Overview

overview

7

Static

static

3

2026-10-17...om.exe

windows10-2004-x64

7

2026-10-17...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/10/2026, 23:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-17_9b9e825bdf334b0f38f3edf432ec761a_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
  • Size 24.4MB
  • Sample261018-26jblsda46
  • SHA256 e02aa675bc881df30aebdbed8cc6695593b2667a3011bc68faf6d22e720a4f6f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 36 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-17_9b9e825bdf334b0f38f3edf432ec761a_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-17_9b9e825bdf334b0f38f3edf432ec761a_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Users\Admin\AppData\Local\Temp\2026-10-17_9b9e825bdf334b0f38f3edf432ec761a_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-17_9b9e825bdf334b0f38f3edf432ec761a_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      PID:4404

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\PySide6\QtCore.pyd
        • Size 3.2MB
        • SHA256 74f96322c5e9cea73aefd2ed5870e5275336b31f552fcd32f12fc81d23f1bc6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\PySide6\QtGui.pyd
        • Size 3.7MB
        • SHA256 7bef20046045199c037b7cbfedaa1c5464730fa948b2c9ec8afbf718e63774d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\PySide6\QtWidgets.pyd
        • Size 4.6MB
        • SHA256 f12f4ca641998e5706d5f7b0023147d573f0f2d2361e26dadf31bdbf05fbfd1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\Qt6Core.dll
        • Size 9.9MB
        • SHA256 d6a3c37c5263c5d418fc0e80b722bc9fca7c0859e6f635f9624a2fde00bdc653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 ae29b005f51b6850bf57fa06fced0dc8c7039fd6fafc3bfbcfe76e38adc7abf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\Qt6Widgets.dll
        • Size 6.2MB
        • SHA256 ff0df9e2e6827e035f0731a4cedfc6333f4602bca00775e56346f27032406b74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\_bz2.pyd
        • Size 84KB
        • SHA256 df21ec68d062eb375dba4ea8332aa859d0d4b91f9eddc45e1cebfd54742044e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\_cffi_backend.pyd
        • Size 176KB
        • SHA256 21b7160d4a6da9590794fdb38718982060b5c92d56fb0e441fc8b62ee789be8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\_ctypes.pyd
        • Size 131KB
        • SHA256 c95add0b1a541b723c9090c23abeadb8f642b31bb33f2e1ae005fbb8a331ef73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\_hashlib.pyd
        • Size 67KB
        • SHA256 8770291fed8af2ea8e9fd2ed695e8c56f8e26848c91d320d1a22ddf404d02116
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\_lzma.pyd
        • Size 155KB
        • SHA256 1ddce9934889905b482f8587656f28ae1988365a55ae86ca4438873fd0184340
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\_queue.pyd
        • Size 34KB
        • SHA256 0d316914b426e71bbd263b78fe23622ac1c8e6f86bae42ef6ffbb609e6257e3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\_socket.pyd
        • Size 84KB
        • SHA256 a69f3a7e281009c86868dd56c2e933ca2634a3979fdc2a4ca751ee4ef5e6ece7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\_ssl.pyd
        • Size 177KB
        • SHA256 eb860d3a4ad45e3d7975c5fdc3994798ee9b7ab685fa920c2656878b7dcd3029
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _rust.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\cryptography\hazmat\bindings\_rust.pyd
        • Size 9.4MB
        • SHA256 1d4332a447cab13dec8e3a533ad579e0e562b79e40822c931f33769758fc7156
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\libssl-3.dll
        • Size 776KB
        • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        loader_entry.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\loader_entry.dll
        • Size 7.3MB
        • SHA256 c3c988bb6e342536b1a6c48e45d871143d76e41ab3ae6e3455d94a6947b19e5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyside6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\pyside6.abi3.dll
        • Size 249KB
        • SHA256 d0b5c701fb3a8ea839e72b602058f3960935156ebeca084893c54c99e54dd707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\python3.dll
        • Size 70KB
        • SHA256 ca9313dce359c129edc385af4d0c2322e6b3fdad4969d5c2fbc36e0886da58bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\python313.dll
        • Size 5.8MB
        • SHA256 265a27242ee97f81eeac6a556fd7de56baff2222f2334386d8f948e359a649d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\select.pyd
        • Size 32KB
        • SHA256 7d061afc87ba79f90878af39a1ebc7b4cf238d52e5bbe16ff7e176cbba266ec0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shiboken6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\shiboken6.abi3.dll
        • Size 384KB
        • SHA256 de3c6b2ed5f75c9ac0de4a6844b653b3b9d09263ce68c2b5fc25a96c5c3e8469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\shiboken6\MSVCP140.dll
        • Size 536KB
        • SHA256 fd4a8c046fa3fea9ca6132f50cf8a56cf1e783b2d3093ba5c85fa063bc6b3845
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Shiboken.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\shiboken6\Shiboken.pyd
        • Size 32KB
        • SHA256 2f6f3a694f675b1dafdae26903191613c02866ab48e02591ae34ca1a3b1284f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\shiboken6\msvcp140_1.dll
        • Size 26KB
        • SHA256 7f556f0a0b944df7b64b916b344a070b7e6f6cf342194475594447ca88c07659
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\shiboken6\msvcp140_2.dll
        • Size 265KB
        • SHA256 720091576d0e2669d16e8ad203a1f81a7c0811a6906452964d6e5fcb28a8de4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5104_303459_2adausj6UKc\vcruntime140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4404-120-0x00007FFE21E40000-0x00007FFE22177000-memory.dmp
        Download

        memory/4404-129-0x00007FFE1AA10000-0x00007FFE1AECA000-memory.dmp
        Download

        memory/4404-132-0x00007FFE196E0000-0x00007FFE19A9C000-memory.dmp
        Download