Overview

overview

9

Static

static

3

2026-05-17...at.exe

windows10-2004-x64

9

2026-05-17...at.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    17/05/2026, 14:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-17_ec80cb3f25ba05d6c146a7c0243d7c0f_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
  • Size 17.8MB
  • Sample260517-rlwfbshx7x
  • SHA256 6291543623448b3889845c45099fab31c726147a000c08ee499dd573d585a332
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasion

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
    defense_evasion
  • Looks for VMWare services registry key. 1 TTPs 2 IoCs
    defense_evasion
  • Loads dropped DLL 55 IoCs
  • Modifies boot configuration data using bcdedit 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-17_ec80cb3f25ba05d6c146a7c0243d7c0f_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-17_ec80cb3f25ba05d6c146a7c0243d7c0f_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4408
    • C:\Users\Admin\AppData\Local\Temp\2026-05-17_ec80cb3f25ba05d6c146a7c0243d7c0f_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
      C:\Users\Admin\AppData\Local\Temp\2026-05-17_ec80cb3f25ba05d6c146a7c0243d7c0f_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
      2⤵
      • Enumerates VirtualBox registry keys
      • Looks for VMWare services registry key.
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Enumerates system info in registry
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2968
      • C:\Windows\SYSTEM32\bcdedit.exe
        bcdedit /enum {current}
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:3708

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd
        • Size 154KB
        • SHA256 b095fa2eac97496b515031fbea5737988b18deee86a11f2784f5a551732ddc0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_wmi.pyd
        • Size 37KB
        • SHA256 b0ed1c62b73b291a1b57e3d8882cc269b2fcbb1253f2947da18d9036e0c985d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\base.pyd
        • Size 30KB
        • SHA256 59fd2c87c8261f8de69fb70f881b41a13e522119503ae18fc068d607b4754bfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        math.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pygame\math.pyd
        • Size 75KB
        • SHA256 515e2cf7344b6daedd464f567ca99978a47da14719b7f5a092c69a252b16c5f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\SDL2.dll
        • Size 2.4MB
        • SHA256 520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\_bz2.pyd
        • Size 82KB
        • SHA256 160b5218c2035cccbaab9dc4ca26d099f433dcb86dbbd96425c933dc796090df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\_hashlib.pyd
        • Size 64KB
        • SHA256 b4cec162b985d34ab768f66e8fa41ed28dc2f273fde6670eeace1d695789b137
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\_socket.pyd
        • Size 81KB
        • SHA256 ce3090fff8575b21287df5fc69ae98806646fc302eefadf85e369ad3debad92b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\_ssl.pyd
        • Size 173KB
        • SHA256 61f00b0543464bba61e0bd1128118326c9bd0cdc592854dd1a31c3d6d8df2b83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\_uuid.pyd
        • Size 25KB
        • SHA256 869361adf2be930e5c8b492fa2116dc0d0edccbf2c231d39c859ce320be27b31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libpng16-16.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\libpng16-16.dll
        • Size 206KB
        • SHA256 e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bufferproxy.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\pygame\bufferproxy.pyd
        • Size 18KB
        • SHA256 7b1de4a711ac3b8c870a70d1b5db3a3684efd5ab258c4e1c42e715bd6e0a500c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        color.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\pygame\color.pyd
        • Size 35KB
        • SHA256 f1532048d8d89e0aff5a79f0dd96edaf7e75665c0292032c2b69a90374b4582a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        constants.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\pygame\constants.pyd
        • Size 49KB
        • SHA256 99ef70bf473e1241a433f33dc7ec89dff64c831999de68612f2e642fd4a1d5dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        display.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\pygame\display.pyd
        • Size 44KB
        • SHA256 6ce7e1f477c4aa614b1231b1a2ce345662bb36ed590157d48e219219f7459970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        draw.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\pygame\draw.pyd
        • Size 49KB
        • SHA256 18e7ec3c61c272318b08adb7c5466c334abf6f75becc5824f5ab8fdc5f6e9a31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        event.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\pygame\event.pyd
        • Size 43KB
        • SHA256 b9a3dabaa705c50d3d78505195eb609e7883c01ec080db2f21e7251025b3309c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        image.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\pygame\image.pyd
        • Size 29KB
        • SHA256 a6100714b22ceb504bc5a303f86ac28ceb1ac47796175f101e23e869eba4480c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        imageext.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\pygame\imageext.pyd
        • Size 17KB
        • SHA256 7ff15e58ae5f0de963508bf002d99363b7e9594a09beabdd99f5d9fb1edce0e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rect.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\pygame\rect.pyd
        • Size 44KB
        • SHA256 38d709cb73a98dd54d666689212bfdddc2a68fcc4541c3b59a741815e4688b7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rwobject.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\pygame\rwobject.pyd
        • Size 19KB
        • SHA256 b658da9b9b207f73325b9e9b84029258e64e324b8935671ce79b49f28a26b87e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        surface.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\pygame\surface.pyd
        • Size 234KB
        • SHA256 bc64469279ac571f08173b2a09da78f1c0af3276e531fdf12ec3f9e9eca8fdde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        surflock.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\pygame\surflock.pyd
        • Size 13KB
        • SHA256 6c0c944037dc7a23e4ca6683d58085752453faf3be1e776a0ebd33f3d0fda8d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\python312.dll
        • Size 6.6MB
        • SHA256 93488fa7e631cc0a2bd808b9eee8617280ee9b6ff499ab424a1a1cbf24d77dc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sdl2_image.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\sdl2_image.dll
        • Size 122KB
        • SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\select.pyd
        • Size 30KB
        • SHA256 dca5e6d39c5094ce599143cb82f6d8470f0c2a4ce4443499e73f32ed13333fd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        test1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\test1.dll
        • Size 19.9MB
        • SHA256 fce073e0b4840d0afd91ea57655f8fc1a9139e6058afe5782c6b4ef742fe51c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\vcruntime140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\vcruntime140_1.dll
        • Size 48KB
        • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4408_134237658614141737\zlib1.dll
        • Size 106KB
        • SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2968-155-0x00007FF8A8E40000-0x00007FF8A90AC000-memory.dmp
        Download

        memory/2968-171-0x00007FF8A8E40000-0x00007FF8A90AC000-memory.dmp
        Download

        memory/2968-149-0x0000000068B40000-0x0000000068B7C000-memory.dmp
        Download

        memory/2968-147-0x00007FF8A8E40000-0x00007FF8A90AC000-memory.dmp
        Download

        memory/2968-151-0x00007FF8A8E40000-0x00007FF8A90AC000-memory.dmp
        Download

        memory/2968-148-0x000000006A880000-0x000000006A8A7000-memory.dmp
        Download

        memory/2968-159-0x00007FF8A8E40000-0x00007FF8A90AC000-memory.dmp
        Download

        memory/2968-163-0x00007FF8A8E40000-0x00007FF8A90AC000-memory.dmp
        Download

        memory/2968-167-0x00007FF8A8E40000-0x00007FF8A90AC000-memory.dmp
        Download

        memory/2968-150-0x0000000062E80000-0x0000000062EA4000-memory.dmp
        Download

        memory/2968-175-0x00007FF8A8E40000-0x00007FF8A90AC000-memory.dmp
        Download

        memory/2968-179-0x00007FF8A8E40000-0x00007FF8A90AC000-memory.dmp
        Download

        memory/2968-183-0x00007FF8A8E40000-0x00007FF8A90AC000-memory.dmp
        Download

        memory/2968-187-0x00007FF8A8E40000-0x00007FF8A90AC000-memory.dmp
        Download

        memory/2968-191-0x00007FF8A8E40000-0x00007FF8A90AC000-memory.dmp
        Download

        memory/2968-195-0x00007FF8A8E40000-0x00007FF8A90AC000-memory.dmp
        Download

        memory/2968-199-0x00007FF8A8E40000-0x00007FF8A90AC000-memory.dmp
        Download