Overview

overview

7

Static

static

3

2026-08-02...ic.exe

windows10-2004-x64

7

2026-08-02...ic.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 03:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_cfa6bb44d9652c05306b86d9cc8ee780_blankgrabber_cobalt-strike_coinminer_emotet_glassworm_ic.exe
  • Size 72.7MB
  • Sample260803-dnenpsbm21
  • SHA256 c83309dc09d16e20d60ae7f7699bf4f6075763c6098abb17253c478a43296296
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 42 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_cfa6bb44d9652c05306b86d9cc8ee780_blankgrabber_cobalt-strike_coinminer_emotet_glassworm_ic.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_cfa6bb44d9652c05306b86d9cc8ee780_blankgrabber_cobalt-strike_coinminer_emotet_glassworm_ic.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4164
    • C:\Users\Admin\AppData\Local\Temp\2026-08-02_cfa6bb44d9652c05306b86d9cc8ee780_blankgrabber_cobalt-strike_coinminer_emotet_glassworm_ic.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-02_cfa6bb44d9652c05306b86d9cc8ee780_blankgrabber_cobalt-strike_coinminer_emotet_glassworm_ic.exe
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:2640

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\2.dll
        • Size 8.0MB
        • SHA256 5fed946226048915d2166f3f9b2fcf05fc7d6923027f9651cbbbce0fbcbabeb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\PySide6\QtCore.pyd
        • Size 3.2MB
        • SHA256 be52341a5df1f76ecca2fb1e94eb429dfa46f0b659ed6536f25119b565b21ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\PySide6\QtWidgets.pyd
        • Size 4.6MB
        • SHA256 85cb6c2181b4b09887a7d8507dd950844d1b8f74a9c4002c7b71169f75bf6fda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\Qt6Core.dll
        • Size 10.0MB
        • SHA256 65fe6224b6c47a15b058738031d31dce9928c4d7a58e1b8db6434f6f5cddd702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 cd071161ad325ff2de92b0e33d71334ef20712544796949623ce92dfb3957e90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\Qt6Widgets.dll
        • Size 6.3MB
        • SHA256 5a9f37dedd3dc5bcc1a4bb8ea919c49fc62df751a1450accc34379eb6710eab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\VCRUNTIME140.dll
        • Size 94KB
        • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\_bz2.pyd
        • Size 78KB
        • SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\_ctypes.pyd
        • Size 117KB
        • SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\_hashlib.pyd
        • Size 57KB
        • SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\_lzma.pyd
        • Size 149KB
        • SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\_socket.pyd
        • Size 72KB
        • SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _win32sysloader.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\_win32sysloader.pyd
        • Size 15KB
        • SHA256 d5580980f445392af3ecedd36c9153b6e3c02b4f00d88243db0058633b81c012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\psutil\_psutil_windows.pyd
        • Size 69KB
        • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyside6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\pyside6.abi3.dll
        • Size 242KB
        • SHA256 d4072be872b31f3748de5e6c28cb2976dafbf063d3ccfa38e5dabda29babcdaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\python3.dll
        • Size 60KB
        • SHA256 8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\python310.dll
        • Size 4.2MB
        • SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\pywintypes310.dll
        • Size 132KB
        • SHA256 d14a89c503599be257b733cafdd66ff8d0e77bc657360dee921d40374820c415
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\select.pyd
        • Size 25KB
        • SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shiboken6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\shiboken6.abi3.dll
        • Size 375KB
        • SHA256 47f4f9b44c95037565dd14f4be04f350f20c53c05483b750e0be867c39a7441e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\shiboken6\MSVCP140_1.dll
        • Size 26KB
        • SHA256 d878d7cb27187247a3ce1adfdf1f9b7b703e4429bc55f3e95284a43e80c10151
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Shiboken.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\shiboken6\Shiboken.pyd
        • Size 32KB
        • SHA256 0e2c5318c5ac60a016a12230bbb1f6a9d990c45cbf4a7c4af24aefb5ab7dc40a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\shiboken6\msvcp140.dll
        • Size 536KB
        • SHA256 005f2324c7ff79bbe9a44992b0708abb4c871bd24bcc7a34aca5eab4439c1f4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\vcruntime140_1.dll
        • Size 36KB
        • SHA256 04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\win32api.pyd
        • Size 134KB
        • SHA256 24040005bb9c9407f539aaa085e1495d047788ed1e6c51d163ebe0277e582563
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32file.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\win32file.pyd
        • Size 137KB
        • SHA256 b8dbd2071b4b0c7f8ef0eefde71e5a12a28ab7871e1017916e2c9486f9191f06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32job.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\win32job.pyd
        • Size 29KB
        • SHA256 800cadc30875eb00c4ab433f30b76a281f26064cc513847ee2b7dd2160d70a49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32pipe.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4164_125980_RNnInLQm_pQ\win32pipe.pyd
        • Size 28KB
        • SHA256 a7112880ea4feaa7f4e1e863e66875797fba4446df531136b561f58782d895e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2640-127-0x00000210ED7D0000-0x00000210EDB03000-memory.dmp
        Download

        memory/2640-137-0x00007FFCE8AF0000-0x00007FFCE8EAB000-memory.dmp
        Download

        memory/2640-138-0x00000210ED7D0000-0x00000210EDB03000-memory.dmp
        Download