Analysis
- max time kernel
149s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
23/05/2026, 02:53
General
- Target 2026-05-23_e38404216a66b156ecbe64fddfdb440b_akira_coinminer_dosia_glassworm_hijackloader_icedid_luca.exe
- Size 65.7MB
- Sample260523-dddnnaes7v
- SHA256 2c8f611b0f2c157f010c20379d4fcd725a8c462a8d226ae0095e3e0fb110ddbe
Malware Config
Signatures
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- UPX dump on OEP (original entry point) 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- Modifies system certificate store 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_e38404216a66b156ecbe64fddfdb440b_akira_coinminer_dosia_glassworm_hijackloader_icedid_luca.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_e38404216a66b156ecbe64fddfdb440b_akira_coinminer_dosia_glassworm_hijackloader_icedid_luca.exe"1⤵
- Suspicious use of SetThreadContext
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeWSCOGJJEZZWL2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeCLWBQWZGWHNV3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeERDCLVBLGHDZ3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1380-53-0x00007FF6A4F00000-0x00007FF6A5AAA000-memory.dmp
memory/2392-55-0x00007FF6A4F00000-0x00007FF6A5802000-memory.dmp
memory/3428-1-0x0000022CE7070000-0x0000022CE7071000-memory.dmp
memory/3428-0-0x0000022CE7060000-0x0000022CE7065000-memory.dmp
memory/3428-4-0x0000022CE7250000-0x0000022CE7254000-memory.dmp
memory/3428-3-0x0000022CE7240000-0x0000022CE7241000-memory.dmp
memory/3428-10-0x0000022CE72B0000-0x0000022CE72B2000-memory.dmp
memory/3428-9-0x0000022CE72A0000-0x0000022CE72A1000-memory.dmp
memory/3428-8-0x0000022CE7290000-0x0000022CE7296000-memory.dmp
memory/3428-7-0x0000022CE7280000-0x0000022CE7281000-memory.dmp
memory/3428-6-0x0000022CE7270000-0x0000022CE7272000-memory.dmp
memory/3428-5-0x0000022CE7260000-0x0000022CE7261000-memory.dmp
memory/3428-16-0x0000022CE7310000-0x0000022CE7313000-memory.dmp
memory/3428-15-0x0000022CE7300000-0x0000022CE7301000-memory.dmp
memory/3428-14-0x0000022CE72F0000-0x0000022CE72F1000-memory.dmp
memory/3428-13-0x0000022CE72E0000-0x0000022CE72E1000-memory.dmp
memory/3428-12-0x0000022CE72D0000-0x0000022CE72D1000-memory.dmp
memory/3428-11-0x0000022CE72C0000-0x0000022CE72C1000-memory.dmp
memory/3428-17-0x0000022CE7320000-0x0000022CE7321000-memory.dmp
memory/3428-21-0x0000022CE7560000-0x0000022CE7561000-memory.dmp
memory/3428-29-0x0000022CE7600000-0x0000022CE7601000-memory.dmp
memory/3428-31-0x0000022CE7620000-0x0000022CE7621000-memory.dmp
memory/3428-44-0x0000022CE76F0000-0x0000022CE76F1000-memory.dmp
memory/3428-48-0x0000022CE7730000-0x0000022CE7741000-memory.dmp
memory/3428-51-0x0000022CE7770000-0x0000022CE7771000-memory.dmp
memory/3428-52-0x0000022CE7780000-0x0000022CE7782000-memory.dmp
memory/3428-50-0x0000022CE7760000-0x0000022CE7761000-memory.dmp
memory/3428-49-0x0000022CE7750000-0x0000022CE7751000-memory.dmp
memory/3428-47-0x0000022CE7720000-0x0000022CE7721000-memory.dmp
memory/3428-46-0x0000022CE7710000-0x0000022CE7718000-memory.dmp
memory/3428-45-0x0000022CE7700000-0x0000022CE7701000-memory.dmp
memory/3428-43-0x0000022CE76E0000-0x0000022CE76E1000-memory.dmp
memory/3428-42-0x0000022CE76D0000-0x0000022CE76D1000-memory.dmp
memory/3428-41-0x0000022CE76C0000-0x0000022CE76C1000-memory.dmp
memory/3428-40-0x0000022CE76B0000-0x0000022CE76B1000-memory.dmp
memory/3428-39-0x0000022CE76A0000-0x0000022CE76A1000-memory.dmp
memory/3428-38-0x0000022CE7690000-0x0000022CE7697000-memory.dmp
memory/3428-37-0x0000022CE7680000-0x0000022CE7681000-memory.dmp
memory/3428-36-0x0000022CE7670000-0x0000022CE7671000-memory.dmp
memory/3428-35-0x0000022CE7660000-0x0000022CE7661000-memory.dmp
memory/3428-34-0x0000022CE7650000-0x0000022CE7651000-memory.dmp
memory/3428-33-0x0000022CE7640000-0x0000022CE7641000-memory.dmp
memory/3428-30-0x0000022CE7610000-0x0000022CE7611000-memory.dmp
memory/3428-28-0x0000022CE75F0000-0x0000022CE75F1000-memory.dmp
memory/3428-27-0x0000022CE75E0000-0x0000022CE75E1000-memory.dmp
memory/3428-22-0x0000022CE7570000-0x0000022CE7573000-memory.dmp
memory/3428-26-0x0000022CE75D0000-0x0000022CE75D1000-memory.dmp
memory/3428-25-0x0000022CE75C0000-0x0000022CE75C1000-memory.dmp
memory/3428-24-0x0000022CE7590000-0x0000022CE7593000-memory.dmp
memory/3428-23-0x0000022CE7580000-0x0000022CE7581000-memory.dmp
memory/3428-20-0x0000022CE7550000-0x0000022CE7551000-memory.dmp
memory/3428-19-0x0000022CE7540000-0x0000022CE7541000-memory.dmp
memory/3428-18-0x0000022CE7330000-0x0000022CE7333000-memory.dmp
memory/3428-54-0x00007FF6986A0000-0x00007FF69C8FF000-memory.dmp