Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 18:50
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe
- Size 78.3MB
- Sample260809-xg9eaatfmc
- SHA256 759ca1043e6f5c10eae4cb2c383ff52c9d85c7905b914053d029f8443bef9781
- MD5 0c269fa5c8c5c15e2489c7cf08ae8dbc
- SHA1 00e094b958927d421a7d481eb9123098ede84bad
- SHA512 a155680a7d5ec08a9ddb6de6ca0697b3d2f34c290a944cf19f801565264461810b615797804b3f678f4893a859f4f6a32b52cc238e7bc3768baa61ea96736a8d
- SSDEEP 393216:CEI64mShA4qF0mHlhDCDv7aClkNRI147WBK0QSI8w5SvDazn1d5VRx+Abr7nB9GW:CQgbLfQlRXHnysf+tgPdBse6NjQH
- TLSH T190087C4667EA04D5F9FB9A349AE65213C673BC463F3085CF3208172A1F736E0997A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 960 tasklist.exe -
pid Process 4428 powershell.exe - Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4928 cmd.exe 4856 cmd.exe 2620 cmd.exe 2588 cmd.exe - Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4368 WMIC.exe - Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4368 WMIC.exe 4368 WMIC.exe 4368 WMIC.exe 4368 WMIC.exe 5512 WMIC.exe 5512 WMIC.exe 5512 WMIC.exe 5512 WMIC.exe 4428 powershell.exe 4428 powershell.exe 4428 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 960 tasklist.exe Token: SeIncreaseQuotaPrivilege 4368 WMIC.exe Token: SeSecurityPrivilege 4368 WMIC.exe Token: SeTakeOwnershipPrivilege 4368 WMIC.exe Token: SeLoadDriverPrivilege 4368 WMIC.exe Token: SeSystemProfilePrivilege 4368 WMIC.exe Token: SeSystemtimePrivilege 4368 WMIC.exe Token: SeProfSingleProcessPrivilege 4368 WMIC.exe Token: SeIncBasePriorityPrivilege 4368 WMIC.exe Token: SeCreatePagefilePrivilege 4368 WMIC.exe Token: SeBackupPrivilege 4368 WMIC.exe Token: SeRestorePrivilege 4368 WMIC.exe Token: SeShutdownPrivilege 4368 WMIC.exe Token: SeDebugPrivilege 4368 WMIC.exe Token: SeSystemEnvironmentPrivilege 4368 WMIC.exe Token: SeRemoteShutdownPrivilege 4368 WMIC.exe Token: SeUndockPrivilege 4368 WMIC.exe Token: SeManageVolumePrivilege 4368 WMIC.exe Token: 33 4368 WMIC.exe Token: 34 4368 WMIC.exe Token: 35 4368 WMIC.exe Token: 36 4368 WMIC.exe Token: SeIncreaseQuotaPrivilege 4368 WMIC.exe Token: SeSecurityPrivilege 4368 WMIC.exe Token: SeTakeOwnershipPrivilege 4368 WMIC.exe Token: SeLoadDriverPrivilege 4368 WMIC.exe Token: SeSystemProfilePrivilege 4368 WMIC.exe Token: SeSystemtimePrivilege 4368 WMIC.exe Token: SeProfSingleProcessPrivilege 4368 WMIC.exe Token: SeIncBasePriorityPrivilege 4368 WMIC.exe Token: SeCreatePagefilePrivilege 4368 WMIC.exe Token: SeBackupPrivilege 4368 WMIC.exe Token: SeRestorePrivilege 4368 WMIC.exe Token: SeShutdownPrivilege 4368 WMIC.exe Token: SeDebugPrivilege 4368 WMIC.exe Token: SeSystemEnvironmentPrivilege 4368 WMIC.exe Token: SeRemoteShutdownPrivilege 4368 WMIC.exe Token: SeUndockPrivilege 4368 WMIC.exe Token: SeManageVolumePrivilege 4368 WMIC.exe Token: 33 4368 WMIC.exe Token: 34 4368 WMIC.exe Token: 35 4368 WMIC.exe Token: 36 4368 WMIC.exe Token: SeIncreaseQuotaPrivilege 5512 WMIC.exe Token: SeSecurityPrivilege 5512 WMIC.exe Token: SeTakeOwnershipPrivilege 5512 WMIC.exe Token: SeLoadDriverPrivilege 5512 WMIC.exe Token: SeSystemProfilePrivilege 5512 WMIC.exe Token: SeSystemtimePrivilege 5512 WMIC.exe Token: SeProfSingleProcessPrivilege 5512 WMIC.exe Token: SeIncBasePriorityPrivilege 5512 WMIC.exe Token: SeCreatePagefilePrivilege 5512 WMIC.exe Token: SeBackupPrivilege 5512 WMIC.exe Token: SeRestorePrivilege 5512 WMIC.exe Token: SeShutdownPrivilege 5512 WMIC.exe Token: SeDebugPrivilege 5512 WMIC.exe Token: SeSystemEnvironmentPrivilege 5512 WMIC.exe Token: SeRemoteShutdownPrivilege 5512 WMIC.exe Token: SeUndockPrivilege 5512 WMIC.exe Token: SeManageVolumePrivilege 5512 WMIC.exe Token: 33 5512 WMIC.exe Token: 34 5512 WMIC.exe Token: 35 5512 WMIC.exe Token: 36 5512 WMIC.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2636 wrote to memory of 4856 2636 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe 89 PID 4856 wrote to memory of 960 4856 cmd.exe 91 PID 2636 wrote to memory of 2620 2636 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe 93 PID 2620 wrote to memory of 4368 2620 cmd.exe 95 PID 2636 wrote to memory of 2588 2636 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe 96 PID 2588 wrote to memory of 5512 2588 cmd.exe 98 PID 2636 wrote to memory of 4928 2636 2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe 99 PID 4928 wrote to memory of 4428 4928 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_0c269fa5c8c5c15e2489c7cf08ae8dbc_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_lu.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /fo csv"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\system32\tasklist.exetasklist /fo csv3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:960
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name /value"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name /value3⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path Win32_VideoController get CurrentRefreshRate /value"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_VideoController get CurrentRefreshRate /value3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5512
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty CurrentRefreshRate""2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty CurrentRefreshRate"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4428
-
-