171_Ig8woYDkX-Y\yarl\_quoting_c.pyd
        • Size 80KB
        • SHA256 4d5b5978bdb7a001fe9e79f5f62e1b496c11ac331204104b23307c51903cb69a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/236-135-0x00007FFAEBDA0000-0x00007FFAEC02F000-memory.dmp
        Download

        memory/236-150-0x00007FFAE9D20000-0x00007FFAEA354000-memory.dmp
        Download

        memory/236-149-0x00007FFAEA360000-0x00007FFAEA83B000-memory.dmp
        Download

        memory/236-144-0x00007FFAEB170000-0x00007FFAEB3A9000-memory.dmp
        Download

        memory/2736-184-0x00007FFAEBDA0000-0x00007FFAEC02F000-memory.dmp
        Download