Analysis
- max time kernel
150s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 14:02
Behavioral task
behavioral1
Sample
2026-08-03_c3c6041ff7a3164de0a7ef8dc4ae3025_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_hel.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_c3c6041ff7a3164de0a7ef8dc4ae3025_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_hel.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-03_c3c6041ff7a3164de0a7ef8dc4ae3025_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_hel.exe
- Size 22.4MB
- Sample260803-rcfnhssthv
- SHA256 5cf25aa9e677f5850cb5c82af8e278d1a03deecba384b7c52e9c2f70237012da
- MD5 c3c6041ff7a3164de0a7ef8dc4ae3025
- SHA1 80685b74b93d650cd905fc7d6ef310dac9a29a1f
- SHA512 641f34447ec81c5614f7659d3cc36c446f8309267043a1d46a6d6d589c31dd65f3c842bf80ad7530ef28a4b48098b30f0865ccc6d7a1d6cd13f595b910007a10
- SSDEEP 393216:7FXSnF3uTEw+EHDGtdU6aNeANK2s4bZayxAF9MoWu:EFeaEHDwU6zANB7A/
- TLSH T1B037F116B29941F9D09AC534CA465527FBB1344B0B74BEEB36CC09162F33EE90A3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with VMProtect. 1 IoCs
resource yara_rule behavioral2/memory/3496-3-0x00007FF72BF80000-0x00007FF72D5E6000-memory.dmp INDICATOR_EXE_Packed_VMProtect -
resource yara_rule behavioral2/memory/3496-3-0x00007FF72BF80000-0x00007FF72D5E6000-memory.dmp vmprotect - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3496 2026-08-03_c3c6041ff7a3164de0a7ef8dc4ae3025_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_hel.exe 3496 2026-08-03_c3c6041ff7a3164de0a7ef8dc4ae3025_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_hel.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3496 2026-08-03_c3c6041ff7a3164de0a7ef8dc4ae3025_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_hel.exe 3496 2026-08-03_c3c6041ff7a3164de0a7ef8dc4ae3025_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_hel.exe 3496 2026-08-03_c3c6041ff7a3164de0a7ef8dc4ae3025_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_hel.exe 3496 2026-08-03_c3c6041ff7a3164de0a7ef8dc4ae3025_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_hel.exe 4364 wmic.exe 4364 wmic.exe 4364 wmic.exe 4364 wmic.exe 3360 wmic.exe 3360 wmic.exe 3360 wmic.exe 3360 wmic.exe 2308 wmic.exe 2308 wmic.exe 2308 wmic.exe 2308 wmic.exe 2348 wmic.exe 2348 wmic.exe 2348 wmic.exe 2348 wmic.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4364 wmic.exe Token: SeSecurityPrivilege 4364 wmic.exe Token: SeTakeOwnershipPrivilege 4364 wmic.exe Token: SeLoadDriverPrivilege 4364 wmic.exe Token: SeSystemProfilePrivilege 4364 wmic.exe Token: SeSystemtimePrivilege 4364 wmic.exe Token: SeProfSingleProcessPrivilege 4364 wmic.exe Token: SeIncBasePriorityPrivilege 4364 wmic.exe Token: SeCreatePagefilePrivilege 4364 wmic.exe Token: SeBackupPrivilege 4364 wmic.exe Token: SeRestorePrivilege 4364 wmic.exe Token: SeShutdownPrivilege 4364 wmic.exe Token: SeDebugPrivilege 4364 wmic.exe Token: SeSystemEnvironmentPrivilege 4364 wmic.exe Token: SeRemoteShutdownPrivilege 4364 wmic.exe Token: SeUndockPrivilege 4364 wmic.exe Token: SeManageVolumePrivilege 4364 wmic.exe Token: 33 4364 wmic.exe Token: 34 4364 wmic.exe Token: 35 4364 wmic.exe Token: 36 4364 wmic.exe Token: SeIncreaseQuotaPrivilege 4364 wmic.exe Token: SeSecurityPrivilege 4364 wmic.exe Token: SeTakeOwnershipPrivilege 4364 wmic.exe Token: SeLoadDriverPrivilege 4364 wmic.exe Token: SeSystemProfilePrivilege 4364 wmic.exe Token: SeSystemtimePrivilege 4364 wmic.exe Token: SeProfSingleProcessPrivilege 4364 wmic.exe Token: SeIncBasePriorityPrivilege 4364 wmic.exe Token: SeCreatePagefilePrivilege 4364 wmic.exe Token: SeBackupPrivilege 4364 wmic.exe Token: SeRestorePrivilege 4364 wmic.exe Token: SeShutdownPrivilege 4364 wmic.exe Token: SeDebugPrivilege 4364 wmic.exe Token: SeSystemEnvironmentPrivilege 4364 wmic.exe Token: SeRemoteShutdownPrivilege 4364 wmic.exe Token: SeUndockPrivilege 4364 wmic.exe Token: SeManageVolumePrivilege 4364 wmic.exe Token: 33 4364 wmic.exe Token: 34 4364 wmic.exe Token: 35 4364 wmic.exe Token: 36 4364 wmic.exe Token: SeIncreaseQuotaPrivilege 3360 wmic.exe Token: SeSecurityPrivilege 3360 wmic.exe Token: SeTakeOwnershipPrivilege 3360 wmic.exe Token: SeLoadDriverPrivilege 3360 wmic.exe Token: SeSystemProfilePrivilege 3360 wmic.exe Token: SeSystemtimePrivilege 3360 wmic.exe Token: SeProfSingleProcessPrivilege 3360 wmic.exe Token: SeIncBasePriorityPrivilege 3360 wmic.exe Token: SeCreatePagefilePrivilege 3360 wmic.exe Token: SeBackupPrivilege 3360 wmic.exe Token: SeRestorePrivilege 3360 wmic.exe Token: SeShutdownPrivilege 3360 wmic.exe Token: SeDebugPrivilege 3360 wmic.exe Token: SeSystemEnvironmentPrivilege 3360 wmic.exe Token: SeRemoteShutdownPrivilege 3360 wmic.exe Token: SeUndockPrivilege 3360 wmic.exe Token: SeManageVolumePrivilege 3360 wmic.exe Token: 33 3360 wmic.exe Token: 34 3360 wmic.exe Token: 35 3360 wmic.exe Token: 36 3360 wmic.exe Token: SeIncreaseQuotaPrivilege 3360 wmic.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3496 wrote to memory of 4364 3496 2026-08-03_c3c6041ff7a3164de0a7ef8dc4ae3025_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_hel.exe 89 PID 3496 wrote to memory of 3360 3496 2026-08-03_c3c6041ff7a3164de0a7ef8dc4ae3025_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_hel.exe 92 PID 3496 wrote to memory of 2308 3496 2026-08-03_c3c6041ff7a3164de0a7ef8dc4ae3025_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_hel.exe 94 PID 3496 wrote to memory of 2348 3496 2026-08-03_c3c6041ff7a3164de0a7ef8dc4ae3025_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_hel.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_c3c6041ff7a3164de0a7ef8dc4ae3025_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_hel.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_c3c6041ff7a3164de0a7ef8dc4ae3025_blankgrabber_cobalt-strike_coinminer_gazer_glassworm_hel.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
-
C:\Windows\System32\Wbem\wmic.exewmic baseboard get SerialNumber2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3360
-
-
C:\Windows\System32\Wbem\wmic.exewmic memphysical list brief2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2308
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get processorid2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2348
-