Analysis
- max time kernel
150s - max time network
145s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
28/05/2026, 00:51
General
- Target 2026-05-28_7d888f10a341e1852f104140c2db4ac4_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
- Size 15.4MB
- Sample260528-a7k32set4w
- SHA256 a4f87e76f848891c74b1ce4898e62b1829c09015667d3b7f7220628c25ee4540
Malware Config
Signatures
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 5 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 5 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 5 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Kills process with taskkill 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_7d888f10a341e1852f104140c2db4ac4_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_7d888f10a341e1852f104140c2db4ac4_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_7d888f10a341e1852f104140c2db4ac4_blankgrabber_coinminer_icedid_luca-stealer_njrat.exeC:\Users\Admin\AppData\Local\Temp\2026-05-28_7d888f10a341e1852f104140c2db4ac4_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_7d888f10a341e1852f104140c2db4ac4_blankgrabber_coinminer_icedid_luca-stealer_njrat.exeC:\Users\Admin\AppData\Local\Temp\2026-05-28_7d888f10a341e1852f104140c2db4ac4_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe -m pip install pycryptodome requests psutil --quiet3⤵
- Loads dropped DLL
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "UpdateTask" /tr "C:\Users\Admin\AppData\Roaming\Update.exe" /sc onlogon /f"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "UpdateTask" /tr "C:\Users\Admin\AppData\Roaming\Update.exe" /sc onlogon /f4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Roaming\Update.exeC:\Users\Admin\AppData\Roaming\Update.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Update.exeC:\Users\Admin\AppData\Roaming\Update.exe2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Update.exeC:\Users\Admin\AppData\Roaming\Update.exe -m pip install pycryptodome requests psutil --quiet3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Users\Admin\AppData\Roaming\Update.exe"C:\Users\Admin\AppData\Roaming\Update.exe" "--multiprocessing-fork" "parent_pid=3400" "pipe_handle=904"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Update.exeC:\Users\Admin\AppData\Roaming\Update.exe -m pip install pycryptodome requests psutil --quiet4⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Telegram.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\tmpmqxrljoi.ps13⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_q2imvfd4.sd3.ps1
81d243bd2c585b0f4821__mypyc.pyd
_raw_aes.pyd
_raw_aesni.pyd
_SHA224.pyd
_cpuid_c.pyd
VCRUNTIME140.dll
_bz2.pyd
_cffi_backend.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
cd.pyd
md.pyd
_rust.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
output.dll
_psutil_windows.pyd
python3.dll
python313.dll
select.pyd
sqlite3.dll
unicodedata.pyd
vcruntime140_1.dll
memory/3960-243-0x0000019D72020000-0x0000019D73BFC000-memory.dmp
memory/3960-244-0x0000019D72020000-0x0000019D73BFC000-memory.dmp
memory/3960-145-0x0000019D72020000-0x0000019D73BFC000-memory.dmp
memory/4624-296-0x00000215C1430000-0x00000215C1452000-memory.dmp
memory/4624-303-0x00000215BFBB0000-0x00000215BFBBA000-memory.dmp
memory/4624-304-0x00000215DA5C0000-0x00000215DA5E6000-memory.dmp
memory/4624-305-0x00000215C14D0000-0x00000215C14D8000-memory.dmp
memory/4624-308-0x00000215C1870000-0x00000215C2332000-memory.dmp
memory/4780-129-0x0000024D88050000-0x0000024D89C2C000-memory.dmp