Overview

overview

7

Static

static

3

2026-09-30...at.exe

windows10-2004-x64

7

2026-09-30...at.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/10/2026, 17:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-30_27641068a752a31c1fee4cc3e5d98c07_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
  • Size 6.9MB
  • Sample261001-vqsrsavyat
  • SHA256 2ada94caf16ab6840621a6417a397f365509ce1880836f0791885b9df050b0cc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 15 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies registry class 6 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27641068a752a31c1fee4cc3e5d98c07_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27641068a752a31c1fee4cc3e5d98c07_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27641068a752a31c1fee4cc3e5d98c07_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-30_27641068a752a31c1fee4cc3e5d98c07_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      PID:2004

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1336_911929_L5DBPvSm-b0\VCRUNTIME140.dll
        • Size 121KB
        • SHA256 0205071c36c17f1efbd70178c852cb7d49985c484202752b8704b7ac6b184e60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1336_911929_L5DBPvSm-b0\_bz2.pyd
        • Size 35KB
        • SHA256 667d0a109f432c18b85f0f2c37a3bc382adb9e30a9cc8aa64497832f93a74b99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1336_911929_L5DBPvSm-b0\_hashlib.pyd
        • Size 60KB
        • SHA256 8086ee59bdb3f7d5f45da70d3861360600d3cc6ff68b801972f869d84c4886f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1336_911929_L5DBPvSm-b0\_lzma.pyd
        • Size 48KB
        • SHA256 88c54c2ec35d9f12c4051c68b623ed4e3c71e1510d989490eb38074c2db8d43f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1336_911929_L5DBPvSm-b0\_socket.pyd
        • Size 83KB
        • SHA256 764f8608e0c8aaff7fa0381a71921dd739adba7d1ecb03d4dfa60574ebfae70d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1336_911929_L5DBPvSm-b0\_ssl.pyd
        • Size 177KB
        • SHA256 4290f033a14643c448f14dd82ec391d95edd3ad9939077a37f832c171f924490
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libbz2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1336_911929_L5DBPvSm-b0\libbz2.dll
        • Size 81KB
        • SHA256 25a4aae35dd89709620106db311af5bca7c868182b961e106a895ae14d2fc98a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1336_911929_L5DBPvSm-b0\libcrypto-3-x64.dll
        • Size 7.0MB
        • SHA256 83e02d124c675839765df4cf42bf483d239204c5d70e83232ce1cb131c6f7a4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        liblzma.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1336_911929_L5DBPvSm-b0\liblzma.dll
        • Size 195KB
        • SHA256 960b67b5188e142ae86e7a3ad0ad417a6c50e7a511b19155ad46061f46d0857f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3-x64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1336_911929_L5DBPvSm-b0\libssl-3-x64.dll
        • Size 1.3MB
        • SHA256 8cce38aefaaa530528949a9f3901c09d5578b91fe9b6a0248427c983f1b54559
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1336_911929_L5DBPvSm-b0\python312.dll
        • Size 7.1MB
        • SHA256 72c1bea78e0c49f746889a3af8c4973e044e50e319c1c976dd98059a403404da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1336_911929_L5DBPvSm-b0\select.pyd
        • Size 30KB
        • SHA256 9b2db44d96870efb13a0bf1013b7863bf3c9fe823cf55928afdd797440257fb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        temp_secure_build.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1336_911929_L5DBPvSm-b0\temp_secure_build.dll
        • Size 6.0MB
        • SHA256 dd380bb23d0179f8a1486cc15490de0991230a27a83c1b80aa808e8f2ab93a58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1336_911929_L5DBPvSm-b0\unicodedata.pyd
        • Size 1.1MB
        • SHA256 046ea71130dcc8f9da1a37f9acd0c9c4b2b67f608457f1e254a959b921694fbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1336_911929_L5DBPvSm-b0\zlib.dll
        • Size 100KB
        • SHA256 a2e123cc624634d08200b4e5ee6a2828d2df88fd9573b5b5fdd9da336f5738a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download