62cda4b9b52829d4f30e6bd0216b11b964b9b3657c13f85f936686c0490ad342

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 06:40

Target
2026-07-27_712ba8c5edeb5f44b72891f11870e90b_blankgrabber_cobalt-strike_emotet_glassworm_icedid_luca-.exe
Size 10.6MB
Sample260727-hfl52axtd1
SHA256 62cda4b9b52829d4f30e6bd0216b11b964b9b3657c13f85f936686c0490ad342
MD5 712ba8c5edeb5f44b72891f11870e90b
SHA1 5c44f547bfd022ac79f455ee93e563b356121a7f
SHA512 3a2089b9f750f344a856f34dddbecafba9426cdce4c2bfc61c51ea614494c5880f9adf7019033c638d09139b97d8f9a0b04e599876fceffb9f457b974cb0f00e
SSDEEP 196608:qyoHT/xFzAKXbeO7btUTGlG5ha3wfI9jSQflYZtPL8s7QoVy81z81y:ql7xUg0acIjM3VVmy
TLSH
T12FB6F142B594C1B2C2C58972DD56D5B3EB303DBD87F6067B32A8FED63A322903A25315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
6020	YLdOBx8yhg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6020	YLdOBx8yhg.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6020	YLdOBx8yhg.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 6020	3440	2026-07-27_712ba8c5edeb5f44b72891f11870e90b_blankgrabber_cobalt-strike_emotet_glassworm_icedid_luca-.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-27_712ba8c5edeb5f44b72891f11870e90b_blankgrabber_cobalt-strike_emotet_glassworm_icedid_luca-.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_712ba8c5edeb5f44b72891f11870e90b_blankgrabber_cobalt-strike_emotet_glassworm_icedid_luca-.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Users\Admin\AppData\Local\Temp\YLdOBx8yhg.exe
  "C:\Users\Admin\AppData\Local\Temp\YLdOBx8yhg.exe" --renamed
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:6020

YLdOBx8yhg.exe

Path C:\Users\Admin\AppData\Local\Temp\YLdOBx8yhg.exe
Size 10.6MB
SHA256 62cda4b9b52829d4f30e6bd0216b11b964b9b3657c13f85f936686c0490ad342
MD5 712ba8c5edeb5f44b72891f11870e90b
SHA1 5c44f547bfd022ac79f455ee93e563b356121a7f
SHA512 3a2089b9f750f344a856f34dddbecafba9426cdce4c2bfc61c51ea614494c5880f9adf7019033c638d09139b97d8f9a0b04e599876fceffb9f457b974cb0f00e
SSDEEP 196608:qyoHT/xFzAKXbeO7btUTGlG5ha3wfI9jSQflYZtPL8s7QoVy81z81y:ql7xUg0acIjM3VVmy
TLSH
T12FB6F142B594C1B2C2C58972DD56D5B3EB303DBD87F6067B32A8FED63A322903A25315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download