Overview

overview

9

Static

static

3

2026-07-22...at.exe

windows10-2004-x64

9

2026-07-22...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/07/2026, 05:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-22_17f328b2f342d2a536b7e2f91c544276_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
  • Size 46.2MB
  • Sample260722-gnfsjszcle
  • SHA256 9a1eeb81d40e3aee069309c6239e67fc6b9a53e1cfae71b38f8a813d79b3d6ff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
execution

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Loads dropped DLL 46 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_17f328b2f342d2a536b7e2f91c544276_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-22_17f328b2f342d2a536b7e2f91c544276_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4524
    • C:\Users\Admin\AppData\Local\Temp\2026-07-22_17f328b2f342d2a536b7e2f91c544276_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-22_17f328b2f342d2a536b7e2f91c544276_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue'; $target='C:\\Users\\Admin\\AppData\\Local\\Temp'; $pPid=2756; $currentPid=$PID; function Global-Nuke { try { $procs=Get-Process | Where-Object { $_.Path -like \"$target*\" -and $_.Id -ne $PID }; $handleProcs=@(); try { $allProcs=Get-Process; foreach($p in $allProcs){ if($p.Id -ne $PID){ try { $handles=Get-WmiObject Win32_ProcessHandle -Filter \"ProcessId=$($p.Id)\" 2>$null; foreach($h in $handles){ if($h.Handle -and $h.Handle.Name -like \"$target*\"){ $handleProcs +=$p; break; } } } catch { } } } } catch { } $allProcsToKill=$procs + $handleProcs | Select-Object -Unique; foreach($p in $allProcsToKill){ try { Stop-Process -Id $p.Id -Force -ErrorAction Stop; } catch { try { taskkill /F /T /PID $p.Id /NoWindow 2>$null; } catch { } } } } catch { } }; $monitorCount=0; while($true){ Start-Sleep -Milliseconds 500; $monitorCount++; try { $parent=Get-Process -Id $pPid -ErrorAction Stop; } catch { Global-Nuke; break; } }; Stop-Process -Id $currentPid -Force"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4760

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\MSVCP140.dll
        • Size 544KB
        • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\PySide6\QtCore.pyd
        • Size 3.2MB
        • SHA256 be52341a5df1f76ecca2fb1e94eb429dfa46f0b659ed6536f25119b565b21ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\PySide6\QtGui.pyd
        • Size 3.7MB
        • SHA256 f0549716b10a8b4fbd5c6c041f36af215223809f919f4c4722d44cc199d5c593
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\PySide6\QtWidgets.pyd
        • Size 4.6MB
        • SHA256 85cb6c2181b4b09887a7d8507dd950844d1b8f74a9c4002c7b71169f75bf6fda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\Qt6Core.dll
        • Size 10.0MB
        • SHA256 65fe6224b6c47a15b058738031d31dce9928c4d7a58e1b8db6434f6f5cddd702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 cd071161ad325ff2de92b0e33d71334ef20712544796949623ce92dfb3957e90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\Qt6Widgets.dll
        • Size 6.3MB
        • SHA256 5a9f37dedd3dc5bcc1a4bb8ea919c49fc62df751a1450accc34379eb6710eab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\VCRUNTIME140.dll
        • Size 121KB
        • SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\_bz2.pyd
        • Size 71KB
        • SHA256 d7da471478efe60a47cfec52787b4f8b391f2f255157a44ceb1e76cfda847ec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\_ctypes.pyd
        • Size 120KB
        • SHA256 c919a3fcd0a5cfd34b67a1991c011a8510ad0f64122b817d2d4d2908f91f901c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\_lzma.pyd
        • Size 149KB
        • SHA256 4dfa5049a1ae627eed0e9d62fbd195e2d1ecb7d49062099d520e62d1cf107e4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\_queue.pyd
        • Size 21KB
        • SHA256 ef53c94a98fecb0bf22c41ed8bd79cf1bfa7edf76979a51a26109c2fdf8dea12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\_socket.pyd
        • Size 71KB
        • SHA256 a31cd049a442704f5944b33d4ecd5e1a4b406baecd3c1426601cb839f17c1c9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\_uuid.pyd
        • Size 13KB
        • SHA256 dd3bee70c3086cfcd44293033a0d54a9e97c383096722429489352567b833b0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\_wmi.pyd
        • Size 25KB
        • SHA256 e3b9b6366c8d81ea76acbf37ffc029438cc257664b526c3556bdaa099b55580c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\libffi-8.dll
        • Size 27KB
        • SHA256 81fc25b9b8dd929a470af0de020c334705b1c5695f7b3d02e06c413e70e96523
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        main.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\main.dll
        • Size 30.7MB
        • SHA256 cba4bbff53015de1b0d5980cc204cb18a0c8e9719175164827628088644ca2c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orjson.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\orjson\orjson.pyd
        • Size 218KB
        • SHA256 ead891b62fbbbc3422ddbc953c9a409a3c00da85eac2d5c42948e7786ae19425
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        palooz.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\palooz.pyd
        • Size 248KB
        • SHA256 5e00a7ca8b8fe187b770a2d08fe5cf364e55ef1842f2a21b229c9b64c30c041f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyside6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\pyside6.abi3.dll
        • Size 242KB
        • SHA256 d4072be872b31f3748de5e6c28cb2976dafbf063d3ccfa38e5dabda29babcdaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\python3.dll
        • Size 57KB
        • SHA256 a7cff5d87993e00da11d65eff2ce831c4016173ce87a7fced80d2984ebe3b07b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\python313.dll
        • Size 5.8MB
        • SHA256 7049f5ee3fad122b1b98dbca2c73e1e659a938da862263a8426b1cfa68befcd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        T_itemicon_Weapon_SphereLauncher.webp
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\resources\game_data\icons\technologies\T_itemicon_Weapon_SphereLauncher.webp
        • Size 7KB
        • SHA256 9bc6a97dca038b707208673eb8a5685a1746690e9906657da7040dc691b5c422
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\select.pyd
        • Size 18KB
        • SHA256 beb48243113c0ed2c4f5009598fa643fea1d3df2f66a7dcc0f432b292666ae91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shiboken6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\shiboken6.abi3.dll
        • Size 375KB
        • SHA256 47f4f9b44c95037565dd14f4be04f350f20c53c05483b750e0be867c39a7441e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Shiboken.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\shiboken6\Shiboken.pyd
        • Size 32KB
        • SHA256 0e2c5318c5ac60a016a12230bbb1f6a9d990c45cbf4a7c4af24aefb5ab7dc40a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\shiboken6\msvcp140_1.dll
        • Size 26KB
        • SHA256 d878d7cb27187247a3ce1adfdf1f9b7b703e4429bc55f3e95284a43e80c10151
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\shiboken6\msvcp140_2.dll
        • Size 265KB
        • SHA256 c0ab58670a2cebaad8e7ef1f57d8f684a43bdf1c39d20a032088425905802655
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        config.json
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\src\data\configs\config.json
        • Size 152B
        • SHA256 2fcfe225a73ff4881f977f0fe4a27cbb3406c42ff9b6c20192519ba57dd9454f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        equipment_loadouts.json
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\src\data\configs\equipment_loadouts.json
        • Size 2KB
        • SHA256 75881d71f966314733c391d599be722dc3ebff2e1618651430583467b8821a77
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        inventory_loadouts.json
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\src\data\configs\inventory_loadouts.json
        • Size 2KB
        • SHA256 02b125e0376128a5621a3681c428b853c76b8404a820956748b4268d7d178ece
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        passive_loadouts.json
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\src\data\configs\passive_loadouts.json
        • Size 1KB
        • SHA256 453b3b9ea0aa56accd04e6e12722363e676d6971964560b843a7a5ae7e0270d1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        user.cfg
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4524_528960_I7luM-0TDBc\src\data\configs\user.cfg
        • Size 323B
        • SHA256 e768a3305e50beb35666224fb10e67719955796a6ec95b5570ec0b95a20bde11
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2756-2747-0x00007FF896D90000-0x00007FF89714B000-memory.dmp
        Download

        memory/2756-2740-0x00007FF894E70000-0x00007FF8954BD000-memory.dmp
        Download

        memory/2756-2733-0x00007FF8974E0000-0x00007FF897813000-memory.dmp
        Download

        memory/2756-2744-0x00007FF8954C0000-0x00007FF895979000-memory.dmp
        Download

        memory/4760-2759-0x0000024850C20000-0x0000024850C42000-memory.dmp
        Download