28ab45529c6f6b62054830c5857d5c6c80b4ffcecd4a2d962855c752f3056522

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 23:36

Target
2026-09-22_e33c63f2729780d7d11d033756ae877b_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe
Size 20.2MB
Sample260922-3l24natgrd
SHA256 28ab45529c6f6b62054830c5857d5c6c80b4ffcecd4a2d962855c752f3056522
MD5 e33c63f2729780d7d11d033756ae877b
SHA1 826f6513db6b3d6329e7423894ea0433b1005470
SHA512 034a878dea91c638821d3ed1a7d1e7c36f4e0b8b2e52f18112acf57ca36dd5c48b40aaa9a410662d0dc20bc7a77e3c4bb2303e61fc416a6d9efb251d08187ed9
SSDEEP 393216:NJ3ZUg8e7yAr/JcCy3Xp84W/moR2hd1mrtvn5MRbRmOmD:NFZmcJIWl/mB/RbHm
TLSH
T1AF27D01AB66A18BDD8D6C4B4834B59238B20749B17716DEF43C496B52FAF7E00F39B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
804	Process not Found
804	Process not Found

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 1104	2444	2026-09-22_e33c63f2729780d7d11d033756ae877b_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-22_e33c63f2729780d7d11d033756ae877b_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-22_e33c63f2729780d7d11d033756ae877b_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\2026-09-22_e33c63f2729780d7d11d033756ae877b_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-22_e33c63f2729780d7d11d033756ae877b_blankgrabber_cobalt-strike_coinminer_glassworm_icedid_me.exe" --bz-worker-process --ctl-in 352 --ctl-out 364 --color --bz-tty
  2⤵
  PID:1104