Overview

overview

7

Static

static

3

2026-08-03...at.exe

windows10-2004-x64

7

2026-08-03...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/08/2026, 09:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_5b00fc67cb8decb3bceafd51c0527a8c_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat.exe
  • Size 4.5MB
  • Sample260803-k73m7sshka
  • SHA256 4f0d77e53a3b14b4830645df018d3fedd7c865a9e2bdfd2b600b81f237c1a352
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 7 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_5b00fc67cb8decb3bceafd51c0527a8c_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_5b00fc67cb8decb3bceafd51c0527a8c_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4908
    • C:\Users\Admin\AppData\Local\Temp\2026-08-03_5b00fc67cb8decb3bceafd51c0527a8c_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-03_5b00fc67cb8decb3bceafd51c0527a8c_blankgrabber_cobalt-strike_icedid_luca-stealer_njrat.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:2376

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
        • Size 131KB
        • SHA256 96b07339d52c74f2a1dd043df5eb931e4072eed90a3a8715ffec751d818e4117
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_queue.pyd
        • Size 34KB
        • SHA256 b5b5368026c33ade7651fb4cf4c6c1ca7eecc9c8cdad0af007da8a3ac0e067f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd
        • Size 695KB
        • SHA256 b965a80346ee95dbec0b147faab329f3276ba24fceb8df5df171367649f116f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4908_134302221288013058\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hotkey_helper.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4908_134302221288013058\hotkey_helper.dll
        • Size 6.0MB
        • SHA256 3f48f54e706948da4f64700ec3651a90c7da42fcc7e7c622239ea139e8d63a53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4908_134302221288013058\python313.dll
        • Size 5.8MB
        • SHA256 6964e590037c41d631fd1215f05af154f7fa68105993c6f573a20689b473f1ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download