177a5b3b61228feaf28511a4cc9a679a3dc342b96fae8ebe44a69245644cf42e

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 17:03

Target
2026-05-11_8bf588f2e6d245e529780e1669863ab8_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc.exe
Size 32.4MB
Sample260511-vkn7eaax2k
SHA256 177a5b3b61228feaf28511a4cc9a679a3dc342b96fae8ebe44a69245644cf42e
MD5 8bf588f2e6d245e529780e1669863ab8
SHA1 7a44c6bdb0e914584d8640b555f8c266de6589ff
SHA512 1bfe511cf380de19ffef5737a737ad841a28315a6bd52b03906a2275de91d01867c12e424e8b130066ffab5a63fa6a0d457d89cb9468e5354e00a56212e9c4d2
SSDEEP 786432:EQvzLP2lP1dG1gxvL182Ms2TMtYIS0L10Gnr+8vnUfNgs/T0+Tccs4JJD:BvzaXQQ/x1PPwgs/DccsCD
TLSH
T10D775CDF16E7658DF4F8AC34C0002D1AE5607E2D9F19A5E3C176B17037395C82A6EAA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4584	2026-05-11_8bf588f2e6d245e529780e1669863ab8_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc.exe
4584	2026-05-11_8bf588f2e6d245e529780e1669863ab8_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-11_8bf588f2e6d245e529780e1669863ab8_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_8bf588f2e6d245e529780e1669863ab8_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4584