Overview

overview

7

Static

static

3

2026-10-23...om.exe

windows10-2004-x64

7

2026-10-23...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/10/2026, 06:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-23_e2d7f933400d0c5411408efbb8deb5e6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 43.1MB
  • Sample261023-hc784acv2k
  • SHA256 1042f00da079620397a40af6ebf3f28074c85f34fe2becea37af1cf1a772cb14
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 35 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-23_e2d7f933400d0c5411408efbb8deb5e6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-23_e2d7f933400d0c5411408efbb8deb5e6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:720
    • C:\Users\Admin\AppData\Local\Temp\2026-10-23_e2d7f933400d0c5411408efbb8deb5e6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-23_e2d7f933400d0c5411408efbb8deb5e6_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:5416

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\PyQt5\Qt5\bin\MSVCP140.dll
        • Size 576KB
        • SHA256 88f55d86b50b0a7e55e71ad2d8f7552146ba26e927230daf2e26ad3a971973c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\PyQt5\Qt5\bin\MSVCP140_1.dll
        • Size 30KB
        • SHA256 446c48c1224c289bd3080087fe15d6759416d64f4136addf30086abd5415d83f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\PyQt5\Qt5\bin\Qt5Core.dll
        • Size 5.7MB
        • SHA256 8d2ff4ce9096ddccc4f4cd62c2e41fc854cfd1b0d6e8d296645a7f5fd4ae565a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\PyQt5\Qt5\bin\Qt5Gui.dll
        • Size 6.7MB
        • SHA256 5e7d2d41b8b92a880e83b8cc0ca173f5da61218604186196787ee1600956be1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\PyQt5\Qt5\bin\VCRUNTIME140_1.dll
        • Size 43KB
        • SHA256 1f0f5f2ce671e0f68cf96176721df0e5e6f527c8ca9cfa98aa875b5a3816d460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\PyQt5\QtCore.pyd
        • Size 2.4MB
        • SHA256 d6e45fd8c3b3f93f52c4d1b6f9e3ee220454a73f80f65f3d70504bd55415ea37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\PyQt5\QtGui.pyd
        • Size 2.4MB
        • SHA256 a9408e3b15ff3030f0e9acb3429000d253d3bb7206f750091a7130325f6d0d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\PyQt5\QtWidgets.pyd
        • Size 4.9MB
        • SHA256 a1e97a2ab434c6ae5e56491c60172e59cdcce42960734e8bdf5d851b79361071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\PyQt5\sip.cp313-win_amd64.pyd
        • Size 117KB
        • SHA256 7a54c971af695af612a1cda68924a2170d4a2afe48dd32770b60fde5b2dd7dab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\VCRUNTIME140.dll
        • Size 121KB
        • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_bz2.pyd
        • Size 71KB
        • SHA256 ea5aa5c49abe44d4441fc7bd5ca906212d271d7242fc89248c665abe2540a6cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_cffi_backend.cp313-win_amd64.pyd
        • Size 176KB
        • SHA256 91a8b18110a0ca95026e77b27bcaa3bcab6ecafbd22580c4fc29eac2e6e744e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_ctypes.pyd
        • Size 120KB
        • SHA256 7c02c8573f10caca9e1cc823d257974fbdef03a7360d22af2dce7b3179111e81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_decimal.pyd
        • Size 266KB
        • SHA256 3dfc7933359f2c994c502a3759f3d498d027c936394ee7d27e48fa22bdf2d61f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_hashlib.pyd
        • Size 54KB
        • SHA256 a6a932a67a09509c03436b7ea7fce619d5ade4a372867bbe113347b3cbd14a81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_lzma.pyd
        • Size 149KB
        • SHA256 97a891e9237379b2cea58a5e243b557dd76a426612ba2871b2d5c28d62a8e672
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_queue.pyd
        • Size 21KB
        • SHA256 8bb59daef1701c217a5441883f4cbc257db440fcab13c9874c5cc91492432c6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_socket.pyd
        • Size 71KB
        • SHA256 074bddeb66df8a42ef206534a240f6729369dfdc839d03c73839f33d150c2dcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_ssl.pyd
        • Size 164KB
        • SHA256 1671fe83d92d7d9ae6b29c7d5e4897959fcf0091154824303d21e9ae5e2baa2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_wmi.pyd
        • Size 25KB
        • SHA256 36d78485f74371a5a5d6fb282ac2de6793f34a7319a1aae9a087c1606625a929
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd
        • Size 221KB
        • SHA256 58c25c988641247cc153a987d1080dceb65c3a5cea68be96f0ac5b29c700ab05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\base_library.zip
        • Size 1.3MB
        • SHA256 9c7d595ca5683334da386d5889172152c5357186712f277cea1e8d2ca73fc33c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\charset_normalizer\cd.cp313-win_amd64.pyd
        • Size 10KB
        • SHA256 77e1c9c2679ea4855d5b97dba2666c6b4cfe32636945f5bb8399ff2c7ef1b050
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _rust.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\cryptography\hazmat\bindings\_rust.pyd
        • Size 9.4MB
        • SHA256 813b101f70efb79c388239ce82ac891e195a1e19eeaeb43c32d9bf425e7b51b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\libcrypto-3-x64.dll
        • Size 7.6MB
        • SHA256 b259d7ba122e0458d2f741bbae4a628a0f2d74b68e5ffbc2498c648993206e1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\libffi-8.dll
        • Size 27KB
        • SHA256 00c9d0b65d5f4dd796e892923388702c640271bdd7b9a63289bca00be61778ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\libssl-3-x64.dll
        • Size 1.5MB
        • SHA256 bcb77c6a18ba81d7d09a9f8906e9e4b6388be67074efcc972041a8f47f5d2059
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\python3.DLL
        • Size 57KB
        • SHA256 4c7ac174b17cc59eb461cb0c71c7d7b93841ece841622f45a5d43f908983ff63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\python313.dll
        • Size 5.9MB
        • SHA256 597c6747e061ee5a53bf7fefabc20483f3912510510e77ce2398ab40f5e2a118
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\select.pyd
        • Size 18KB
        • SHA256 509daae7556a1a48032d9c91bf79727f47499d4e519f6ee909740c2643c27ae3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\unicodedata.pyd
        • Size 682KB
        • SHA256 67160db8f535e9e40aa67baa49891d4186773a04a92d5977f33e79a7180728d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5416-225-0x00007FFF6CA20000-0x00007FFF6CC85000-memory.dmp
        Download

        memory/5416-182-0x00007FFF70480000-0x00007FFF706E3000-memory.dmp
        Download

        memory/5416-230-0x0000020A035B0000-0x0000020A035C0000-memory.dmp
        Download

        memory/5416-229-0x00007FFF69000000-0x00007FFF69541000-memory.dmp
        Download

        memory/5416-228-0x00007FFF6B700000-0x00007FFF6BBEC000-memory.dmp
        Download