beebc9f00960872b64ff14c5308223c23bc8dfea8213b456c92ef988e517feb1

General

Target
2026-05-09_003c4cf5a6b7c4774fec37f6771e4a61_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe
Size 86.1MB
Sample260509-w15d1aby8t
SHA256 beebc9f00960872b64ff14c5308223c23bc8dfea8213b456c92ef988e517feb1
MD5 003c4cf5a6b7c4774fec37f6771e4a61
SHA1 e4272617db6cfc72f2dd093bf465386d7de96913
SHA512 366b2671df21e59f3994dd9d9ff790c9d8e308bcd01e044e8ddc4dc79c0013004a23299fa02c306c6c4b7e29fd3dc2c0364249e9d920b927ee7310a37c9ba75a
SSDEEP 786432:0AZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:0AZui3zQz2jOZKft
TLSH
T191187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2628	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	2026-05-09_003c4cf5a6b7c4774fec37f6771e4a61_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe
Key value queried	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation	2026-05-09_003c4cf5a6b7c4774fec37f6771e4a61_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
1800	tasklist.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2628	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	tasklist.exe
Token: SeDebugPrivilege	2628	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 1044	2840	2026-05-09_003c4cf5a6b7c4774fec37f6771e4a61_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe	87
PID 1044 wrote to memory of 2628	1044	2026-05-09_003c4cf5a6b7c4774fec37f6771e4a61_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe	88
PID 1044 wrote to memory of 1800	1044	2026-05-09_003c4cf5a6b7c4774fec37f6771e4a61_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-05-09_003c4cf5a6b7c4774fec37f6771e4a61_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-09_003c4cf5a6b7c4774fec37f6771e4a61_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\Temp\2026-05-09_003c4cf5a6b7c4774fec37f6771e4a61_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe
  C:\Users\Admin\AppData\Local\Temp\2026-05-09_003c4cf5a6b7c4774fec37f6771e4a61_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe C:\Users\Admin\AppData\Local\Temp\2026-05-09_003c4cf5a6b7c4774fec37f6771e4a61_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBOAGEAbQBlACAAVwBpAG4AQQBQAEkAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAQwBvAG4AcwBvAGwAZQAgAC0ATQBlAG0AYgBlAHIARABlAGYAaQBuAGkAdABpAG8AbgAgAEAAIgAKACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARwBlAHQAQwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwAoACkAOwAKACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAWwByAGUAdAB1AHIAbgA6ACAATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4AQgBvAG8AbAApAF0ACgAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABTAGgAbwB3AFcAaQBuAGQAbwB3ACgASQBuAHQAUAB0AHIAIABoAFcAbgBkACwAIABpAG4AdAAgAG4AQwBtAGQAUwBoAG8AdwApADsACgAiAEAACgAkAGgAYQBuAGQAbABlACAAPQAgAFsAQwBvAG4AcwBvAGwAZQAuAFcAaQBuAEEAUABJAF0AOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApAAoAaQBmACAAKAAkAGgAYQBuAGQAbABlACAALQBuAGUAIABbAEkAbgB0AFAAdAByAF0AOgA6AFoAZQByAG8AKQAgAHsAIABbAEMAbwBuAHMAbwBsAGUALgBXAGkAbgBBAFAASQBdADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABoAGEAbgBkAGwAZQAsACAAMAApACAAfQA=
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2628
- - C:\Windows\system32\tasklist.exe
    tasklist /fo csv /nh
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_5w13zo24.osr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5w13zo24.osr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2628-2-0x000001342B910000-0x000001342B932000-memory.dmp

Download

memory/2628-11-0x000001342B800000-0x000001342B80C000-memory.dmp