Overview

overview

9

Static

static

3

2026-09-24...om.exe

windows10-2004-x64

9

2026-09-24...om.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 03:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_9b70bb1de72e19e46f79fa242da62b72_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
  • Size 6.0MB
  • Sample260924-dtsgrach29
  • SHA256 86b0ae460af09ec4a238c5415217e555a6bcbefad6e8381d8943dc6e2ec100b3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
execution

Malware Config

Signatures

  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Loads dropped DLL 15 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_9b70bb1de72e19e46f79fa242da62b72_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_9b70bb1de72e19e46f79fa242da62b72_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2832
    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_9b70bb1de72e19e46f79fa242da62b72_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-24_9b70bb1de72e19e46f79fa242da62b72_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4624
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        PID:4600

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2832_812347_Zu0phZayB3U\VCRUNTIME140.dll
        • Size 96KB
        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2832_812347_Zu0phZayB3U\_bz2.pyd
        • Size 81KB
        • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2832_812347_Zu0phZayB3U\_ctypes.pyd
        • Size 120KB
        • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2832_812347_Zu0phZayB3U\_hashlib.pyd
        • Size 62KB
        • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2832_812347_Zu0phZayB3U\_lzma.pyd
        • Size 154KB
        • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2832_812347_Zu0phZayB3U\_queue.pyd
        • Size 30KB
        • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2832_812347_Zu0phZayB3U\_socket.pyd
        • Size 76KB
        • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2832_812347_Zu0phZayB3U\_ssl.pyd
        • Size 155KB
        • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2832_812347_Zu0phZayB3U\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2832_812347_Zu0phZayB3U\libffi-8.dll
        • Size 34KB
        • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2832_812347_Zu0phZayB3U\libssl-1_1.dll
        • Size 686KB
        • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        macro python.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2832_812347_Zu0phZayB3U\macro python.dll
        • Size 7.3MB
        • SHA256 077238b45712f601c8f5934ba6eeb8806543447c0ddefe2e523547fdf7604640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2832_812347_Zu0phZayB3U\python311.dll
        • Size 5.5MB
        • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2832_812347_Zu0phZayB3U\select.pyd
        • Size 28KB
        • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2832_812347_Zu0phZayB3U\unicodedata.pyd
        • Size 1.1MB
        • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download