Overview

overview

7

Static

static

3

2026-07-27...oa.exe

windows10-2004-x64

7

2026-07-27...oa.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 21:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_fb6a9620d0818bd39e5b4360118aeae2_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
  • Size 89.3MB
  • Sample260727-1jdl6ssajc
  • SHA256 c1512ab749c19993ebbdde784c5ac810dc81af5655a0be9d9a3ed88aa219ebac
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_fb6a9620d0818bd39e5b4360118aeae2_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_fb6a9620d0818bd39e5b4360118aeae2_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4632
    • C:\Users\Admin\AppData\Local\Temp\2026-07-27_fb6a9620d0818bd39e5b4360118aeae2_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
      C:\Users\Admin\AppData\Local\Temp\2026-07-27_fb6a9620d0818bd39e5b4360118aeae2_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2176

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\MSVCP140.dll
        • Size 628KB
        • SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\MSVCP140_1.dll
        • Size 34KB
        • SHA256 206c931bf90fdad8816de3b5e2ef80b2bcaa9406c89ecc05fe6fddffe251e982
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\PyQt6\QtCore.pyd
        • Size 2.3MB
        • SHA256 364270cfe4587ec567e7779c59906bcf7ac60c136599c76b7bc7d7fc0c532367
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\PyQt6\QtGui.pyd
        • Size 2.1MB
        • SHA256 b01a0f35a383916227edef264d0a834f08542008c00b4b1eafecd11bf6821345
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\PyQt6\QtWidgets.pyd
        • Size 4.8MB
        • SHA256 26e364adace767d3d16ccb1f29eb262fe422c8b7477b40b2452ee55e68c1c357
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\PyQt6\sip.pyd
        • Size 110KB
        • SHA256 b3712a5326b899ba794082ad173f9b0cd0fce3a14de53f524b8c94c86d2d431d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\Qt6Core.dll
        • Size 5.4MB
        • SHA256 ef9a8048a33001b552601b7e0a9a5adeecad429bbfd3281e2223656cdea692d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\Qt6Gui.dll
        • Size 7.4MB
        • SHA256 c128872b19f0a5ba9f1adfbb9c475216d6968b622be672b703104ce574206119
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\Qt6Widgets.dll
        • Size 5.8MB
        • SHA256 12385663fa6a4432049692171e8cf3e74e739cd23edd2d1fc5f8dba13daa2c33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\_ctypes.pyd
        • Size 121KB
        • SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\_socket.pyd
        • Size 77KB
        • SHA256 a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        main.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\main.dll
        • Size 16.9MB
        • SHA256 e07bafad77479c6e98eadb1c41cf6fbbdfa89503438c98b121f66c363a7c14e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\msvcp140_2.dll
        • Size 268KB
        • SHA256 d50d7883f20d1dc6191768d3746f52dd9cac89c346ffaed5be1f110c2f34a838
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\psutil\_psutil_windows.pyd
        • Size 69KB
        • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\pygame\SDL2.dll
        • Size 2.4MB
        • SHA256 520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\pygame\base.pyd
        • Size 30KB
        • SHA256 179b6803eaa24c8ad84cd85912147ec8ce423a136d529f564d2579aa405297f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bufferproxy.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\pygame\bufferproxy.pyd
        • Size 18KB
        • SHA256 2e21d60f149aefd2a4a362486c4c22f47cc4b915cc6df7d68b8b05fb8cc185ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        color.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\pygame\color.pyd
        • Size 34KB
        • SHA256 e340d7069dbe3f43c2dc9d6611e4b04e447b378ab988bd0a004ce6577ae09f48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        constants.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\pygame\constants.pyd
        • Size 49KB
        • SHA256 60dfd088ad8e333e8f13bfcf1409cbbdaa1ebdad9f0faf060d9c2860f801b2bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        display.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\pygame\display.pyd
        • Size 43KB
        • SHA256 7e0ee07bff4abff2670da3faff3df36e0d80f120fc958d71de444509104eae34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        math.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\pygame\math.pyd
        • Size 74KB
        • SHA256 8a65ada7f7745fe81ea2af927ebf7a12881157852b208f3076b314f099922da5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rect.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\pygame\rect.pyd
        • Size 44KB
        • SHA256 a761a244eacf7fb01923fc171aa4ef5468fb150518f5a5f99412d44c70fbbd3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rwobject.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\pygame\rwobject.pyd
        • Size 19KB
        • SHA256 2b0a7b68e1bdbd12fd7c2f53dcb5f88855eb5fd54170368c92fc4119c756f3b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        surface.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\pygame\surface.pyd
        • Size 234KB
        • SHA256 1e472a78d4015af2213b5926686b18dfcced43cd7e55612409da37f5184f9f5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        surflock.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\pygame\surflock.pyd
        • Size 13KB
        • SHA256 59aff38e712fb63f548a3494023edac41e8532460294a9baa8bd71efc6bafd9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\python3.dll
        • Size 65KB
        • SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\python311.dll
        • Size 5.5MB
        • SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4632_313882_h2L5aujL9jQ\select.pyd
        • Size 29KB
        • SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2176-168-0x00007FFFDAA90000-0x00007FFFDB058000-memory.dmp
        Download

        memory/2176-176-0x00007FFFDC080000-0x00007FFFDC2D4000-memory.dmp
        Download

        memory/2176-179-0x00007FFFDBE60000-0x00007FFFDC07C000-memory.dmp
        Download

        memory/2176-171-0x00007FFFDC2E0000-0x00007FFFDC7A7000-memory.dmp
        Download