Analysis
- max time kernel
152s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 21:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe
- Size 79.6MB
- Sample260809-1qmtescf56
- SHA256 7e9319c504ceb8aed0f9f7776d2322cd701c84c273b97f405f591dfddbd657ea
- MD5 2f377b88fd722d6c8b85101edc07c7bd
- SHA1 0b522e6ecf4f29b2dd07108942fce4cd8b53f808
- SHA512 960ec7634c18719ad39a62b73402e5c983f2c4d5c4c34ba50e01124c49c221d80bcc896e66e2ab5925f676418fb285dce29a20dac3bbeac465279f01a392c0ee
- SSDEEP 393216:0Eh183u6i+BptZK6a+HnV7yaG0D46lcigGZroQRqDrVtZBJSIzf67yjgIP6CpzQ2:0EwTZ6+rqH5KCTuuZZfgDvxOtxxy2
- TLSH T101087B42A3FA04D5E9FB9A3489E65213D673BC063F3086DB324C176A1F736E09976721
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 4992 tasklist.exe -
pid Process 3876 powershell.exe - Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1936 cmd.exe 4668 cmd.exe 5160 cmd.exe 2472 cmd.exe - Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 5272 WMIC.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5272 WMIC.exe 5272 WMIC.exe 5272 WMIC.exe 5272 WMIC.exe 1924 WMIC.exe 1924 WMIC.exe 1924 WMIC.exe 1924 WMIC.exe 3876 powershell.exe 3876 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4992 tasklist.exe Token: SeIncreaseQuotaPrivilege 5272 WMIC.exe Token: SeSecurityPrivilege 5272 WMIC.exe Token: SeTakeOwnershipPrivilege 5272 WMIC.exe Token: SeLoadDriverPrivilege 5272 WMIC.exe Token: SeSystemProfilePrivilege 5272 WMIC.exe Token: SeSystemtimePrivilege 5272 WMIC.exe Token: SeProfSingleProcessPrivilege 5272 WMIC.exe Token: SeIncBasePriorityPrivilege 5272 WMIC.exe Token: SeCreatePagefilePrivilege 5272 WMIC.exe Token: SeBackupPrivilege 5272 WMIC.exe Token: SeRestorePrivilege 5272 WMIC.exe Token: SeShutdownPrivilege 5272 WMIC.exe Token: SeDebugPrivilege 5272 WMIC.exe Token: SeSystemEnvironmentPrivilege 5272 WMIC.exe Token: SeRemoteShutdownPrivilege 5272 WMIC.exe Token: SeUndockPrivilege 5272 WMIC.exe Token: SeManageVolumePrivilege 5272 WMIC.exe Token: 33 5272 WMIC.exe Token: 34 5272 WMIC.exe Token: 35 5272 WMIC.exe Token: 36 5272 WMIC.exe Token: SeIncreaseQuotaPrivilege 5272 WMIC.exe Token: SeSecurityPrivilege 5272 WMIC.exe Token: SeTakeOwnershipPrivilege 5272 WMIC.exe Token: SeLoadDriverPrivilege 5272 WMIC.exe Token: SeSystemProfilePrivilege 5272 WMIC.exe Token: SeSystemtimePrivilege 5272 WMIC.exe Token: SeProfSingleProcessPrivilege 5272 WMIC.exe Token: SeIncBasePriorityPrivilege 5272 WMIC.exe Token: SeCreatePagefilePrivilege 5272 WMIC.exe Token: SeBackupPrivilege 5272 WMIC.exe Token: SeRestorePrivilege 5272 WMIC.exe Token: SeShutdownPrivilege 5272 WMIC.exe Token: SeDebugPrivilege 5272 WMIC.exe Token: SeSystemEnvironmentPrivilege 5272 WMIC.exe Token: SeRemoteShutdownPrivilege 5272 WMIC.exe Token: SeUndockPrivilege 5272 WMIC.exe Token: SeManageVolumePrivilege 5272 WMIC.exe Token: 33 5272 WMIC.exe Token: 34 5272 WMIC.exe Token: 35 5272 WMIC.exe Token: 36 5272 WMIC.exe Token: SeIncreaseQuotaPrivilege 1924 WMIC.exe Token: SeSecurityPrivilege 1924 WMIC.exe Token: SeTakeOwnershipPrivilege 1924 WMIC.exe Token: SeLoadDriverPrivilege 1924 WMIC.exe Token: SeSystemProfilePrivilege 1924 WMIC.exe Token: SeSystemtimePrivilege 1924 WMIC.exe Token: SeProfSingleProcessPrivilege 1924 WMIC.exe Token: SeIncBasePriorityPrivilege 1924 WMIC.exe Token: SeCreatePagefilePrivilege 1924 WMIC.exe Token: SeBackupPrivilege 1924 WMIC.exe Token: SeRestorePrivilege 1924 WMIC.exe Token: SeShutdownPrivilege 1924 WMIC.exe Token: SeDebugPrivilege 1924 WMIC.exe Token: SeSystemEnvironmentPrivilege 1924 WMIC.exe Token: SeRemoteShutdownPrivilege 1924 WMIC.exe Token: SeUndockPrivilege 1924 WMIC.exe Token: SeManageVolumePrivilege 1924 WMIC.exe Token: 33 1924 WMIC.exe Token: 34 1924 WMIC.exe Token: 35 1924 WMIC.exe Token: 36 1924 WMIC.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3504 wrote to memory of 1936 3504 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe 89 PID 1936 wrote to memory of 4992 1936 cmd.exe 91 PID 3504 wrote to memory of 4668 3504 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe 93 PID 4668 wrote to memory of 5272 4668 cmd.exe 95 PID 3504 wrote to memory of 5160 3504 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe 96 PID 5160 wrote to memory of 1924 5160 cmd.exe 98 PID 3504 wrote to memory of 2472 3504 2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe 99 PID 2472 wrote to memory of 3876 2472 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_2f377b88fd722d6c8b85101edc07c7bd_blankgrabber_cobalt-strike_coinminer_funksec_glassworm_i.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /fo csv"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\system32\tasklist.exetasklist /fo csv3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name /value3⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5272
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_VideoController get CurrentRefreshRate /value"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_VideoController get CurrentRefreshRate /value3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty CurrentRefreshRate""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty CurrentRefreshRate"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3876
-
-