Overview

overview

7

Static

static

3

2026-09-12...oa.exe

windows10-2004-x64

7

2026-09-12...oa.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    110s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/09/2026, 07:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-12_00a9a26bbeb996df9c00a38133b4f469_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
  • Size 80.8MB
  • Sample260913-jee6rsgf86
  • SHA256 4bfc02337b434f3851a16c456d64bce7168a31c16613bdaf7bbc4fba3ba7089d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 46 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-12_00a9a26bbeb996df9c00a38133b4f469_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-12_00a9a26bbeb996df9c00a38133b4f469_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4308
    • C:\Users\Admin\AppData\Local\Temp\2026-09-12_00a9a26bbeb996df9c00a38133b4f469_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-12_00a9a26bbeb996df9c00a38133b4f469_blankgrabber_cobalt-strike_coinminer_glassworm_hijackloa.exe
      2⤵
      • Loads dropped DLL
      • Enumerates connected drives
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      PID:3288

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        1.ttf
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\1.ttf
        • Size 224KB
        • SHA256 e961399ff3ee006cd60aeab77fac3194610c7aef1d85bf678164fb05d8526579
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\PySide6\QtCore.pyd
        • Size 3.2MB
        • SHA256 74f96322c5e9cea73aefd2ed5870e5275336b31f552fcd32f12fc81d23f1bc6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\PySide6\QtGui.pyd
        • Size 3.7MB
        • SHA256 7bef20046045199c037b7cbfedaa1c5464730fa948b2c9ec8afbf718e63774d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\PySide6\QtWidgets.pyd
        • Size 4.6MB
        • SHA256 f12f4ca641998e5706d5f7b0023147d573f0f2d2361e26dadf31bdbf05fbfd1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qsvgicon.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\PySide6\qt-plugins\iconengines\qsvgicon.dll
        • Size 70KB
        • SHA256 5bb97b6f114682ae0b5f42b23b6818aece6499bad88dac80a138efa8a88c12bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qdirect2d.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\PySide6\qt-plugins\platforms\qdirect2d.dll
        • Size 1.0MB
        • SHA256 56f41ad523d016fe2cf2c90fae158e21766d1fcd021bced1a3704c6da0f00c98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qminimal.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\PySide6\qt-plugins\platforms\qminimal.dll
        • Size 60KB
        • SHA256 768a9c6dbb1c86abbefa2ff9d7e98cdfb4fdc9292eb8d64195bb6d23939a5344
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qoffscreen.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\PySide6\qt-plugins\platforms\qoffscreen.dll
        • Size 108KB
        • SHA256 e776251668440169ed18a2fe1b236762d514ef5244639cbb559b5a77ddd38954
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwindows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\PySide6\qt-plugins\platforms\qwindows.dll
        • Size 967KB
        • SHA256 bf6dbc3009f386fa22f0ced560bea6bbf3e0e0b4442d2fb855db67cffce49dbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qmodernwindowsstyle.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\PySide6\qt-plugins\styles\qmodernwindowsstyle.dll
        • Size 234KB
        • SHA256 a7a6424c23bf371bd28a404a196b210971726f6f2a87b63aac185a5e6e40da71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\Qt6Core.dll
        • Size 9.9MB
        • SHA256 d6a3c37c5263c5d418fc0e80b722bc9fca7c0859e6f635f9624a2fde00bdc653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 ae29b005f51b6850bf57fa06fced0dc8c7039fd6fafc3bfbcfe76e38adc7abf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\Qt6Widgets.dll
        • Size 6.2MB
        • SHA256 ff0df9e2e6827e035f0731a4cedfc6333f4602bca00775e56346f27032406b74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\_bz2.pyd
        • Size 82KB
        • SHA256 fc3b481684b926350057e263622a2a5335b149a0498a8d65c4f37e39dd90b640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\_ctypes.pyd
        • Size 128KB
        • SHA256 f63c6c7e71c342084d8f1a108786ca6975a52cefef8be32cc2589e6e2fe060c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\_hashlib.pyd
        • Size 62KB
        • SHA256 838d5c8b7c3212c8429baf612623abbbc20a9023eec41e34e5461b76a285b86c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\_lzma.pyd
        • Size 154KB
        • SHA256 d080eabd015a3569813a220fd4ea74dff34ed2a8519a10473eb37e22b1118a06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\_wmi.pyd
        • Size 37KB
        • SHA256 6435c679a3a3ff4f16708ebc43f7ca62456c110ac1ea94f617d8052c90c143c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyside6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\pyside6.abi3.dll
        • Size 249KB
        • SHA256 d0b5c701fb3a8ea839e72b602058f3960935156ebeca084893c54c99e54dd707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\python3.dll
        • Size 68KB
        • SHA256 a5c6a329698490a035133433928d04368ce6285bb91a9d074fc285de4c9a32a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\python313.dll
        • Size 5.8MB
        • SHA256 0c0a66505093b6a4bb3475f716bd3d9552095776f6a124709c13b3f9552c7d99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qt6svg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\qt6svg.dll
        • Size 594KB
        • SHA256 1eac8f7415b311a88cb3cb4e25c3098d0e059c24c831fbbb13f43a80f0df06b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup_fa.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\setup_fa.dll
        • Size 6.5MB
        • SHA256 e356b71b376abfd1e5e9c0907b5345ae42005e3765cc567b424e1df0ccd4dc29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shiboken6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\shiboken6.abi3.dll
        • Size 384KB
        • SHA256 de3c6b2ed5f75c9ac0de4a6844b653b3b9d09263ce68c2b5fc25a96c5c3e8469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\shiboken6\MSVCP140_1.dll
        • Size 26KB
        • SHA256 7f556f0a0b944df7b64b916b344a070b7e6f6cf342194475594447ca88c07659
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Shiboken.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\shiboken6\Shiboken.pyd
        • Size 32KB
        • SHA256 2f6f3a694f675b1dafdae26903191613c02866ab48e02591ae34ca1a3b1284f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\shiboken6\msvcp140.dll
        • Size 536KB
        • SHA256 fd4a8c046fa3fea9ca6132f50cf8a56cf1e783b2d3093ba5c85fa063bc6b3845
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4308_684925_E1CB1ZzoHwE\shiboken6\msvcp140_2.dll
        • Size 265KB
        • SHA256 720091576d0e2669d16e8ad203a1f81a7c0811a6906452964d6e5fcb28a8de4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3288-111-0x00007FFC69F20000-0x00007FFC6A2DC000-memory.dmp
        Download

        memory/3288-104-0x00007FFC6AC10000-0x00007FFC6B244000-memory.dmp
        Download

        memory/3288-108-0x00007FFC6B250000-0x00007FFC6B70A000-memory.dmp
        Download

        memory/3288-97-0x00007FFC6D030000-0x00007FFC6D367000-memory.dmp
        Download