Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/05/2026, 01:28
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
- Size 78.2MB
- Sample260528-bvm8baex7x
- SHA256 9a7be877cc59cfcdcea3cb44b8e54326dba963d8a2409a1b822255f96b8b0498
- MD5 d4a962abc8d4f6a07c8dde3644eecc07
- SHA1 87be181e2be33b2955923e781ac28ec614980773
- SHA512 cd7e98a6a444748f108b90765c06364f9ab4454e7a72b7fc5921b5fabded0c61b773a533d5d5d6ee5360aa45bcc2ad6b5000e7773bb1b290b1936e2cea9d7118
- SSDEEP 393216:7EI64mShA4qF0mHlhDCDv7aClkNRI147WBK0QSI8w5SvDazn1d5VRx+Abr7nB9GR:7QgbLfQlRXHnysf+tgPdBse6NcS
- TLSH T147087C46A7EA04D5F9F79A349AE65213C673BC463F3085CF3208172A1F736E0997A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2308 tasklist.exe -
pid Process 5976 powershell.exe - Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 3308 WMIC.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5976 powershell.exe 5976 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2308 tasklist.exe Token: SeIncreaseQuotaPrivilege 3308 WMIC.exe Token: SeSecurityPrivilege 3308 WMIC.exe Token: SeTakeOwnershipPrivilege 3308 WMIC.exe Token: SeLoadDriverPrivilege 3308 WMIC.exe Token: SeSystemProfilePrivilege 3308 WMIC.exe Token: SeSystemtimePrivilege 3308 WMIC.exe Token: SeProfSingleProcessPrivilege 3308 WMIC.exe Token: SeIncBasePriorityPrivilege 3308 WMIC.exe Token: SeCreatePagefilePrivilege 3308 WMIC.exe Token: SeBackupPrivilege 3308 WMIC.exe Token: SeRestorePrivilege 3308 WMIC.exe Token: SeShutdownPrivilege 3308 WMIC.exe Token: SeDebugPrivilege 3308 WMIC.exe Token: SeSystemEnvironmentPrivilege 3308 WMIC.exe Token: SeRemoteShutdownPrivilege 3308 WMIC.exe Token: SeUndockPrivilege 3308 WMIC.exe Token: SeManageVolumePrivilege 3308 WMIC.exe Token: 33 3308 WMIC.exe Token: 34 3308 WMIC.exe Token: 35 3308 WMIC.exe Token: 36 3308 WMIC.exe Token: SeIncreaseQuotaPrivilege 3308 WMIC.exe Token: SeSecurityPrivilege 3308 WMIC.exe Token: SeTakeOwnershipPrivilege 3308 WMIC.exe Token: SeLoadDriverPrivilege 3308 WMIC.exe Token: SeSystemProfilePrivilege 3308 WMIC.exe Token: SeSystemtimePrivilege 3308 WMIC.exe Token: SeProfSingleProcessPrivilege 3308 WMIC.exe Token: SeIncBasePriorityPrivilege 3308 WMIC.exe Token: SeCreatePagefilePrivilege 3308 WMIC.exe Token: SeBackupPrivilege 3308 WMIC.exe Token: SeRestorePrivilege 3308 WMIC.exe Token: SeShutdownPrivilege 3308 WMIC.exe Token: SeDebugPrivilege 3308 WMIC.exe Token: SeSystemEnvironmentPrivilege 3308 WMIC.exe Token: SeRemoteShutdownPrivilege 3308 WMIC.exe Token: SeUndockPrivilege 3308 WMIC.exe Token: SeManageVolumePrivilege 3308 WMIC.exe Token: 33 3308 WMIC.exe Token: 34 3308 WMIC.exe Token: 35 3308 WMIC.exe Token: 36 3308 WMIC.exe Token: SeIncreaseQuotaPrivilege 4224 WMIC.exe Token: SeSecurityPrivilege 4224 WMIC.exe Token: SeTakeOwnershipPrivilege 4224 WMIC.exe Token: SeLoadDriverPrivilege 4224 WMIC.exe Token: SeSystemProfilePrivilege 4224 WMIC.exe Token: SeSystemtimePrivilege 4224 WMIC.exe Token: SeProfSingleProcessPrivilege 4224 WMIC.exe Token: SeIncBasePriorityPrivilege 4224 WMIC.exe Token: SeCreatePagefilePrivilege 4224 WMIC.exe Token: SeBackupPrivilege 4224 WMIC.exe Token: SeRestorePrivilege 4224 WMIC.exe Token: SeShutdownPrivilege 4224 WMIC.exe Token: SeDebugPrivilege 4224 WMIC.exe Token: SeSystemEnvironmentPrivilege 4224 WMIC.exe Token: SeRemoteShutdownPrivilege 4224 WMIC.exe Token: SeUndockPrivilege 4224 WMIC.exe Token: SeManageVolumePrivilege 4224 WMIC.exe Token: 33 4224 WMIC.exe Token: 34 4224 WMIC.exe Token: 35 4224 WMIC.exe Token: 36 4224 WMIC.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2296 wrote to memory of 3688 2296 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe 81 PID 3688 wrote to memory of 2308 3688 cmd.exe 83 PID 2296 wrote to memory of 5164 2296 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe 85 PID 5164 wrote to memory of 3308 5164 cmd.exe 87 PID 2296 wrote to memory of 8 2296 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe 88 PID 8 wrote to memory of 4224 8 cmd.exe 90 PID 2296 wrote to memory of 3312 2296 2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe 91 PID 3312 wrote to memory of 5976 3312 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_d4a962abc8d4f6a07c8dde3644eecc07_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /fo csv"2⤵
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\system32\tasklist.exetasklist /fo csv3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"2⤵
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name /value3⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:3308
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_VideoController get CurrentRefreshRate /value"2⤵
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_VideoController get CurrentRefreshRate /value3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4224
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty CurrentRefreshRate""2⤵
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty CurrentRefreshRate"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5976
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ybzqk1ik.vfw.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH