Overview

overview

7

Static

static

3

2026-10-01...om.exe

windows10-2004-x64

7

2026-10-01...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/10/2026, 10:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-01_7f2b32f83e665223966b59de44e2f404_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 46.6MB
  • Sample261002-mmfdaaxblb
  • SHA256 366d30dccb2ac56dbf92f26cae9f6fe7d43701ed6ab01f607cc317b4ed8926f8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • Deletes itself 1 TTPs 1 IoCs
    defense_evasion
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 57 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_7f2b32f83e665223966b59de44e2f404_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_7f2b32f83e665223966b59de44e2f404_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4640
    • C:\Users\Admin\AppData\Local\Temp\2026-10-01_7f2b32f83e665223966b59de44e2f404_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-01_7f2b32f83e665223966b59de44e2f404_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:324
      • C:\Windows\explorer.exe
        explorer.exe C:\Users\Admin\AppData\Local\Temp\2026-10-01_7f2b32f83e665223966b59de44e2f404_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        3⤵
          PID:4556
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4508
      • C:\Users\Admin\AppData\Local\Temp\2026-10-01_7f2b32f83e665223966b59de44e2f404_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-01_7f2b32f83e665223966b59de44e2f404_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3704
        • C:\Users\Admin\AppData\Local\Temp\2026-10-01_7f2b32f83e665223966b59de44e2f404_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-10-01_7f2b32f83e665223966b59de44e2f404_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
          3⤵
          • Deletes itself
          • Executes dropped EXE
          • Loads dropped DLL
          • Reads the TCP/IP host and domain name from the registry
          PID:1572

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          gb2312.enc
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e782\_tcl_data\encoding\gb2312.enc
          • Size 84KB
          • SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          INSTALLER
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI00000e782\cryptography-50.0.2.dist-info\INSTALLER
          • Size 4B
          • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
          • MD5 SHA1 SHA512
          Submit Download

          _imaging.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\PIL\_imaging.cp312-win_amd64.pyd
          • Size 2.5MB
          • SHA256 6dfd10a98bc81a1999e2b5ddb8be8c1cfb9a2c8e10258c56a52ee0d8930d3d7f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\VCRUNTIME140.dll
          • Size 116KB
          • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_asyncio.pyd
          • Size 69KB
          • SHA256 5bebeb765ab9ef045bc5515166360d6f53890d3ad6fc360c20222d61841410b6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_bz2.pyd
          • Size 83KB
          • SHA256 3ed0e5058d370fb14aa5469d81f96c5685559c054917c7280dd4125f21d25f62
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cffi_backend.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_cffi_backend.cp312-win_amd64.pyd
          • Size 175KB
          • SHA256 86f136553ba301c70e7bada8416b77eb4a07f76ccb02f7d73c2999a38fa5fa5b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_ctypes.pyd
          • Size 122KB
          • SHA256 74e0e8384f6c2503215f4cf64c92efe7257f1aec44f72d67ad37dc8ba2530bc1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_decimal.pyd
          • Size 251KB
          • SHA256 b8221d1c9e2c892dd6227a6042d1e49200cd5cb82adbd998e4a77f4ee0e9abf1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _elementtree.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_elementtree.pyd
          • Size 130KB
          • SHA256 4869325e5cffbd13d3cc02dc78226478adfb51a802b52ff65b5adfacff3511f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_hashlib.pyd
          • Size 64KB
          • SHA256 fd77a5756a17ec0788989f73222b0e7334dd4494b8c8647b43fe554cf3cfb354
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_lzma.pyd
          • Size 156KB
          • SHA256 7bf9ff61babebd90c499a8ed9b62141f947f90d87e0bbd41a12e99d20e06954a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multiprocessing.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_multiprocessing.pyd
          • Size 34KB
          • SHA256 3c34031b464e7881d8f9d182f7387a86b883581fd020280ec56c1e3ec6f4cc2d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_overlapped.pyd
          • Size 54KB
          • SHA256 d5f89859609371393d379b5ffd98e5b552078050e8b02a8e2900fa9b4ee8ff91
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_queue.pyd
          • Size 31KB
          • SHA256 dbdabb5fe0ccbc8b951a2c6ec033551836b072cab756aaa56b6f22730080d173
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_socket.pyd
          • Size 81KB
          • SHA256 b102522c23dac2332511eb3502466caf842d6bcd092fbc276b7b55e9cc01b085
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_ssl.pyd
          • Size 174KB
          • SHA256 a5d361707f7a2a2d726b20770e8a6fc25d753be30bcbcbbb683ffee7959557c2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          auto.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_tcl_data\auto.tcl
          • Size 21KB
          • SHA256 517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cp1252.enc
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_tcl_data\encoding\cp1252.enc
          • Size 1KB
          • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          init.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_tcl_data\init.tcl
          • Size 25KB
          • SHA256 7a103a85413988456c2ad615c879bbcb4d91435bcfbbe23393e0eb52b56af6e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          package.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_tcl_data\package.tcl
          • Size 23KB
          • SHA256 f46ab61cdebe3aa45fa7e61a48930d64a0d0e7e94d04d6bf244f48c36cafe948
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tclIndex
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_tcl_data\tclIndex
          • Size 5KB
          • SHA256 ddf7e42def37888ad0a564aa4f8ca95f4eec942cebebfca851d35515104d5c89
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tm.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_tcl_data\tm.tcl
          • Size 11KB
          • SHA256 4b7ed9fd2363d6876092db3f720cbddf97e72b86b519403539ba96e1c815ed8f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tk.tcl
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_tk_data\tk.tcl
          • Size 23KB
          • SHA256 1d5e7518afc1382e36bf13fc5196c8a7cd93a4e9d24acf445522564245a489b0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_tkinter.pyd
          • Size 64KB
          • SHA256 a1c74836bad3d9b0aaec8dccd92e552b5ad583bfea7ef21cd40713a265d94f7e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_uuid.pyd
          • Size 25KB
          • SHA256 acbf831004fb8b8d5340fe5debd9814c49bd282dd765c78faeb6bb5116288c78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _wmi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\_wmi.pyd
          • Size 36KB
          • SHA256 752fb80edb51f45d3cc1c046f3b007802432b91aef400c985640d6b276a67c12
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\base_library.zip
          • Size 1.3MB
          • SHA256 8cbfc1e89b232e3228c28de8a6ba96a08a2ff45eee0d81b8246d433d3c8f8ffa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          blue.json
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\customtkinter\assets\themes\blue.json
          • Size 4KB
          • SHA256 a9c10c997a2281b57b60ff9325c9c0b2dbebe498722f3fbc7c585ec9fe1aa352
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\libcrypto-3.dll
          • Size 5.0MB
          • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\libssl-3.dll
          • Size 768KB
          • SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\pyexpat.pyd
          • Size 197KB
          • SHA256 efd6099b1a6efdadd988d08dce0d8a34bd838106238250bccd201dc7dcd9387f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\python3.DLL
          • Size 66KB
          • SHA256 5146005c36455e7ede4b8ecc0dc6f6fa8ea6b4a99fedbabc1994ae27dfab9d1b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python312.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\python312.dll
          • Size 6.6MB
          • SHA256 21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\select.pyd
          • Size 30KB
          • SHA256 411d6f538bdbaf60f1a1798fa8aa7ed3a4e8fcc99c9f9f10d21270d2f3742019
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\tcl86t.dll
          • Size 1.7MB
          • SHA256 3d2769e69d611314d517fc9aad688a529670af94a7589f728107180ae105218f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msgcat-1.6.1.tm
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\tcl8\8.5\msgcat-1.6.1.tm
          • Size 34KB
          • SHA256 6774519f179872ec5292523f2788b77b2b839e15665037e097a0d4edddd1c6fb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\tk86t.dll
          • Size 1.5MB
          • SHA256 b30576b60aee548838243601952a05b70a9fc937f5a607f6b1413cd5ed04d900
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\unicodedata.pyd
          • Size 1.1MB
          • SHA256 bc2cf23b7b7491edcf03103b78dbaf42afd84a60ea71e764af9a1ddd0fe84268
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zlib1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012202\zlib1.dll
          • Size 143KB
          • SHA256 21feea753a6f991f01bcf9d30afada06eca3a105e97d5d81998ef359c4fc86a3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/324-1126-0x00007FFE36FF0000-0x00007FFE3701A000-memory.dmp
          Download

          memory/324-1132-0x00007FFE36FF0000-0x00007FFE3701A000-memory.dmp
          Download

          memory/324-1131-0x00007FF77B090000-0x00007FF77B0ED000-memory.dmp
          Download

          memory/1572-2219-0x00007FFE375E0000-0x00007FFE3760A000-memory.dmp
          Download

          memory/4640-1215-0x00007FF77B090000-0x00007FF77B0ED000-memory.dmp
          Download