Overview

overview

10

Static

static

10

2026-10-22...om.exe

windows10-2004-x64

7

2026-10-22...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/10/2026, 22:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_0c6400a1cfc453016fd6c70c5c608738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 40.2MB
  • Sample261024-1xpllaev2q
  • SHA256 9208c7ffe6d95902a37302d14a25610828e3793602b1470ae616dec820bfad62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
credential_accessdiscoveryexecutionspywarestealer

Malware Config

Signatures

  • Loads dropped DLL 59 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Queries system WMI classes for hardware identifiers 2 TTPs 4 IoCs

    Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_0c6400a1cfc453016fd6c70c5c608738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_0c6400a1cfc453016fd6c70c5c608738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4388
    • C:\Users\Admin\AppData\Local\Temp\2026-10-22_0c6400a1cfc453016fd6c70c5c608738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-22_0c6400a1cfc453016fd6c70c5c608738_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4652
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_ComputerSystemProduct).UUID"
        3⤵
        • Queries system WMI classes for hardware identifiers
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:900
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_BIOS).SerialNumber"
        3⤵
        • Queries system WMI classes for hardware identifiers
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5020
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_BaseBoard).SerialNumber"
        3⤵
        • Queries system WMI classes for hardware identifiers
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4848
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_Processor).ProcessorId"
        3⤵
        • Queries system WMI classes for hardware identifiers
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2864
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_BIOS).OEMStringArray"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3296
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "(Get-WmiObject -Class Win32_SystemEnclosure).SMBIOSAssetTag"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1900

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 64B
        • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
        • MD5 SHA1 SHA512
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\VCRUNTIME140.dll
        • Size 174KB
        • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\_asyncio.pyd
        • Size 71KB
        • SHA256 6654dfbf4cc92609801f35022acaddd3fc19e6c777b7771b0f0a68f5813889a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\_bz2.pyd
        • Size 84KB
        • SHA256 6da4d453852346299e983b458f3ec2f0db3b5f765998ba3f45c91b4a1549037b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\_cffi_backend.cp313-win_amd64.pyd
        • Size 176KB
        • SHA256 21b7160d4a6da9590794fdb38718982060b5c92d56fb0e441fc8b62ee789be8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\_ctypes.pyd
        • Size 131KB
        • SHA256 5bcddf4c374c4d247e1e4a61f3347159c36c5785fe43bdae11a4e6c9ea2c0166
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\_decimal.pyd
        • Size 280KB
        • SHA256 eeb278dfbdb305bb5af916ed79e878943e25dc4bd6e99ec17abb7b3fd9f935d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\_elementtree.pyd
        • Size 133KB
        • SHA256 34968e3aebdb3e89cb1472b75b04986ce1bbf27d290f4154d77649cc17c41fab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\_hashlib.pyd
        • Size 67KB
        • SHA256 4d3eb9d9492d626c7bb10cfe5ab233a9195ec7b27e92b465b287e7a24fc8266c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\_lzma.pyd
        • Size 155KB
        • SHA256 2b4dcb12c0420ffced4b91968ae4eff6cb585f0f07490160c6da47da63064a99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\_multiprocessing.pyd
        • Size 37KB
        • SHA256 5017bb9dd0d5ab6d7c0f007763d7906d33464f0b436ac6577f1f4fffd5c98986
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\_overlapped.pyd
        • Size 56KB
        • SHA256 3f393b2ce1fe5973fc45e49dffcf51405fa875cdb284cf96b2f0d4b93b08765c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\_queue.pyd
        • Size 34KB
        • SHA256 79c196a0804b152fc48b4055387f4352838e41c28863a0c946e7a98137e681e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\_socket.pyd
        • Size 84KB
        • SHA256 c5936292083189e0675a96ddd0e38235726f1c58195cec64eb0085b9c479ddce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\_sqlite3.pyd
        • Size 128KB
        • SHA256 95d5b99f696cb33550534e8be80d31003db8b8a27062dfd6b09fdba4bb92f812
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\_ssl.pyd
        • Size 186KB
        • SHA256 30ff82a3ea0c675ddc99e6b14f71ca750f06e77d6653e2da3d7d35b7ef0fc2ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\_tkinter.pyd
        • Size 68KB
        • SHA256 426c1761322019d382da2b7154786809ee39f7680b130ea405294b8adcc89baf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\_uuid.pyd
        • Size 27KB
        • SHA256 0d6fcf704721d4bae58cc754b15a3f8c36907b718874f6d7cbbaa363a14618b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\_wmi.pyd
        • Size 38KB
        • SHA256 f88c322f871aef92de562278bd25c34c6e758642669d5512a22ed972840317b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\base_library.zip
        • Size 1.3MB
        • SHA256 9bf288475623b1be232b7593766d251a8dcaec3f64873d773b66c49c308ac44a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\charset_normalizer\cd.cp313-win_amd64.pyd
        • Size 112KB
        • SHA256 9cccc0b9eb9f514f25cf21d9a8f09948506978ffa19d80ccd6be8df9a9890095
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\charset_normalizer\md.cp313-win_amd64.pyd
        • Size 201KB
        • SHA256 b484d0fc3d09e52a4974f4aebfc8f79cc5e4f38e375d76402b93905f03f803b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\libcrypto-3.dll
        • Size 5.7MB
        • SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\libssl-3.dll
        • Size 1.2MB
        • SHA256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multidict.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\multidict\_multidict.cp313-win_amd64.pyd
        • Size 125KB
        • SHA256 329fc90ad253591fed1ed6a9756d953d918b1ff5169df5e769c6553ddeba9001
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        INSTALLER
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\numpy-2.5.4.dist-info\INSTALLER
        • Size 4B
        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
        • MD5 SHA1 SHA512
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\pyexpat.pyd
        • Size 195KB
        • SHA256 3865fae84ff0f274c049e737731cd8aa184fae208af5b4c0d0cfc42a38f79cea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\python3.dll
        • Size 70KB
        • SHA256 a1a32b2475675e784d9b34d33d3a8f3e4afaa563da1feb784b0dd69fc4d8f9dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\python313.dll
        • Size 5.9MB
        • SHA256 3b29bf9ff39bed8f660f5b935f19657f7ce7f145009851741b11364f6ebcb862
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\pywin32_system32\pywintypes313.dll
        • Size 133KB
        • SHA256 ea82e185e0bed58485a8df23712b62224f5e486dbb84d946115cad17512065cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\select.pyd
        • Size 32KB
        • SHA256 17df388a7aa42e7f066b80aa4f77cbbba9286495e6f3508425806be6766d122b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\sqlite3.dll
        • Size 1.5MB
        • SHA256 fa794b6edd241d456b7d4e7ff5d99cebd326b45ebe659a0bc37d9affcc292210
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\tcl86t.dll
        • Size 1.8MB
        • SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\tk86t.dll
        • Size 1.5MB
        • SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\unicodedata.pyd
        • Size 695KB
        • SHA256 d113047658f92d893bf4ee2da81ffbd624ec5c485733c02e116fac1b9a1b964c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\win32\win32api.pyd
        • Size 135KB
        • SHA256 040d6a9ce12555d2585f89dce2aa4e25265c27dfa827eb9cae4c922e12ec731c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _quoting_c.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\yarl\_quoting_c.cp313-win_amd64.pyd
        • Size 78KB
        • SHA256 5bfa1f08f916718a5c18373dc1c09a50cccf8a5cea70b01473dd76ce60d1f8fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000011242\zlib1.dll
        • Size 142KB
        • SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __PSScriptPolicyTest_q44ywt5q.ypo.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q44ywt5q.ypo.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/900-1154-0x00000121FB9C0000-0x00000121FB9D0000-memory.dmp
        Download

        memory/900-1161-0x00000121FB970000-0x00000121FB992000-memory.dmp
        Download

        memory/900-1155-0x00000121FB9C0000-0x00000121FB9D0000-memory.dmp
        Download

        memory/1900-1212-0x00000208E4290000-0x00000208E42D8000-memory.dmp
        Download

        memory/1900-1211-0x00000208CB3F0000-0x00000208CB40E000-memory.dmp
        Download

        memory/2864-1192-0x00000241EB990000-0x00000241EB9C0000-memory.dmp
        Download

        memory/3296-1201-0x000001FC7BD10000-0x000001FC7BD2E000-memory.dmp
        Download

        memory/3296-1202-0x000001FC7BD30000-0x000001FC7BD78000-memory.dmp
        Download

        memory/4848-1182-0x000001E2A5F40000-0x000001E2A5F59000-memory.dmp
        Download

        memory/4848-1183-0x000001E2A5FA0000-0x000001E2A5FBE000-memory.dmp
        Download