Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
18/04/2026, 18:28
General
- Target 2026-04-18_54339822a9633d49e230b367333e607f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
- Size 57.7MB
- Sample260418-w4ggcaev2k
- SHA256 f221720d8817f6f9caf678dde62f43e9f19e7cd40e0b941371774caa85ed76fe
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 9 IoCs
- Clears Windows event logs 1 TTPs 2 IoCs
- UPX dump on OEP (original entry point) 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Executes dropped EXE 7 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 36 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-18_54339822a9633d49e230b367333e607f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-18_54339822a9633d49e230b367333e607f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe"C:\Users\Admin\AppData\Local\Temp\HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath '%~dp0'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess '%EXE_PATH%'; Add-MpPreference -ExclusionPath '%FOLDER_PATH%'; Add-MpPreference -ExclusionExtension '.exe'"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionProcess %EXE_PATH%4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\Data.exe"C:\Program Files (x86)\HFZ Activator A12+ Premium V1.2\utils\MobileDevice\Data.exe" /verysilent /norestart3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath '$env:APPDATA\windowshost'"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess '%EXE_PATH%'; Add-MpPreference -ExclusionPath '%FOLDER_PATH%'; Add-MpPreference -ExclusionExtension '.exe'"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionProcess %EXE_PATH%5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\windows update\cmd.exe"C:\Program Files\windows update\cmd.exe" /verysilent /norestart4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3DFE.tmp\3DFF.tmp\3E00.bat "C:\Program Files\windows update\cmd.exe" /verysilent /norestart"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq svchost32.exe"6⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\find.exefind /I "svchost32.exe"6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sys_update.exe"C:\Users\Admin\AppData\Local\Temp\sys_update.exe" --source="HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c s^ch^ta^sks /C^re^ate /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:003⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:004⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c w^ev^tu^ti^l cl "Windows-Security"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wevtutil.exewevtutil cl "Windows-Security"4⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe"C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" --source="HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c s^ch^ta^sks /C^re^ate /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:004⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:005⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c w^ev^tu^ti^l cl "Windows-Security"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wevtutil.exewevtutil cl "Windows-Security"5⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe"C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe" --config="C:\Users\Admin\AppData\Roaming\WindowsHost\config.json"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exeC:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1Clear Windows Event Logs
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
HFZ Activator A12+ Premium.exe
Data.exe
cmd.exe
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
0001.tmp
0003.tmp
0004.tmp
0005.tmp
2.tmp
3E00.bat
HFZ-ACTIVATOR-A12-Premium v1.2 (win).exe
__PSScriptPolicyTest_jd0dwqsr.vgu.ps1
sys_update.exe
config.json
svchost32.exe
memory/656-164-0x000000006EE20000-0x000000006EE6C000-memory.dmp
memory/1016-398-0x000000006FF60000-0x000000006FFAC000-memory.dmp
memory/1016-406-0x00000000076C0000-0x0000000007763000-memory.dmp
memory/1016-407-0x0000000007990000-0x00000000079A1000-memory.dmp
memory/1016-408-0x00000000079C0000-0x00000000079D4000-memory.dmp
memory/1328-97-0x00007FF72AEB0000-0x00007FF72B8A1000-memory.dmp
memory/1416-98-0x00007FF71F4B0000-0x00007FF722E68000-memory.dmp
memory/1496-175-0x000000006EE20000-0x000000006EE6C000-memory.dmp
memory/1496-148-0x0000000005630000-0x0000000005984000-memory.dmp
memory/1884-316-0x000000006EE20000-0x000000006EE6C000-memory.dmp
memory/1892-172-0x00007FF72D3D0000-0x00007FF72DDC1000-memory.dmp
memory/1892-173-0x000002689FBB0000-0x000002689FBBC000-memory.dmp
memory/1892-418-0x00007FF72D3D0000-0x00007FF72DDC1000-memory.dmp
memory/2524-126-0x000000006EE20000-0x000000006EE6C000-memory.dmp
memory/2524-135-0x00000000073B0000-0x0000000007453000-memory.dmp
memory/2524-143-0x00000000079F0000-0x0000000007A0A000-memory.dmp
memory/2524-142-0x00000000078F0000-0x0000000007904000-memory.dmp
memory/2524-141-0x00000000078E0000-0x00000000078EE000-memory.dmp
memory/2524-140-0x00000000078B0000-0x00000000078C1000-memory.dmp
memory/2524-139-0x0000000007930000-0x00000000079C6000-memory.dmp
memory/2524-99-0x0000000002DA0000-0x0000000002DD6000-memory.dmp
memory/2524-138-0x0000000007720000-0x000000000772A000-memory.dmp
memory/2524-137-0x00000000076B0000-0x00000000076CA000-memory.dmp
memory/2524-136-0x0000000007D00000-0x000000000837A000-memory.dmp
memory/2524-118-0x00000000063C0000-0x000000000640C000-memory.dmp
memory/2524-100-0x0000000005660000-0x0000000005C88000-memory.dmp
memory/2524-101-0x00000000053C0000-0x00000000053E2000-memory.dmp
memory/2524-134-0x0000000006930000-0x000000000694E000-memory.dmp
memory/2524-125-0x0000000006950000-0x0000000006982000-memory.dmp
memory/2524-104-0x0000000005D00000-0x0000000005D66000-memory.dmp
memory/2524-144-0x00000000079D0000-0x00000000079D8000-memory.dmp
memory/2524-111-0x0000000005D70000-0x00000000060C4000-memory.dmp
memory/2524-103-0x0000000005C90000-0x0000000005CF6000-memory.dmp
memory/2524-117-0x0000000006390000-0x00000000063AE000-memory.dmp
memory/2980-397-0x0000000000400000-0x00000000006D9000-memory.dmp
memory/2980-348-0x0000000000400000-0x00000000006D9000-memory.dmp
memory/2980-396-0x00000000038C0000-0x00000000038FB000-memory.dmp
memory/3060-124-0x0000000004D50000-0x0000000004D8B000-memory.dmp
memory/3060-123-0x0000000000400000-0x000000000043B000-memory.dmp
memory/3060-303-0x0000000000400000-0x000000000043B000-memory.dmp
memory/3060-304-0x0000000004D50000-0x0000000004D8B000-memory.dmp
memory/3060-246-0x0000000000400000-0x000000000043B000-memory.dmp
memory/3060-13-0x000000000042B000-0x000000000042C000-memory.dmp
memory/3496-385-0x000001AA754B0000-0x000001AA754D0000-memory.dmp
memory/3556-346-0x0000000004C10000-0x0000000004C4B000-memory.dmp
memory/3556-345-0x0000000000400000-0x0000000000433000-memory.dmp
memory/4404-105-0x00007FF72D3D0000-0x00007FF72DDC1000-memory.dmp
memory/4708-361-0x0000000006270000-0x00000000062BC000-memory.dmp
memory/4708-356-0x0000000005D20000-0x0000000006074000-memory.dmp
memory/4708-410-0x000000006FF60000-0x000000006FFAC000-memory.dmp