Overview

overview

10

Static

static

10

2026-06-28...sw.exe

windows10-2004-x64

10

2026-06-28...sw.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/06/2026, 18:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-28_df03e3d1ea0476c6deebf9fab4cac972_akira_blankgrabber_cobalt-strike_coinminer_emotet_glassw.exe
  • Size 54.8MB
  • Sample260628-w6eersb16k
  • SHA256 4bec4a70b41229f02c5759b0cbd59f5b7e22e28da8b9c3d536386069b70b7805
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionblankgrabberpersistenceprivilege_escalationstealer

Malware Config

Signatures

  • Family: blankgrabber

    Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.

    stealerblankgrabber
  • A stealer written in Python and packaged with Pyinstaller 1 IoCs
  • UPX dump on OEP (original entry point) 1 IoCs
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 31 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 33 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_df03e3d1ea0476c6deebf9fab4cac972_akira_blankgrabber_cobalt-strike_coinminer_emotet_glassw.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-28_df03e3d1ea0476c6deebf9fab4cac972_akira_blankgrabber_cobalt-strike_coinminer_emotet_glassw.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1112
    • C:\Users\Admin\AppData\Local\Temp\2026-06-28_df03e3d1ea0476c6deebf9fab4cac972_akira_blankgrabber_cobalt-strike_coinminer_emotet_glassw.exe
      C:\Users\Admin\AppData\Local\Temp\2026-06-28_df03e3d1ea0476c6deebf9fab4cac972_akira_blankgrabber_cobalt-strike_coinminer_emotet_glassw.exe
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4484
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls||clear
        3⤵
          PID:1776
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1576
          • C:\Windows\system32\netsh.exe
            netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:2524
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5476
          • C:\Windows\system32\netsh.exe
            netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:1068
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "ipconfig /flushdns"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:936
          • C:\Windows\system32\ipconfig.exe
            ipconfig /flushdns
            4⤵
            • Gathers network information
            PID:1196
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4412
          • C:\Windows\system32\netsh.exe
            netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:4976
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5588
          • C:\Windows\system32\netsh.exe
            netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234
            4⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:1592
        • C:\Windows\SYSTEM32\certutil.exe
          certutil -delstore Root keyauth.win
          3⤵
            PID:4900
          • C:\Windows\SYSTEM32\certutil.exe
            certutil -addstore Root C:\Windows\localhost.crt
            3⤵
              PID:5084
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "ipconfig /flushdns"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3772
              • C:\Windows\system32\ipconfig.exe
                ipconfig /flushdns
                4⤵
                • Gathers network information
                PID:4088
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4508
              • C:\Windows\system32\netsh.exe
                netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443
                4⤵
                • Event Triggered Execution: Netsh Helper DLL
                PID:2000
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2236
              • C:\Windows\system32\netsh.exe
                netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234
                4⤵
                • Event Triggered Execution: Netsh Helper DLL
                PID:3748
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "netsh interface ipv4 add address "name=Loopback Pseudo-Interface 1" address=162.159.133.234 mask=255.255.255.255"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:292
              • C:\Windows\system32\netsh.exe
                netsh interface ipv4 add address "name=Loopback Pseudo-Interface 1" address=162.159.133.234 mask=255.255.255.255
                4⤵
                • Event Triggered Execution: Netsh Helper DLL
                PID:2008
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "netsh interface portproxy add v4tov4 listenaddress=162.159.133.234 listenport=443 connectaddress=127.0.0.1 connectport=443"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5496
              • C:\Windows\system32\netsh.exe
                netsh interface portproxy add v4tov4 listenaddress=162.159.133.234 listenport=443 connectaddress=127.0.0.1 connectport=443
                4⤵
                • Event Triggered Execution: Netsh Helper DLL
                PID:2140
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "netsh interface portproxy show all"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1296
              • C:\Windows\system32\netsh.exe
                netsh interface portproxy show all
                4⤵
                • Event Triggered Execution: Netsh Helper DLL
                PID:2944
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "sc stop WinDivert"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1420
              • C:\Windows\system32\sc.exe
                sc stop WinDivert
                4⤵
                • Launches sc.exe
                PID:5204
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "sc delete WinDivert"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1472
              • C:\Windows\system32\sc.exe
                sc delete WinDivert
                4⤵
                • Launches sc.exe
                PID:2952
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "sc create WinDivert type= kernel start= demand binPath= "C:\Windows\WinDivert64.sys" DisplayName= "WinDivert Network Driver""
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4108
              • C:\Windows\system32\sc.exe
                sc create WinDivert type= kernel start= demand binPath= "C:\Windows\WinDivert64.sys" DisplayName= "WinDivert Network Driver"
                4⤵
                • Launches sc.exe
                PID:1784
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "sc start WinDivert"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:2868
              • C:\Windows\system32\sc.exe
                sc start WinDivert
                4⤵
                • Launches sc.exe
                PID:4928
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3800
              • C:\Windows\system32\netsh.exe
                netsh interface portproxy delete v4tov4 listenaddress=162.159.133.234 listenport=443
                4⤵
                • Event Triggered Execution: Netsh Helper DLL
                PID:2528
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4148
              • C:\Windows\system32\netsh.exe
                netsh interface ipv4 delete address "name=Loopback Pseudo-Interface 1" address=162.159.133.234
                4⤵
                • Event Triggered Execution: Netsh Helper DLL
                PID:4848
        • C:\Windows\WinDivert64.sys
          C:\Windows\WinDivert64.sys
          1⤵
          • Executes dropped EXE
          PID:3496

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              81d243bd2c585b0f4821__mypyc.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\81d243bd2c585b0f4821__mypyc.pyd
              • Size 211KB
              • SHA256 5b80e8963c54771f2d923eb0469a7a293cabf172bdcff8ef2f28804948c4ec8c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Loader.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\Loader.dll
              • Size 19.8MB
              • SHA256 7443649d6f5fe2a5da62fd7b01f08d1a8053634d46c6831da3dd347fe7f74d78
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _imaging.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\PIL\_imaging.pyd
              • Size 2.5MB
              • SHA256 a6150bd6d42c8179bb0bef700765b1dba247b89e115808f70727eb5a04fc344f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _imagingft.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\PIL\_imagingft.pyd
              • Size 2.1MB
              • SHA256 bc9e0564c33a1319438de7a08f555b325c9b7e28d316680c53f19572d5e5655c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VCRUNTIME140.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\VCRUNTIME140.dll
              • Size 94KB
              • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _bz2.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\_bz2.pyd
              • Size 78KB
              • SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _cffi_backend.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\_cffi_backend.pyd
              • Size 175KB
              • SHA256 c379126647af2cbfb592d6a921f6218da59b886e2a56e9b82f8159aced6f1100
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ctypes.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\_ctypes.pyd
              • Size 117KB
              • SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _hashlib.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\_hashlib.pyd
              • Size 57KB
              • SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _lzma.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\_lzma.pyd
              • Size 149KB
              • SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _queue.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\_queue.pyd
              • Size 26KB
              • SHA256 9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _socket.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\_socket.pyd
              • Size 72KB
              • SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _ssl.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\_ssl.pyd
              • Size 152KB
              • SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              cd.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\charset_normalizer\cd.pyd
              • Size 10KB
              • SHA256 54ed1a662d7b02ac19d8227badf17a2d6924395474c1cce5a2314eacf4f544a0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libcrypto-1_1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\libcrypto-1_1.dll
              • Size 3.3MB
              • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libffi-7.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\libffi-7.dll
              • Size 32KB
              • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              libssl-1_1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\libssl-1_1.dll
              • Size 678KB
              • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _sodium.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\nacl\_sodium.pyd
              • Size 396KB
              • SHA256 57822e7aed944269943bcb855fc14560a5b6ae38869de4e3d00c380a5119ecc7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _psutil_windows.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\psutil\_psutil_windows.pyd
              • Size 69KB
              • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              injector.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\pyinjector\injector.pyd
              • Size 20KB
              • SHA256 10575c0fe3fa9dabeddb0f65beb38e3d99081245de46c6770994ed28dbba397e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              python3.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\python3.dll
              • Size 60KB
              • SHA256 8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              python310.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\python310.dll
              • Size 4.2MB
              • SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              pywintypes310.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\pywintypes310.dll
              • Size 132KB
              • SHA256 d14a89c503599be257b733cafdd66ff8d0e77bc657360dee921d40374820c415
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              select.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\select.pyd
              • Size 25KB
              • SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              unicodedata.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\unicodedata.pyd
              • Size 1.1MB
              • SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vcruntime140_1.dll
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\vcruntime140_1.dll
              • Size 36KB
              • SHA256 04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              win32security.pyd
              • Path C:\Users\Admin\AppData\Local\Temp\onefile_1112_933774_DfCO4oxCzEQ\win32security.pyd
              • Size 129KB
              • SHA256 35686c5ec1fda6b12691151fc4f98670183e4edca72575b7aac0f53034104120
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WinDivert64.dll
              • Path C:\Windows\WinDivert64.dll
              • Size 22KB
              • SHA256 d0d8e5806952ce8f321d106551c680afe5a074cb9366a54282ff83397c64c27f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WinDivert64.sys
              • Path C:\Windows\WinDivert64.sys
              • Size 46KB
              • SHA256 9026147943bd44a1eb5e2f0c89cc8f441c7d1f13c1571aba54e262d2e7354798
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              localhost.crt
              • Path C:\Windows\localhost.crt
              • Size 1KB
              • SHA256 b01649f1f8bbb871a1f6667dba896af4812bbc59d3c6cdf4ba0f181a189d78b8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/3496-113-0x0000000000010000-0x000000000001E000-memory.dmp
              Download