Overview

overview

9

Static

static

3

2026-10-30...om.exe

windows10-2004-x64

9

2026-10-30...om.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/10/2026, 17:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
  • Size 25.1MB
  • Sample261030-wcb3jsdy41
  • SHA256 2fe11bf1c394cb5784874dc100602fe92fd8a93da6a34b80274c081f5db83106
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Custom signature
    Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Loads dropped DLL 5 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 21 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 50 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-30_c30a8624812a9256723c07ec7e678531_blankgrabber_cobalt-strike_icedid_njrat_satacom.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:452
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c ""C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB & "
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3896
      • C:\Windows\system32\sc.exe
        "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
        3⤵
        • Launches sc.exe
        PID:1924
      • C:\Windows\system32\sc.exe
        "C:\Windows\system32\sc.exe" delete ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
        3⤵
        • Launches sc.exe
        PID:3988
    • C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
      2⤵
      • Launches sc.exe
      PID:4036
    • C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
      2⤵
      • Launches sc.exe
      PID:1764
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:584
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"
      2⤵
      • Loads dropped DLL
      PID:4648
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Downloads MZ/PE file
      • Loads dropped DLL
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:32
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:3860
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:748

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Command Shell

        1
        T1059.003

        System Services

        1
        T1569

        Service Execution

        1
        T1569.002

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Active Setup

        1
        T1547.014

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Active Setup

        1
        T1547.014

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Component Object Model Hijacking

        1
        T1546.015

        Defense Evasion

        Impair Defenses

        1
        T1562

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        2
        T1120

        Query Registry

        5
        T1012

        System Information Discovery

        4
        T1082

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Service Stop

        1
        T1489

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ExplorerPatcher.amd64.dll
        • Path C:\Program Files\ExplorerPatcher\ExplorerPatcher.amd64.dll
        • Size 629KB
        • SHA256 d4ff82c450936e5832b3e658ae912570ae63699d64b980d8b137cb562440e35c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WebView2Loader.dll
        • Path C:\Program Files\ExplorerPatcher\WebView2Loader.dll
        • Size 153KB
        • SHA256 fb82ac089963e1dee932acce2f86ba34c128770cec4b60bcfd86f95d29e971ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ep_gui.dll
        • Path C:\Program Files\ExplorerPatcher\ep_gui.dll
        • Size 1023KB
        • SHA256 3a5dbd13e171e011493bc3fc348ac728caa8fed990c444bde28530800321932e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ep_weather_host.dll
        • Path C:\Program Files\ExplorerPatcher\ep_weather_host.dll
        • Size 242KB
        • SHA256 e5f60642fe2d8e1c9d742af831a640e7baafd8a8d6212f04670ce264834b3e11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ep_weather_host_stub.dll
        • Path C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll
        • Size 107KB
        • SHA256 fde96f8f288cddce13617744822312798d8bae69b12b7fe04560322c78469572
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Properties (ExplorerPatcher).lnk
        • Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk
        • Size 1KB
        • SHA256 da974ccbec371584d6a7e94079d9fec9601c6c12f68af0832ecb445c937075f9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        microsoft.windows[1].xml
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\GWGDD6W0\microsoft.windows[1].xml
        • Size 97B
        • SHA256 5bdbe15e564e471f0573760bd1a1d30e0fa7514a67b9814b746aa3dfe95ea109
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{A5E73466-E220-8EF4-B956-A582187356D9}
        • Size 36KB
        • SHA256 813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cleanmgr_exe
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cleanmgr_exe
        • Size 36KB
        • SHA256 f160948153cf32d47d35bea85eccd51929566e662c6eca6f838515b0860704c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppCache134378560027993827.txt.~tmp
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134378560027993827.txt.~tmp
        • Size 77KB
        • SHA256 f643ec5fcff5bd6897430f75d3f1220e4fa6f9a9d9b4bec0c89e36547b05095c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StartUI.pdb
        • Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartUI.pdb
        • Size 35.4MB
        • SHA256 37daf447f92f6d910d69fd8b9d549aa3d098dc38b374a63e83b15ca16f26504c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        twinui.pcshell.pdb
        • Path C:\Users\Admin\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb
        • Size 17.9MB
        • SHA256 589c2ff9e4ac0465a8b682d6fb988c81b4e91af9f760d174811315681d94b954
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/32-58-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-52-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-57-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-62-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-65-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-76-0x00007FFCE3480000-0x00007FFCE3490000-memory.dmp
        Download

        memory/32-78-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-77-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-74-0x00007FFCE3480000-0x00007FFCE3490000-memory.dmp
        Download

        memory/32-72-0x00007FFD0E520000-0x00007FFD0EB46000-memory.dmp
        Download

        memory/32-71-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-70-0x00007FFCE3480000-0x00007FFCE3490000-memory.dmp
        Download

        memory/32-68-0x00007FFCE3480000-0x00007FFCE3490000-memory.dmp
        Download

        memory/32-66-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-64-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-63-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-61-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-59-0x00007FF61A970000-0x00007FF61A980000-memory.dmp
        Download

        memory/32-47-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-56-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-55-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-54-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-53-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-51-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-49-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-48-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-46-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-45-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-50-0x00007FF65A750000-0x00007FF65ABED000-memory.dmp
        Download

        memory/32-39-0x00007FFD0ECE0000-0x00007FFD0EF00000-memory.dmp
        Download

        memory/32-38-0x00007FFD0ECE0000-0x00007FFD0EF00000-memory.dmp
        Download

        memory/32-37-0x00007FFD0ECE0000-0x00007FFD0EF00000-memory.dmp
        Download

        memory/32-36-0x00007FFCE3480000-0x00007FFCE3490000-memory.dmp
        Download

        memory/32-33-0x00007FFCE3480000-0x00007FFCE3490000-memory.dmp
        Download

        memory/32-44-0x00007FFD226E0000-0x00007FFD22881000-memory.dmp
        Download

        memory/32-40-0x00007FFD0ECE0000-0x00007FFD0EF00000-memory.dmp
        Download

        memory/32-97-0x0000000002F20000-0x0000000002F21000-memory.dmp
        Download

        memory/32-32-0x00007FFD22F20000-0x00007FFD2365F000-memory.dmp
        Download

        memory/32-35-0x00007FFD0ECE0000-0x00007FFD0EF00000-memory.dmp
        Download

        memory/32-34-0x00007FFD22F20000-0x00007FFD2365F000-memory.dmp
        Download

        memory/32-43-0x00007FFCE3480000-0x00007FFCE3490000-memory.dmp
        Download

        memory/32-42-0x00007FFD0ECE0000-0x00007FFD0EF00000-memory.dmp
        Download

        memory/32-41-0x00007FFD0ECE0000-0x00007FFD0EF00000-memory.dmp
        Download

        memory/748-140-0x000001BDD2270000-0x000001BDD2290000-memory.dmp
        Download

        memory/748-106-0x000001BDD1EA0000-0x000001BDD1EC0000-memory.dmp
        Download

        memory/748-129-0x000001BDD1E60000-0x000001BDD1E80000-memory.dmp
        Download

        memory/748-101-0x000001BDD0D00000-0x000001BDD0E00000-memory.dmp
        Download

        memory/748-103-0x000001BDD0D00000-0x000001BDD0E00000-memory.dmp
        Download