Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
25/06/2026, 11:42
General
- Target taskhostw.exe
- Size 61.5MB
- Sample260625-nvdebsbt9n
- SHA256 cf8a816917b932c65ad6ae82652da0b7062bb67abcc94c838d2b39b0d08f248c
Malware Config
Signatures
- Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
- A stealer written in Python and packaged with Pyinstaller 18 IoCs
- Loads dropped DLL 64 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\taskhostw.exe"C:\Users\Admin\AppData\Local\Temp\taskhostw.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\taskhostw.exeC:\Users\Admin\AppData\Local\Temp\taskhostw.exe2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /f /tn "HiddenAppTask" /tr "C:\Users\Admin\AppData\Local\Temp\taskhostw.exe" /sc onlogon /rl highest"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "HiddenAppTask" /tr "C:\Users\Admin\AppData\Local\Temp\taskhostw.exe" /sc onlogon /rl highest4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskhostw.exeC:\Users\Admin\AppData\Local\Temp\taskhostw.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\taskhostw.exeC:\Users\Admin\AppData\Local\Temp\taskhostw.exe2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /f /tn "HiddenAppTask" /tr "C:\Users\Admin\AppData\Local\Temp\taskhostw.exe" /sc onlogon /rl highest"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeschtasks /create /f /tn "HiddenAppTask" /tr "C:\Users\Admin\AppData\Local\Temp\taskhostw.exe" /sc onlogon /rl highest4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_imaging.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_overlapped.pyd
_socket.pyd
_ssl.pyd
_wmi.pyd
_http_parser.pyd
_http_writer.pyd
mask.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
_multidict.pyd
libscipy_openblas64_-b788215d9d47792bcba3a2e2a7114320.dll
msvcp140-a4c2229bdc2a2a630acdc095b4d86008.dll
_multiarray_umath.pyd
_umath_linalg.pyd
_helpers_c.pyd
_psutil_windows.pyd
python3.dll
python312.dll
select.pyd
unicodedata.pyd
_quoting_c.pyd
memory/1160-272-0x00007FF6B7610000-0x00007FF6BB3C6000-memory.dmp
memory/1664-302-0x00007FF8D55C0000-0x00007FF8D9EE9000-memory.dmp
memory/1664-366-0x00007FF8D55C0000-0x00007FF8D9EE9000-memory.dmp
memory/1664-350-0x00007FF8D55C0000-0x00007FF8D9EE9000-memory.dmp
memory/1664-342-0x00007FF8D55C0000-0x00007FF8D9EE9000-memory.dmp
memory/1664-273-0x00007FF6B7610000-0x00007FF6BB3C6000-memory.dmp
memory/1664-318-0x00007FF8D55C0000-0x00007FF8D9EE9000-memory.dmp
memory/1664-287-0x00007FF8E87C0000-0x00007FF8E9B40000-memory.dmp
memory/1664-286-0x00007FF8D55C0000-0x00007FF8D9EE9000-memory.dmp
memory/1664-310-0x00007FF8D55C0000-0x00007FF8D9EE9000-memory.dmp
memory/1664-294-0x00007FF8D55C0000-0x00007FF8D9EE9000-memory.dmp
memory/4548-270-0x00007FF8E9B40000-0x00007FF8EE469000-memory.dmp
memory/4548-299-0x00007FF8E9B40000-0x00007FF8EE469000-memory.dmp
memory/4548-307-0x00007FF8E9B40000-0x00007FF8EE469000-memory.dmp
memory/4548-291-0x00007FF8E9B40000-0x00007FF8EE469000-memory.dmp
memory/4548-314-0x00007FF8E9B40000-0x00007FF8EE469000-memory.dmp
memory/4548-243-0x00007FF6B7610000-0x00007FF6BB3C6000-memory.dmp
memory/4548-323-0x00007FF8E9B40000-0x00007FF8EE469000-memory.dmp
memory/4548-338-0x00007FF8E9B40000-0x00007FF8EE469000-memory.dmp
memory/4548-346-0x00007FF8E9B40000-0x00007FF8EE469000-memory.dmp
memory/4548-244-0x00007FF8E9B40000-0x00007FF8EE469000-memory.dmp
memory/4548-355-0x00007FF8E9B40000-0x00007FF8EE469000-memory.dmp
memory/4548-245-0x00007FF8F4AE0000-0x00007FF8F5E60000-memory.dmp
memory/4560-165-0x00007FF6B7610000-0x00007FF6BB3C6000-memory.dmp