Overview

overview

9

Static

static

3

2026-07-17...at.exe

windows10-2004-x64

9

2026-07-17...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/07/2026, 23:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-17_31f3ab1411e8379eee8acb0a12cd5c09_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
  • Size 6.8MB
  • Sample260717-3d4yaacy61
  • SHA256 392493f3a2e87f9c4d87b08d6416e602d4a1daab187b739e7cbe1730df640d75
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10

Malware Config

Signatures

  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Loads dropped DLL 13 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-17_31f3ab1411e8379eee8acb0a12cd5c09_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-17_31f3ab1411e8379eee8acb0a12cd5c09_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5924
    • C:\Users\Admin\AppData\Local\Temp\2026-07-17_31f3ab1411e8379eee8acb0a12cd5c09_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-17_31f3ab1411e8379eee8acb0a12cd5c09_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
      2⤵
      • Loads dropped DLL
      PID:5600

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
        • Size 85KB
        • SHA256 a4be36fffeefa8b24c1234d548da8f05558aba53c2ea7d1d2614776eaad8fbf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_hashlib.pyd
        • Size 67KB
        • SHA256 d4524b261f09806a828c62fc97e8517328b23d65ab87d20706a4bafd86bbf345
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd
        • Size 157KB
        • SHA256 f7ad11fbbb7aeaf7b6566a532a3243e3ae5f92bac480dbe5c2ef300fe2c1dabe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
        • Size 85KB
        • SHA256 ff3e97cd11bdc68798e5b3dcd5295d1efba179b7344142d50d066bbf1c2d79cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd
        • Size 180KB
        • SHA256 43e60bbdff2fe41701f39fa25ea6a8251a2b7623ff18f980a209a451eb5e648f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 e03dd02fdcfb791981c9962827cfcf495f2a47a514c1526efb57f847a9df514a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-3.dll
        • Size 776KB
        • SHA256 1e4bc0638682bfcbb36f4465d6a2e9944d917a60f05ecc8ddf9e96847e05e13f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GIUX.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5924_134288042936062070\GIUX.dll
        • Size 6.7MB
        • SHA256 6daa616bc5b1b356ca144e0ff55bc45a9fd71ac8a0825eb16ddda35cf26702ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5924_134288042936062070\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5924_134288042936062070\_uuid.pyd
        • Size 27KB
        • SHA256 fc7406772b43caa3b6f41c690753792188b1c14c36a723d49e9276b7457696ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5924_134288042936062070\_zstd.pyd
        • Size 491KB
        • SHA256 536a3b521a3c42d2827ece0ccfbe40b83a2fd96a0f5496cd60b943b10e1266d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5924_134288042936062070\python314.dll
        • Size 6.4MB
        • SHA256 1ac15e2224581fc678bbd17728b9aa538d47b891b72c76499ef07e54cd74f151
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5924_134288042936062070\unicodedata.pyd
        • Size 740KB
        • SHA256 4445b894f836e89a8b9fdcc88b5e59fbc76aca805baaf40aeb69e869978d4e6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download