Overview

overview

7

Static

static

3

2026-04-16...oa.exe

windows10-2004-x64

7

2026-04-16...oa.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    16/04/2026, 16:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-16_310f087b30b10e3fe96e5bf5aae8af06_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
  • Size 66.8MB
  • Sample260416-tkpmhaey2p
  • SHA256 3dc035e86ac96d13c8db43888af7a5aa77617383bd66bea1ec2fe25a10fde024
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 27 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-16_310f087b30b10e3fe96e5bf5aae8af06_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-16_310f087b30b10e3fe96e5bf5aae8af06_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5384
    • C:\Users\Admin\AppData\Local\Temp\2026-04-16_310f087b30b10e3fe96e5bf5aae8af06_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
      C:\Users\Admin\AppData\Local\Temp\2026-04-16_310f087b30b10e3fe96e5bf5aae8af06_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      PID:4376

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\MSVCP140.dll
        • Size 540KB
        • SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\MSVCP140_2.dll
        • Size 272KB
        • SHA256 1d60da3ac2b06482912ca852fa7047436e6e474b4cfffa3bf77f4598cfbf454c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qminimal.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt6\Qt6\plugins\platforms\qminimal.dll
        • Size 60KB
        • SHA256 dcff6be588488da37b817c2eb37fc679c056ef587a25520ab1a7700af2161850
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qoffscreen.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt6\Qt6\plugins\platforms\qoffscreen.dll
        • Size 111KB
        • SHA256 c8b67c7a233bc1c727f3f8fe1bcd4f4e36f61a5e5b7dbee0913920e178523470
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwindows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt6\Qt6\plugins\platforms\qwindows.dll
        • Size 974KB
        • SHA256 540211565db496024246cb8a44437212e6b967f3ee7b899e888f41cc556bf041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt6\QtCore.pyd
        • Size 2.5MB
        • SHA256 9306ceffdc3b663f90fc446800be4ab870887c0bf3c38dc16b00e070e519d895
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PyQt6\QtWidgets.pyd
        • Size 4.9MB
        • SHA256 a5e78921d92d4b4975edbd441369ef7ab689e336d1b40d8555728880f0503fd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Qt6Core.dll
        • Size 9.8MB
        • SHA256 b98eea394a95563879b614dbd4432ce074b0fceeb154c3bae252f4e7a9376a40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 28ca8b9e7d3d1c4e3cfafd6fe63877a05cf10202a240134a11f98384f01c9e37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
        • Size 82KB
        • SHA256 02d772c03704fe243c8de2672c210a5804d075c1f75e738d6130a173d08dfcde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
        • Size 121KB
        • SHA256 bc3b83d2dc9e2f0e6386ed952384c6cf48f6eed51129a50dfd5ef6cbbc0a8fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_hashlib.pyd
        • Size 63KB
        • SHA256 e47e76d70d508b62924fe480f30e615b12fdd7745c0aac68a2cddabd07b692ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd
        • Size 155KB
        • SHA256 34130d8abe27586ee315262d69af4e27429b7eab1f3131ea375c2bb62cf094be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-3.dll
        • Size 4.9MB
        • SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Main.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5384_134208292833727291\Main.dll
        • Size 5.9MB
        • SHA256 220c3b0fe4e5c1102829c8eec0ea10761638298db9b7ba23fecf5f1e749d37f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qmodernwindowsstyle.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5384_134208292833727291\PyQt6\Qt6\plugins\styles\qmodernwindowsstyle.dll
        • Size 215KB
        • SHA256 f9ddcd6f6319be76ec8ea1b95e6829cdc0f9600242b6bdd07babb0185e9762ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5384_134208292833727291\PyQt6\QtGui.pyd
        • Size 2.2MB
        • SHA256 78f1acd16154a241101ead83c845388394526b9e4ddc7bdc914d22d96710f7bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5384_134208292833727291\PyQt6\sip.pyd
        • Size 108KB
        • SHA256 4f9b530b045d07007b2bda07580c0ef031a973b8ebd577ae9f533fe52e2bb894
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5384_134208292833727291\_wmi.pyd
        • Size 35KB
        • SHA256 79adca5037d9145309d3bd19f7a26f7bb7da716ee86e01073c6f2a9681e33dad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5384_134208292833727291\msvcp140_1.dll
        • Size 34KB
        • SHA256 2dd670f874562fbdca5b022df1943d70a57ba91fde559280e3a1daebe4db2380
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5384_134208292833727291\python3.dll
        • Size 66KB
        • SHA256 1e9224ba7190b6301ef47befa8e383d0c55700255d04a36f7dac88ea9573f2fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5384_134208292833727291\python312.dll
        • Size 6.6MB
        • SHA256 e7890e38256f04ee0b55ac5276bbf3ac61392c3a3ce150bb5497b709803e17ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qt6widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5384_134208292833727291\qt6widgets.dll
        • Size 6.3MB
        • SHA256 f383fb6b3f6996efe23327ff607e7298fc47ee76e8b8ef8a65f8d2e0a91707e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5384_134208292833727291\vcruntime140.dll
        • Size 106KB
        • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5384_134208292833727291\vcruntime140_1.dll
        • Size 48KB
        • SHA256 e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4376-88-0x00007FF8DF120000-0x00007FF8DF767000-memory.dmp
        Download

        memory/4376-97-0x00007FF8DD950000-0x00007FF8DDB84000-memory.dmp
        Download

        memory/4376-94-0x00007FF8DDB90000-0x00007FF8DDE1D000-memory.dmp
        Download

        memory/4376-89-0x00007FF8DF770000-0x00007FF8DFC50000-memory.dmp
        Download