Overview

overview

7

Static

static

3

2026-11-12...om.exe

windows10-2004-x64

7

2026-11-12...om.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 08:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-12_0882ff2113a5afb6b667d776588cae66_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
  • Size 36.4MB
  • Sample261113-krml2ssw7l
  • SHA256 65077c43649a45a25652c233da66a94daf785d2c8cb7dd42b19e008797a05b37
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Loads dropped DLL 59 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 1 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-12_0882ff2113a5afb6b667d776588cae66_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-12_0882ff2113a5afb6b667d776588cae66_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4252
    • C:\Users\Admin\AppData\Local\Temp\2026-11-12_0882ff2113a5afb6b667d776588cae66_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-11-12_0882ff2113a5afb6b667d776588cae66_blankgrabber_cobalt-strike_coinminer_icedid_njrat_satacom.exe
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4572
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:4760

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _SHA256.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\Cryptodome\Hash\_SHA256.pyd
        • Size 21KB
        • SHA256 e3437cff63cc31509050697bec17f29b24a2842aafbba78238281b5cc621773e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imaging.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\PIL\_imaging.pyd
        • Size 2.4MB
        • SHA256 76645d2564e7232029704c841f3804b954d414c59bb944611cc6c5bd90b11c71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\VCRUNTIME140.dll
        • Size 96KB
        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _brotli.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\_brotli.pyd
        • Size 836KB
        • SHA256 06fb0d9d73fe3ba17a06293f7294d409a0d2db8228f580389039a0837b141b5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\_bz2.pyd
        • Size 81KB
        • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\_cffi_backend.pyd
        • Size 174KB
        • SHA256 8100f667a3f64eeb37b9326d0c53a931e0ea3cea4ade5dbdc638c368355c0948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\_ctypes.pyd
        • Size 120KB
        • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\_elementtree.pyd
        • Size 123KB
        • SHA256 df71d64818cfecd61ad0122bea23b685d01bd241f1b06879a2999917818b0787
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\_hashlib.pyd
        • Size 62KB
        • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\_lzma.pyd
        • Size 154KB
        • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\_queue.pyd
        • Size 30KB
        • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\_socket.pyd
        • Size 76KB
        • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\_ssl.pyd
        • Size 155KB
        • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\_tkinter.pyd
        • Size 61KB
        • SHA256 6ff6cc788f1ab19de383810ddbd15ecd5fc8216faf5e1e406bbf9a608fbb9991
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\backports\zstd\_zstd.pyd
        • Size 568KB
        • SHA256 67ed429992845bbad6b84dce244f2c53f87165f08f42539871fea6f316ce1b80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\charset_normalizer\md.pyd
        • Size 10KB
        • SHA256 4ec4eb6ffb5b9e286897f9ea870561de463421f8312af1e976c045ad6b3f3751
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\charset_normalizer\md__mypyc.pyd
        • Size 120KB
        • SHA256 ce678f5ffa66a0b576796dadf6e1e0fdf3d10a40d056c9a58cb46d4aabb87901
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ClrLoader.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\clr_loader\ffi\dlls\amd64\ClrLoader.dll
        • Size 10KB
        • SHA256 e6cb8b51dbd5d5b5548696e6ddf17875af73b8abd99ca1572d32b1df98028591
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        blue.json
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\customtkinter\assets\themes\blue.json
        • Size 4KB
        • SHA256 c9417470c16ced7a43d6c4a8e027afa6edc62c24d5aee7c4c2dcd11385964d3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\libffi-8.dll
        • Size 34KB
        • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\libssl-1_1.dll
        • Size 686KB
        • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multidict.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\multidict\_multidict.pyd
        • Size 77KB
        • SHA256 fb947865c6931152dc3bfc8aa0c7a44483872a1ae41fdadc872bfcca24644e70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyarmor_runtime.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\pyarmor_runtime_004990\pyarmor_runtime.pyd
        • Size 617KB
        • SHA256 639ad2f20f52091c473df0d72f92152b699b65cddfdf3cc22bb6a6280d957f0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\pyexpat.pyd
        • Size 193KB
        • SHA256 d97f3e27130c267e7d3287d1b159f65559e84ead9090d02a01b4c7dc663cd509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\python311.dll
        • Size 5.5MB
        • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Python.Runtime.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\pythonnet\runtime\Python.Runtime.dll
        • Size 439KB
        • SHA256 d204ad74dc18cd07320c8e665bd32ec6549b555ce97e61e4d3cf88437a64988e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\select.pyd
        • Size 28KB
        • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        auto_crash.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\src\auto_crash.pyd
        • Size 242KB
        • SHA256 43f7bbbfd7255f02f4c11dcd445c2f86aea59b22efab3dd0e3e5b6187d35b4e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\tcl86t.dll
        • Size 1.8MB
        • SHA256 a91781fe13548b89817462b00058a75fb0b607ec8ce99d265719ced573ade7b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\tcl\encoding\cp1252.enc
        • Size 1KB
        • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        gb2312.enc
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\tcl\encoding\gb2312.enc
        • Size 84KB
        • SHA256 1700af47dc012a48cec89cf1dfae6d1d0d2f40ed731eff6ca55296a055a11c00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\tk86t.dll
        • Size 1.5MB
        • SHA256 20139f4c327711baf18289584fa0c8112f7bb3ba55475bded21f3d107672ed94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4252_403923_akqt038SyAI\unicodedata.pyd
        • Size 1.1MB
        • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4572-1058-0x00007FFCE4380000-0x00007FFCE438A000-memory.dmp
        Download

        memory/4572-1060-0x0000014079F30000-0x0000014079FA4000-memory.dmp
        Download

        memory/4572-1062-0x0000014079F00000-0x0000014079F08000-memory.dmp
        Download

        memory/4572-1057-0x0000014079E60000-0x0000014079E6A000-memory.dmp
        Download

        memory/4572-1046-0x0000014078830000-0x0000014078832000-memory.dmp
        Download

        memory/4572-1043-0x0000014078800000-0x0000014078801000-memory.dmp
        Download

        memory/4572-1061-0x0000014079F30000-0x0000014079F4A000-memory.dmp
        Download

        memory/4572-1110-0x000001407F8F0000-0x000001407F8F8000-memory.dmp
        Download

        memory/4572-1111-0x00000000655C0000-0x0000000065669000-memory.dmp
        Download

        memory/4572-1112-0x00007FFCBD750000-0x00007FFCBEACE000-memory.dmp
        Download

        memory/4572-1044-0x0000014078810000-0x0000014078812000-memory.dmp
        Download

        memory/4572-1063-0x0000014079F10000-0x0000014079F18000-memory.dmp
        Download