Overview

overview

7

Static

static

3

2026-10-26...om.exe

windows10-2004-x64

7

2026-10-26...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 02:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-26_f06b209b784431283bc3c9dd5b351eb5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 11.1MB
  • Sample261027-c9a2zace53
  • SHA256 5a08e57913588b4d484ba4c2bc597d56c9841dc629d4d6e0a9386730e44eb0ac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Loads dropped DLL 53 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_f06b209b784431283bc3c9dd5b351eb5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-26_f06b209b784431283bc3c9dd5b351eb5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\Users\Admin\AppData\Local\Temp\2026-10-26_f06b209b784431283bc3c9dd5b351eb5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-26_f06b209b784431283bc3c9dd5b351eb5_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      PID:4516

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\VCRUNTIME140.dll
        • Size 96KB
        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\VCRUNTIME140_1.dll
        • Size 37KB
        • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\_bz2.pyd
        • Size 81KB
        • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\_ctypes.pyd
        • Size 120KB
        • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\_decimal.pyd
        • Size 245KB
        • SHA256 d0df57988a74acd50b2d261e8b5f2c25da7b940ec2aafbee444c277552421e6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\_hashlib.pyd
        • Size 62KB
        • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\_lzma.pyd
        • Size 154KB
        • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\_multiprocessing.pyd
        • Size 32KB
        • SHA256 0ae3bf383ff998886f97576c55d6bf0a076c24395cf6fcd2265316e9a6e8c007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\_queue.pyd
        • Size 30KB
        • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\_socket.pyd
        • Size 76KB
        • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\_sqlite3.pyd
        • Size 115KB
        • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\_ssl.pyd
        • Size 155KB
        • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\base_library.zip
        • Size 1.4MB
        • SHA256 61669f073e628eb3727de94cae6723f612cce614a737c442c7c329f6629f3c8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ascii__mypyc.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\chardet\pipeline\ascii__mypyc.cp311-win_amd64.pyd
        • Size 36KB
        • SHA256 9b6ef74f0d8d4718df454ab6feb75ed99d9e8a2d1c2a11d172a9ffe734e3fe9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        escape__mypyc.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\chardet\pipeline\escape__mypyc.cp311-win_amd64.pyd
        • Size 66KB
        • SHA256 afd451482673d6cff1b057e430ee364a673582e8964097d494cb41f8dd3956f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        language__mypyc.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\chardet\pipeline\language__mypyc.cp311-win_amd64.pyd
        • Size 45KB
        • SHA256 ce8fd251e56f01c86ff69279e8a335d901a667946527a0f90a4b40bd887a6a5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        magic__mypyc.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\chardet\pipeline\magic__mypyc.cp311-win_amd64.pyd
        • Size 61KB
        • SHA256 0dfbdf8d1e00ddf2c90005029ea517d4b69113c3af25c5b92ec7ce0dcbac3310
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        markup__mypyc.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\chardet\pipeline\markup__mypyc.cp311-win_amd64.pyd
        • Size 83KB
        • SHA256 7d34edb7c0e927ff7712b689b0d634dc57744399306c5548673780e9d5116fa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orchestrator.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\chardet\pipeline\orchestrator.cp311-win_amd64.pyd
        • Size 10KB
        • SHA256 dd643cdd3945ad22b1b86091e73cbd580d8dc7a92ab50c9c20c68449bf17e177
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orchestrator__mypyc.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\chardet\pipeline\orchestrator__mypyc.cp311-win_amd64.pyd
        • Size 90KB
        • SHA256 c8190ce7bae73aa5b49f901b2f967ed2bcd366130cac263589a1e4842f108708
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        postprocess__mypyc.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\chardet\pipeline\postprocess__mypyc.cp311-win_amd64.pyd
        • Size 100KB
        • SHA256 33c8da0821a3e1eeadd1cc5375570dc9254ad2bb2286e316f94c2607bd45467c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        statistical__mypyc.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\chardet\pipeline\statistical__mypyc.cp311-win_amd64.pyd
        • Size 80KB
        • SHA256 6656238d81e3c63ae6b37f3b9e76e44b1fda1d687be39407909fc863c60658ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        structural__mypyc.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\chardet\pipeline\structural__mypyc.cp311-win_amd64.pyd
        • Size 81KB
        • SHA256 1b220a7867b5d0862ace0a738623e2f5d2b10b073b93994113ad262905d4aabc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        utf1632__mypyc.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\chardet\pipeline\utf1632__mypyc.cp311-win_amd64.pyd
        • Size 58KB
        • SHA256 f7d7e61c3127f34cee22ecd146b729c88352c6b37abb0336712e3733616f3192
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        utf8__mypyc.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\chardet\pipeline\utf8__mypyc.cp311-win_amd64.pyd
        • Size 46KB
        • SHA256 9e9b25abe85321dda63c6c8563bf1bc8c14b91343d6f4cab142994d823b32d62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\libffi-8.dll
        • Size 34KB
        • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\libssl-1_1.dll
        • Size 686KB
        • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\pyexpat.pyd
        • Size 193KB
        • SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\python311.dll
        • Size 5.5MB
        • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\pywin32_system32\pywintypes311.dll
        • Size 132KB
        • SHA256 dcc14a7ed85a324e357eab7db970d8db61387c8b5d6baa23283aabd8300c4e09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\select.pyd
        • Size 28KB
        • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\sqlite3.dll
        • Size 1.4MB
        • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\unicodedata.pyd
        • Size 1.1MB
        • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32crypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI0000031c2\win32\win32crypt.pyd
        • Size 122KB
        • SHA256 57b37eae88743fe71226365880f8870b2082a8df9775c28019f58c25f75a05c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download