Overview

overview

9

Static

static

3

2026-08-13...at.exe

windows10-2004-x64

9

2026-08-13...at.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 09:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_6a165f1ee3ebebd54750c6a291b6e161_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
  • Size 15.2MB
  • Sample260813-lbnd3sem61
  • SHA256 ce55af78f97ce5e1a86b703ef0e656fbcb222259d1703691d6eb92d92226d49d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10

Malware Config

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Loads dropped DLL 23 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 6 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_6a165f1ee3ebebd54750c6a291b6e161_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_6a165f1ee3ebebd54750c6a291b6e161_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3712
    • C:\Users\Admin\AppData\Local\Temp\2026-08-13_6a165f1ee3ebebd54750c6a291b6e161_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
      C:\Users\Admin\AppData\Local\Temp\2026-08-13_6a165f1ee3ebebd54750c6a291b6e161_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
      2⤵
      • Loads dropped DLL
      PID:3740

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\_bz2.pyd
        • Size 84KB
        • SHA256 1bf985b54f529a3cbb3e52532791cc4d4c64009142d37b54eb3521adec203d5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\_cffi_backend.pyd
        • Size 176KB
        • SHA256 d5b09da2e726b4e90cf0edad5d2a0ec52f369dfd060e14d3807a32b2205031fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\_ctypes.pyd
        • Size 131KB
        • SHA256 96b07339d52c74f2a1dd043df5eb931e4072eed90a3a8715ffec751d818e4117
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\_hashlib.pyd
        • Size 67KB
        • SHA256 50f3ce7a2281fd32f378f3ba5067bdd13e18ee95877db5199c6a0babdc9c516a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\_lzma.pyd
        • Size 155KB
        • SHA256 51815b6474d4216c6a2aeaffdae5d2ff4acb7a0236254f2cfe43247022f3d781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\_socket.pyd
        • Size 84KB
        • SHA256 8676f3cebd9d01c7ad51a29b3f7ff429c0a8f6bc564cab21eb6cdaa2e26fd259
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\_sqlite3.pyd
        • Size 127KB
        • SHA256 bb80e54f2de8aa3cddc00a2a2f893c432d45ecd64a5c55758a4eb6d2e3007127
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\_ssl.pyd
        • Size 177KB
        • SHA256 b8118580b461801df12ec12d3d666aa0ebc2b3750bcf92b90b92789b152bf856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\_uuid.pyd
        • Size 27KB
        • SHA256 0116497261edadfe42ba7daf367c8a9ea27a1db210c8384943c890f532e3ce72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\_wmi.pyd
        • Size 38KB
        • SHA256 9a7255064ea143895b28efea6d78e9e518bac290900aec52a6a0435c36a172fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _rust.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\cryptography\hazmat\bindings\_rust.pyd
        • Size 9.4MB
        • SHA256 051e355666d8d242827c7969b70f6da6b7f27aa23fcd5c36fcb0c81bc25a6856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\libssl-3.dll
        • Size 776KB
        • SHA256 cf1a5fdcefa3daf69041f31f98ece1d7911ca4fcb8e9f1043b4d0f459ae4c936
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        obf_main.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\obf_main.dll
        • Size 27.4MB
        • SHA256 d1272298d4246c0d4395414c880f799fd6a246eb2803374873236cb2b05a2b17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\python3.dll
        • Size 70KB
        • SHA256 cbc4876275178244905ee45a9ee6ec9fa4bfb9aad6209a03b756d38a186f80d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\python313.dll
        • Size 5.8MB
        • SHA256 6964e590037c41d631fd1215f05af154f7fa68105993c6f573a20689b473f1ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\select.pyd
        • Size 32KB
        • SHA256 ddf1221851814943a82ed8a986d228463404da2ada969661bdd69223f14fc050
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\sqlite3.dll
        • Size 1.5MB
        • SHA256 5932500d09fbd72559173b5abb7f5174d400f968f08680a1090e75b75bb03bc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_3712_982524_uqQOzN3lprc\vcruntime140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download