Overview

overview

7

Static

static

3

2026-10-28...om.exe

windows10-2004-x64

7

2026-10-28...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/10/2026, 09:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-28_1a3473cbc5635a0affc7b525d73f7b25_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
  • Size 9.6MB
  • Sample261030-lda7jaea92
  • SHA256 c08c812d23ee054d2206aa237b54888aafa4027969e0cc65a61c3b70d77ee7b0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Loads dropped DLL 34 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Discovers running processes 1 TTPs 2 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-28_1a3473cbc5635a0affc7b525d73f7b25_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-28_1a3473cbc5635a0affc7b525d73f7b25_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Users\Admin\AppData\Local\Temp\2026-10-28_1a3473cbc5635a0affc7b525d73f7b25_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-28_1a3473cbc5635a0affc7b525d73f7b25_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of WriteProcessMemory
      PID:2892
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "getmac /fo csv /nh"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2536
        • C:\Windows\system32\getmac.exe
          getmac /fo csv /nh
          4⤵
            PID:3128
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "tasklist /fo csv /nh"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2752
          • C:\Windows\system32\tasklist.exe
            tasklist /fo csv /nh
            4⤵
            • Discovers running processes
            • Suspicious use of AdjustPrivilegeToken
            PID:3288
        • C:\Windows\SYSTEM32\netsh.exe
          netsh wlan show profiles
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Network Configuration Discovery: Wi-Fi Discovery
          PID:5360
    • C:\Users\Admin\AppData\Local\Temp\2026-10-28_1a3473cbc5635a0affc7b525d73f7b25_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-28_1a3473cbc5635a0affc7b525d73f7b25_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1216
      • C:\Users\Admin\AppData\Local\Temp\2026-10-28_1a3473cbc5635a0affc7b525d73f7b25_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-10-28_1a3473cbc5635a0affc7b525d73f7b25_blankgrabber_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
        2⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Reads the TCP/IP host and domain name from the registry
        • Suspicious use of WriteProcessMemory
        PID:5648
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "ver"
          3⤵
          • Executes a command shell one-liner
          PID:2200
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "ver"
          3⤵
          • Executes a command shell one-liner
          PID:2740
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "getmac /fo csv /nh"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4176
          • C:\Windows\system32\getmac.exe
            getmac /fo csv /nh
            4⤵
              PID:5252
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "tasklist /fo csv /nh"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5992
            • C:\Windows\system32\tasklist.exe
              tasklist /fo csv /nh
              4⤵
              • Discovers running processes
              • Suspicious use of AdjustPrivilegeToken
              PID:3408
          • C:\Windows\SYSTEM32\netsh.exe
            netsh wlan show profiles
            3⤵
            • Event Triggered Execution: Netsh Helper DLL
            • System Network Configuration Discovery: Wi-Fi Discovery
            PID:3120

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Command and Scripting Interpreter

            1
            T1059

            Windows Command Shell

            1
            T1059.003

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            Modify Registry

            1
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Process Discovery

            1
            T1057

            Query Registry

            1
            T1012

            System Network Configuration Discovery

            2
            T1016

            Wi-Fi Discovery

            1
            T1016.002

            Lateral Movement

            Collection

            Data from Local System

            1
            T1005

            Command and Control

            Web Service

            1
            T1102

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            VCRUNTIME140.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29362\VCRUNTIME140.dll
            • Size 174KB
            • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            VCRUNTIME140_1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29362\VCRUNTIME140_1.dll
            • Size 48KB
            • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _bz2.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29362\_bz2.pyd
            • Size 86KB
            • SHA256 b938073c85cf6b9fe80556d7899ed1901e5e60b7adea2832442376239fb36b36
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ctypes.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29362\_ctypes.pyd
            • Size 139KB
            • SHA256 408cc4e7a22ffa418ca52f5e13fe9268a3c50a2bc9de02b0530b555ef591bc5a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _hashlib.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29362\_hashlib.pyd
            • Size 67KB
            • SHA256 5933ef5eda7c0bca0b3874a6e2c5f13b91b8f2cfc29bc46160df3212a1dbee79
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _lzma.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29362\_lzma.pyd
            • Size 157KB
            • SHA256 d2abf8db7fb0cf6285663b177991691a41b37e215c3d71fd087a98d8ec1bee63
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _socket.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29362\_socket.pyd
            • Size 85KB
            • SHA256 02265dd0d0287f3ffd287ea5d8e3c918a5a056e8ef2c4529857f5e84ec9e2519
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _sqlite3.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29362\_sqlite3.pyd
            • Size 129KB
            • SHA256 ec9694e5929747e93e05bc32427d24350dc4de5074b61a37bc961c3048794a67
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _ssl.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29362\_ssl.pyd
            • Size 186KB
            • SHA256 4cfb154c7cc525d57020c0e64f2dd876a78b46cd38419446392478de6b7b13b8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _wmi.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29362\_wmi.pyd
            • Size 39KB
            • SHA256 b6fd41f079da0c0054829855360e88b8b762f5c42bb474c2fa02eae367839ad2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            _zstd.pyd
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29362\_zstd.pyd
            • Size 491KB
            • SHA256 33c6eca99470c3eb9d776b617c550ad41b002a668336f062a9ab7be677a7409a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            base_library.zip
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29362\base_library.zip
            • Size 1.3MB
            • SHA256 933d37fc11a1acc90eb5827d201fe1698c0c53f929da13938a7572e52cbc636d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libcrypto-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29362\libcrypto-3.dll
            • Size 6.0MB
            • SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libffi-8.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29362\libffi-8.dll
            • Size 38KB
            • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libssl-3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29362\libssl-3.dll
            • Size 1.3MB
            • SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            python314.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29362\python314.dll
            • Size 6.5MB
            • SHA256 0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sqlite3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\_MEI29362\sqlite3.dll
            • Size 1.5MB
            • SHA256 9a8fb79d6b7e581d127314028dcecf754b8d7fe4aca1247f82c1f33ee8fccc7e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download