Analysis
- max time kernel
149s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20251223-en - resource tags
- submitted
18/12/2025, 09:48
General
- Target 2025-12-18_5c480b9b6ee16832d25b54cc1c83f25d_coinminer_elex_glassworm_maze_stealc.exe
- Size 2.0MB
- Sample251218-lsv59askes
- SHA256 472eb658a4702eab3c579ddf1cafa16cb9e8594e352934af1ce4730cfd174281
Malware Config
Extracted
-
ffdroider
-
http://186.2.171.3
Signatures
- FFDroider
Stealer targeting social media platform users first seen in April 2022.
- FFDroider payload 2 IoCs
- Ffdroider family
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-12-18_5c480b9b6ee16832d25b54cc1c83f25d_coinminer_elex_glassworm_maze_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2025-12-18_5c480b9b6ee16832d25b54cc1c83f25d_coinminer_elex_glassworm_maze_stealc.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
d
d.INTEG.RAW
memory/5024-173-0x00000000044C0000-0x00000000044C8000-memory.dmp
memory/5024-177-0x0000000004620000-0x0000000004628000-memory.dmp
memory/5024-0-0x0000000000400000-0x000000000062B000-memory.dmp
memory/5024-23-0x00000000045C0000-0x00000000045C8000-memory.dmp
memory/5024-26-0x0000000004700000-0x0000000004708000-memory.dmp
memory/5024-27-0x0000000004720000-0x0000000004728000-memory.dmp
memory/5024-28-0x0000000004B10000-0x0000000004B18000-memory.dmp
memory/5024-29-0x0000000004A10000-0x0000000004A18000-memory.dmp
memory/5024-30-0x0000000004880000-0x0000000004888000-memory.dmp
memory/5024-35-0x0000000004500000-0x0000000004508000-memory.dmp
memory/5024-39-0x0000000004880000-0x0000000004888000-memory.dmp
memory/5024-41-0x00000000049B0000-0x00000000049B8000-memory.dmp
memory/5024-46-0x0000000004500000-0x0000000004508000-memory.dmp
memory/5024-50-0x00000000049B0000-0x00000000049B8000-memory.dmp
memory/5024-52-0x0000000004880000-0x0000000004888000-memory.dmp
memory/5024-94-0x00000000043C0000-0x00000000043C8000-memory.dmp
memory/5024-11-0x0000000003A10000-0x0000000003A20000-memory.dmp
memory/5024-95-0x00000000043E0000-0x00000000043E8000-memory.dmp
memory/5024-98-0x00000000044C0000-0x00000000044C8000-memory.dmp
memory/5024-101-0x0000000004600000-0x0000000004608000-memory.dmp
memory/5024-102-0x0000000004620000-0x0000000004628000-memory.dmp
memory/5024-103-0x00000000046D0000-0x00000000046D8000-memory.dmp
memory/5024-104-0x00000000046E0000-0x00000000046E8000-memory.dmp
memory/5024-105-0x0000000004640000-0x0000000004648000-memory.dmp
memory/5024-110-0x00000000043E0000-0x00000000043E8000-memory.dmp
memory/5024-114-0x0000000004640000-0x0000000004648000-memory.dmp
memory/5024-116-0x0000000004670000-0x0000000004678000-memory.dmp
memory/5024-121-0x00000000043E0000-0x00000000043E8000-memory.dmp
memory/5024-125-0x0000000004670000-0x0000000004678000-memory.dmp
memory/5024-127-0x0000000004640000-0x0000000004648000-memory.dmp
memory/5024-169-0x00000000043C0000-0x00000000043C8000-memory.dmp
memory/5024-170-0x00000000043E0000-0x00000000043E8000-memory.dmp
memory/5024-21-0x0000000004500000-0x0000000004508000-memory.dmp
memory/5024-20-0x00000000044E0000-0x00000000044E8000-memory.dmp
memory/5024-196-0x00000000043E0000-0x00000000043E8000-memory.dmp
memory/5024-178-0x00000000046D0000-0x00000000046D8000-memory.dmp
memory/5024-179-0x00000000046E0000-0x00000000046E8000-memory.dmp
memory/5024-180-0x0000000004640000-0x0000000004648000-memory.dmp
memory/5024-185-0x00000000043E0000-0x00000000043E8000-memory.dmp
memory/5024-189-0x0000000004640000-0x0000000004648000-memory.dmp
memory/5024-191-0x0000000004670000-0x0000000004678000-memory.dmp
memory/5024-176-0x0000000004600000-0x0000000004608000-memory.dmp
memory/5024-200-0x0000000004670000-0x0000000004678000-memory.dmp
memory/5024-202-0x0000000004640000-0x0000000004648000-memory.dmp
memory/5024-244-0x00000000043C0000-0x00000000043C8000-memory.dmp
memory/5024-245-0x00000000043E0000-0x00000000043E8000-memory.dmp
memory/5024-248-0x00000000044C0000-0x00000000044C8000-memory.dmp
memory/5024-251-0x0000000004600000-0x0000000004608000-memory.dmp
memory/5024-252-0x0000000004620000-0x0000000004628000-memory.dmp
memory/5024-253-0x00000000046D0000-0x00000000046D8000-memory.dmp
memory/5024-254-0x00000000046E0000-0x00000000046E8000-memory.dmp
memory/5024-255-0x0000000004640000-0x0000000004648000-memory.dmp
memory/5024-260-0x00000000043E0000-0x00000000043E8000-memory.dmp
memory/5024-264-0x0000000004640000-0x0000000004648000-memory.dmp
memory/5024-266-0x0000000004670000-0x0000000004678000-memory.dmp
memory/5024-271-0x00000000043E0000-0x00000000043E8000-memory.dmp
memory/5024-275-0x0000000004670000-0x0000000004678000-memory.dmp
memory/5024-277-0x0000000004640000-0x0000000004648000-memory.dmp
memory/5024-319-0x00000000043C0000-0x00000000043C8000-memory.dmp
memory/5024-320-0x00000000043E0000-0x00000000043E8000-memory.dmp
memory/5024-323-0x00000000044C0000-0x00000000044C8000-memory.dmp
memory/5024-326-0x0000000004600000-0x0000000004608000-memory.dmp
memory/5024-327-0x0000000004620000-0x0000000004628000-memory.dmp
memory/5024-328-0x00000000046D0000-0x00000000046D8000-memory.dmp
memory/5024-3-0x0000000003850000-0x0000000003860000-memory.dmp
memory/5024-376-0x0000000000400000-0x000000000062B000-memory.dmp