Overview

overview

7

Static

static

3

2026-10-30...om.exe

windows10-2004-x64

7

2026-10-30...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/10/2026, 18:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-30_bac8a99d59c865d4faf10174926267fd_blankgrabber_cobalt-strike_dosia_glassworm_icedid_njrat_quasar-rat_satacom.exe
  • Size 25.7MB
  • Sample261030-w9ppxaev7w
  • SHA256 bdd1a944075c21c41ffbd4d187beca99336f236131883d255a424198954ee4fa
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 36 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-30_bac8a99d59c865d4faf10174926267fd_blankgrabber_cobalt-strike_dosia_glassworm_icedid_njrat_quasar-rat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-30_bac8a99d59c865d4faf10174926267fd_blankgrabber_cobalt-strike_dosia_glassworm_icedid_njrat_quasar-rat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4848
    • C:\Users\Admin\AppData\Local\Temp\2026-10-30_bac8a99d59c865d4faf10174926267fd_blankgrabber_cobalt-strike_dosia_glassworm_icedid_njrat_quasar-rat_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-30_bac8a99d59c865d4faf10174926267fd_blankgrabber_cobalt-strike_dosia_glassworm_icedid_njrat_quasar-rat_satacom.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      PID:240

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\VCRUNTIME140.dll
        • Size 174KB
        • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\_asyncio.pyd
        • Size 76KB
        • SHA256 f9594a2a4f45570dbfdf1f3471194ae7b27dc117c54b9af6bc22df9c93830f8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _brotli.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\_brotli.cp314-win_amd64.pyd
        • Size 836KB
        • SHA256 44f02bcf2b15519a487cf653e16b5f9c65f26d0be559592878988ad47148fc5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\_bz2.pyd
        • Size 86KB
        • SHA256 b938073c85cf6b9fe80556d7899ed1901e5e60b7adea2832442376239fb36b36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\_ctypes.pyd
        • Size 139KB
        • SHA256 408cc4e7a22ffa418ca52f5e13fe9268a3c50a2bc9de02b0530b555ef591bc5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\_hashlib.pyd
        • Size 67KB
        • SHA256 5933ef5eda7c0bca0b3874a6e2c5f13b91b8f2cfc29bc46160df3212a1dbee79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\_lzma.pyd
        • Size 157KB
        • SHA256 d2abf8db7fb0cf6285663b177991691a41b37e215c3d71fd087a98d8ec1bee63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\_overlapped.pyd
        • Size 56KB
        • SHA256 1d7028683e6ec50c159139238f90a6c8431ece139a4764900ca11c941ba05d46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\_queue.pyd
        • Size 35KB
        • SHA256 2fd8668f52b34d0e71ae48784bd2e7d35e5d99df6f641edb0fc279235a187c8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\_socket.pyd
        • Size 85KB
        • SHA256 02265dd0d0287f3ffd287ea5d8e3c918a5a056e8ef2c4529857f5e84ec9e2519
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\_ssl.pyd
        • Size 186KB
        • SHA256 4cfb154c7cc525d57020c0e64f2dd876a78b46cd38419446392478de6b7b13b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\_uuid.pyd
        • Size 27KB
        • SHA256 fbfd7fe8583b346ba20b174b2510c0830237f5092bdf9fc26da9d6b25b018385
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\_wmi.pyd
        • Size 39KB
        • SHA256 b6fd41f079da0c0054829855360e88b8b762f5c42bb474c2fa02eae367839ad2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\_zstd.pyd
        • Size 491KB
        • SHA256 33c6eca99470c3eb9d776b617c550ad41b002a668336f062a9ab7be677a7409a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_parser.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\aiohttp\_http_parser.cp314-win_amd64.pyd
        • Size 258KB
        • SHA256 44e90b54298a360c85678e0a4e45713bcf72305c1dc05dcb06aa0a6200eef7dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_writer.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\aiohttp\_http_writer.cp314-win_amd64.pyd
        • Size 43KB
        • SHA256 471d44a62f269545f4608aef5c84a5d75fbd7a99fef2fed680fa5bccf389432d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mask.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\aiohttp\_websocket\mask.cp314-win_amd64.pyd
        • Size 34KB
        • SHA256 5f5c3de90b92c76af16b3773cb95f39d27acf2631adfa1da4e7dbf66e6be9d8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        reader_c.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\aiohttp\_websocket\reader_c.cp314-win_amd64.pyd
        • Size 138KB
        • SHA256 ace655e0e595d5f29f5347e85ed294402ea624cb57ed73a879db78c3b68b792f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\base_library.zip
        • Size 1.3MB
        • SHA256 3efb0d537b008cf542ee469e0ca06d47362a2fb123537ca3acc2261f3d5fdd83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        INSTALLER
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\h2-4.3.0.dist-info\INSTALLER
        • Size 4B
        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
        • MD5 SHA1 SHA512
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\libcrypto-3.dll
        • Size 6.0MB
        • SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\libssl-3.dll
        • Size 1.3MB
        • SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multidict.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\multidict\_multidict.cp314-win_amd64.pyd
        • Size 81KB
        • SHA256 898096c0e7dd139799eeb8985b80b6dc8e7b6735526fa5f961bea45d09cdf348
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _helpers_c.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\propcache\_helpers_c.cp314-win_amd64.pyd
        • Size 64KB
        • SHA256 cb2e3b34bafecbe41b058cf858916b092659745e3112dae913a9e390ca3b2827
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\python3.DLL
        • Size 72KB
        • SHA256 6c45910e7c82617ca6360820de861699cc99f9efee434df290aa4c6e38f39886
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\python314.dll
        • Size 6.5MB
        • SHA256 0f9857ffdfe010fe6b99328d58c2e3c7472ce75f336bf9c2ad9bd5bca3bce700
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Banjul
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Africa\Banjul
        • Size 148B
        • SHA256 d2efac4e5f23d88c95d72c1db42807170f52f43dd98a205af5a92a91b9f2d997
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Dar_es_Salaam
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Africa\Dar_es_Salaam
        • Size 265B
        • SHA256 c89b2e253a8926a6cecf7eff34e4bfcdb7fe24daff22d84718c30deec0ea4968
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Harare
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Africa\Harare
        • Size 149B
        • SHA256 444ed3a710414bc6bf43eb27e591da49d3be3db153449a6a0c9473f7e39fdbcb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Kinshasa
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Africa\Kinshasa
        • Size 235B
        • SHA256 cffeb0282ccbd7fba0e493ff8677a1e5a6dd5197885042e437f95a773f844846
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Blanc-Sablon
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\America\Blanc-Sablon
        • Size 246B
        • SHA256 8491e557ff801a8306516b8ca5946ff5f2e6821af31477eb47d7d191cc5a6497
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Panama
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\America\Panama
        • Size 182B
        • SHA256 91ac80fe976931c490d058c8ce8b5d71ffa6d4961f6ca13ea9c153f0b0bccea0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Thunder_Bay
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\America\Thunder_Bay
        • Size 3KB
        • SHA256 a587a1a1607439f7bac283e1815f2bdbafb9649a453d18e06c2e44e6996d888f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Riyadh
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Asia\Riyadh
        • Size 151B
        • SHA256 a02287eee69f37c475a3e8a35c6a13e54d49671c2fa0bcc9bbfd82ab28b68543
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Shanghai
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Asia\Shanghai
        • Size 561B
        • SHA256 64ffc2e43a94435a043c040d1d3af7e92d031adc78e7737af1861baa4eeef3e6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Sydney
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Australia\Sydney
        • Size 2KB
        • SHA256 42c3857585b16db2f8ffd47ba19faa60f473340de8d4fe9320ea7be861605906
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        GMT0
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Etc\GMT0
        • Size 114B
        • SHA256 6d9f378883c079f86c0387a5547a92c449869d806e07de10084ab04f0249018d
        • MD5 SHA1 SHA512
        Submit Download

        Zulu
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Etc\Zulu
        • Size 114B
        • SHA256 8b85846791ab2c8a5463c83a5be3c043e2570d7448434d41398969ed47e3e6f2
        • MD5 SHA1 SHA512
        Submit Download

        Copenhagen
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Europe\Copenhagen
        • Size 2KB
        • SHA256 5ee475f71a0fc1a32faeb849f8c39c6e7aa66d6d41ec742b97b3a7436b3b0701
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Guernsey
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Europe\Guernsey
        • Size 3KB
        • SHA256 c85495070dca42687df6a1c3ee780a27cbcb82f1844750ea6f642833a44d29b4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Luxembourg
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Europe\Luxembourg
        • Size 2KB
        • SHA256 812f55aeb6e8cde9ddf4786e15eb4256b21e82cf5f5d28da1bad17d94570cac0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Sarajevo
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Europe\Sarajevo
        • Size 1KB
        • SHA256 3a95adb06156044fd2fa662841c0268c2b5af47c1b19000d9d299563d387093a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Zaporozhye
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Europe\Zaporozhye
        • Size 2KB
        • SHA256 fb0ae91bd8cfb882853f5360055be7c6c3117fd2ff879cf727a4378e3d40c0d3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Christmas
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Indian\Christmas
        • Size 185B
        • SHA256 85fff93d57a041c1524bad028d2f340bb87e4c63ab7d0e27726f3737c5666649
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Reunion
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Indian\Reunion
        • Size 151B
        • SHA256 a667613e16894702b038dbf18993467854880a3956cf263d265147bfe1fdba96
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        BajaNorte
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Mexico\BajaNorte
        • Size 2KB
        • SHA256 8c2e7b321726e6345912da396796bdb3672bfc4bd1a91c65ee58b38e004d4ca5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Navajo
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Navajo
        • Size 2KB
        • SHA256 32e819c00a43b3c348f539d700d425504f20b8d068c16418d26fa9b693e775c9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Auckland
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Pacific\Auckland
        • Size 2KB
        • SHA256 8000e3a323e8fd0212414e9426b020707a771c368ca0e151747f9ddb7b814b27
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Truk
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Pacific\Truk
        • Size 172B
        • SHA256 9c1dfa1c15994dd8774e53f40cb14dcf529143468721f1dba7b2c2e14ae9f5f0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Wake
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\Pacific\Wake
        • Size 152B
        • SHA256 53268a8a6b11f0b8e02fc67683ae48d074efaf7b4c66e036c1478107afd9a7d7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Arizona
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\US\Arizona
        • Size 360B
        • SHA256 8a5973d2c62e2cbf2520f2b44e4a2ee9d2f455c93f0f45bfdeb4533af1584664
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        East-Indiana
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\US\East-Indiana
        • Size 1KB
        • SHA256 90d2b2f4a8fd202b226187c209b020833300edec5ff86a463ccc685e8707532c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Hawaii
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\US\Hawaii
        • Size 329B
        • SHA256 7f03d1bf5264e7ab023a2ef9b997ddfc8cb6936692407c770762b9c549523f33
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Samoa
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\pytz\zoneinfo\US\Samoa
        • Size 175B
        • SHA256 7c262b62985863aad47f13b0ef5db2e5cc917b5d38002de9a2ea83ddb0883458
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\select.pyd
        • Size 32KB
        • SHA256 722328e7fad8048057fc966474ba73966d2ceebaa32e7344cce09640ab4dc9bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\ucrtbase.dll
        • Size 1.1MB
        • SHA256 4a4a407662465c3d1f5d808af3d9fd084baa064bebe62c6c205faec63d308492
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\unicodedata.pyd
        • Size 741KB
        • SHA256 280b09bd97b598d18c0ed9542dc18ed35fa57a16e84f8e65fd9c6e96516c28d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _quoting_c.cp314-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI000012f02\yarl\_quoting_c.cp314-win_amd64.pyd
        • Size 80KB
        • SHA256 3912a5ed94d6928ea73abf3308dcd40fe67223a037846d10d3a773203d807beb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/240-783-0x0000019D64B40000-0x0000019D65236000-memory.dmp
        Download