Overview

overview

7

Static

static

3

2026-11-01...om.exe

windows10-2004-x64

7

2026-11-01...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/11/2026, 06:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_dceca3d01e9e182432047dc18583af00_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
  • Size 49.8MB
  • Sample261102-g71basfx3t
  • SHA256 2bd420df9b1ad942c7c8667cf6971efe95fb4052de9867f90303e9260ed8efd0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 28 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_dceca3d01e9e182432047dc18583af00_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_dceca3d01e9e182432047dc18583af00_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5720
    • C:\Users\Admin\AppData\Local\Temp\2026-11-01_dceca3d01e9e182432047dc18583af00_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-11-01_dceca3d01e9e182432047dc18583af00_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      PID:5308

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\_bz2.pyd
        • Size 84KB
        • SHA256 6da4d453852346299e983b458f3ec2f0db3b5f765998ba3f45c91b4a1549037b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\_ctypes.pyd
        • Size 131KB
        • SHA256 5bcddf4c374c4d247e1e4a61f3347159c36c5785fe43bdae11a4e6c9ea2c0166
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\_hashlib.pyd
        • Size 67KB
        • SHA256 4d3eb9d9492d626c7bb10cfe5ab233a9195ec7b27e92b465b287e7a24fc8266c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\_lzma.pyd
        • Size 155KB
        • SHA256 2b4dcb12c0420ffced4b91968ae4eff6cb585f0f07490160c6da47da63064a99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\_queue.pyd
        • Size 34KB
        • SHA256 79c196a0804b152fc48b4055387f4352838e41c28863a0c946e7a98137e681e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\_socket.pyd
        • Size 84KB
        • SHA256 c5936292083189e0675a96ddd0e38235726f1c58195cec64eb0085b9c479ddce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\_ssl.pyd
        • Size 186KB
        • SHA256 30ff82a3ea0c675ddc99e6b14f71ca750f06e77d6653e2da3d7d35b7ef0fc2ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\_tkinter.pyd
        • Size 68KB
        • SHA256 426c1761322019d382da2b7154786809ee39f7680b130ea405294b8adcc89baf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\_wmi.pyd
        • Size 38KB
        • SHA256 f88c322f871aef92de562278bd25c34c6e758642669d5512a22ed972840317b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        blue.json
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\customtkinter\assets\themes\blue.json
        • Size 4KB
        • SHA256 a9c10c997a2281b57b60ff9325c9c0b2dbebe498722f3fbc7c585ec9fe1aa352
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dark-blue.json
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\customtkinter\assets\themes\dark-blue.json
        • Size 4KB
        • SHA256 a4e3b7155bf29c5fd62a13a4d13b4ae5aa74d3f09fd9295656cedfab63804ffb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        krnl_afk.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\krnl_afk.dll
        • Size 20.2MB
        • SHA256 892183707e7f1864867dd2d8f5ddcd1b4d2005ac7abcc652820632f9efcf5e04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\libcrypto-3.dll
        • Size 5.7MB
        • SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\libssl-3.dll
        • Size 1.2MB
        • SHA256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\numpy.libs\libscipy_openblas64_-ed4f167a5330424524f45258e7ca2c8d.dll
        • Size 19.6MB
        • SHA256 ed4f167a5330424524f45258e7ca2c8d7f03c0cba1f30ee4985553ac1f88ecf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\numpy.libs\msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
        • Size 561KB
        • SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiarray_umath.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\numpy\_core\_multiarray_umath.pyd
        • Size 3.7MB
        • SHA256 db35bf93aeb4bb054c87b525cc83e8dbcbf00c6555ab8599c5cb83f6b0662da9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _umath_linalg.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\numpy\linalg\_umath_linalg.pyd
        • Size 109KB
        • SHA256 2e9de32125fbcaeace0c92b03d73b8aa2350145745b1c8becf630b2115e72a1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\python3.dll
        • Size 70KB
        • SHA256 a1a32b2475675e784d9b34d33d3a8f3e4afaa563da1feb784b0dd69fc4d8f9dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\python313.dll
        • Size 5.9MB
        • SHA256 3b29bf9ff39bed8f660f5b935f19657f7ce7f145009851741b11364f6ebcb862
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\select.pyd
        • Size 32KB
        • SHA256 17df388a7aa42e7f066b80aa4f77cbbba9286495e6f3508425806be6766d122b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\tcl86t.dll
        • Size 1.8MB
        • SHA256 a308beae8555cff5ac2aff7eaf0aef40b5fe173f047e246dc49da9a4d3ef62f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msgcat-1.6.1.tm
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\tcl8\8.5\msgcat-1.6.1.tm
        • Size 34KB
        • SHA256 adca186be560f2236265f538d4cb6df1171bed91192118796988bb9c08a4bc7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        auto.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\tcl\auto.tcl
        • Size 21KB
        • SHA256 08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\tcl\encoding\cp1252.enc
        • Size 1KB
        • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        init.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\tcl\init.tcl
        • Size 25KB
        • SHA256 acacce15658dd7ce8f69b1e3d3a94770a22972a8e906eb3b61cd06f0ecd5db59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        package.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\tcl\package.tcl
        • Size 23KB
        • SHA256 b471cec9056b62d562020b14d69d4bd1f92dfe158afc8ba81c6341836211ca46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tclIndex
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\tcl\tclIndex
        • Size 7KB
        • SHA256 577f042bbe640e2739606a1f76098abdb8bd1d1f31526402fb82b21091644f65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tm.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\tcl\tm.tcl
        • Size 11KB
        • SHA256 f0cc13daca21fee538cca757aa09e88a969a85174eda26e61e573dda6c7ba413
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\tk86t.dll
        • Size 1.5MB
        • SHA256 20f4876506bce7f89e53570e64fd1dce30a64548326b45f372871c7019560df4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\tk\tk.tcl
        • Size 23KB
        • SHA256 b7fd24177b17f67da2ca671f711309c65cf246be1fd0cf4f1ab8f3ea9ca2c3f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\vcruntime140.dll
        • Size 174KB
        • SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\vcruntime140_1.dll
        • Size 48KB
        • SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5720_434060_aO3bTVpZ27o\zlib1.dll
        • Size 142KB
        • SHA256 1dd27f0411ebb31bd148a61589cee254410915f1e6c37aa3ffa52fac71a5426c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5308-1049-0x00007FFA03C40000-0x00007FFA03C69000-memory.dmp
        Download

        memory/5308-1050-0x00007FF9F2730000-0x00007FF9F3ADD000-memory.dmp
        Download

        memory/5308-1051-0x000002A29C0F0000-0x000002A2A13F3000-memory.dmp
        Download