Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 02:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-15_3ef445f80aa0a9833fdd9215f831c21e_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_3ef445f80aa0a9833fdd9215f831c21e_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-07-15_3ef445f80aa0a9833fdd9215f831c21e_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
- Size 5.8MB
- Sample260716-cff15aaz8p
- SHA256 9a0b51591a0864dca59a8bea5a449ff6a348431165533e9ba976f07fb43668f9
- MD5 3ef445f80aa0a9833fdd9215f831c21e
- SHA1 aebd432af662ce1cf9595b4825548ef0e4aa0127
- SHA512 df2359dccf3d09450d4be1dc676753be32e671dd459adeb76f8bdcf1a82d8a29bed5a1e466bd13181754a6e5ceecb24ad55d23e3ce8aaf9df893dfb94fbb88c2
- SSDEEP 98304:j0L6keHgvobPGBlXdOyseDbLjoi+BXswkN1u1BWQCxZtQZsbHXyiiy3nM7ZS:Qrvwut9Dn0i+BclrunW5ntQZuv87Y
- TLSH T1FF5633ACF6A24DFFD92B4238A4916986E7F1F8981774C777422AC6669F131C09F78310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 2536 2026-07-15_3ef445f80aa0a9833fdd9215f831c21e_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe 2536 2026-07-15_3ef445f80aa0a9833fdd9215f831c21e_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe 2536 2026-07-15_3ef445f80aa0a9833fdd9215f831c21e_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3684 wrote to memory of 2536 3684 2026-07-15_3ef445f80aa0a9833fdd9215f831c21e_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_3ef445f80aa0a9833fdd9215f831c21e_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_3ef445f80aa0a9833fdd9215f831c21e_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\2026-07-15_3ef445f80aa0a9833fdd9215f831c21e_blankgrabber_coinminer_icedid_luca-stealer_njrat.exeC:\Users\Admin\AppData\Local\Temp\2026-07-15_3ef445f80aa0a9833fdd9215f831c21e_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe2⤵
- Loads dropped DLL
PID:2536
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3684_134286408596004821\VCRUNTIME140.dll
- Size 117KB
- SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
- MD5 32da96115c9d783a0769312c0482a62d
- SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
- SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
- SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
- TLSH T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3684_134286408596004821\crackme.dll
- Size 5.7MB
- SHA256 1b9b36a084dd76b98a8954135ddb5f5fb42b77d99330dc0de7a71a66d465b6fa
- MD5 60afd1976a95c503e48aa7ee68ccbe7e
- SHA1 3839cc246e3711213bcdbf74deab783646fa3d25
- SHA512 3065466ef2bc64f72c1b44c6ea9132a0b903c46d61b09ce247d1cb439f2b05862fad1caa92398ae30df784cf3367252b64896951a681a911d351a4af5a662156
- SSDEEP 98304:aC9Wis1TkRhWD1FTq17UpJwIX4uzWObPPmRs1:aCc1QnWD1Ae
- TLSH T18F5616817A92D5B3FC95F2F9442A1A4EF32584B6B700C34734AFC0A92F4B6B49E615DC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\onefile_3684_134286408596004821\python312.dll
- Size 6.6MB
- SHA256 9a0e3435aaa680d868150f87ab3e388ad2eebc22f87e036155c7b4eda8cd2120
- MD5 de50496cece613ec7ebedbf9f2aefecd
- SHA1 6cd49527f647f7ea96872b89bb4fde20afbada1b
- SHA512 a8d22a6f6140280ff36476cdc7cda4a3ebc46f0ac63b2a3c44fbd5f45aa3d343121e63b092b320d1dd8dbb7bc586a679bbcf738f485f36502a34592521aaf7a8
- SSDEEP 98304:2nZOqBIZAopgdKJUskfih6ZizvmHDMiEXAbBu:IoJedKJnkf8ivs
- TLSH T12C666B15729CC0A9C96795B8CC13C28EE7B27C117F51434B30ABB71E2F733A1966A789
- MD5 SHA1 SHA512 SSDEEP TLSH