Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/05/2026, 11:12
Behavioral task
behavioral1
Sample
2026-05-23_0a8b26e24743ab28fa694865ea30b724_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-23_0a8b26e24743ab28fa694865ea30b724_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target 2026-05-23_0a8b26e24743ab28fa694865ea30b724_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe
- Size 3.2MB
- Sample260523-naweeagy8l
- SHA256 368baf3568ec4386392577545adc023137aacd546c8e41e265c57079d5d2461c
- MD5 0a8b26e24743ab28fa694865ea30b724
- SHA1 c7bce0c77c5e93404efab110639c164ace0dbe15
- SHA512 19a9a5198dce48eacc8432f6489822ee5c7700ac6e2b43da29e4afac3c6e9f27bf800acef819ef163e977fa40ed7ec145a7ecf2b1a883ad3eb7907c48f352e12
- SSDEEP 49152:70yAXvucS6SnbZVlxyZH0XAaCx5OX9ZO/xtEfOfzMFvfDTtKjkVE+ubDw8litYOD:Qvg6ClrBCjec+OfAK7DuYOQO
- TLSH T1AFF58CD2B7AA00E8E977F23889468517D3F1B81713709BDB66A84A660F136D11F3F706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 836 wmic.exe Token: SeSecurityPrivilege 836 wmic.exe Token: SeTakeOwnershipPrivilege 836 wmic.exe Token: SeLoadDriverPrivilege 836 wmic.exe Token: SeSystemProfilePrivilege 836 wmic.exe Token: SeSystemtimePrivilege 836 wmic.exe Token: SeProfSingleProcessPrivilege 836 wmic.exe Token: SeIncBasePriorityPrivilege 836 wmic.exe Token: SeCreatePagefilePrivilege 836 wmic.exe Token: SeBackupPrivilege 836 wmic.exe Token: SeRestorePrivilege 836 wmic.exe Token: SeShutdownPrivilege 836 wmic.exe Token: SeDebugPrivilege 836 wmic.exe Token: SeSystemEnvironmentPrivilege 836 wmic.exe Token: SeRemoteShutdownPrivilege 836 wmic.exe Token: SeUndockPrivilege 836 wmic.exe Token: SeManageVolumePrivilege 836 wmic.exe Token: 33 836 wmic.exe Token: 34 836 wmic.exe Token: 35 836 wmic.exe Token: 36 836 wmic.exe Token: SeIncreaseQuotaPrivilege 836 wmic.exe Token: SeSecurityPrivilege 836 wmic.exe Token: SeTakeOwnershipPrivilege 836 wmic.exe Token: SeLoadDriverPrivilege 836 wmic.exe Token: SeSystemProfilePrivilege 836 wmic.exe Token: SeSystemtimePrivilege 836 wmic.exe Token: SeProfSingleProcessPrivilege 836 wmic.exe Token: SeIncBasePriorityPrivilege 836 wmic.exe Token: SeCreatePagefilePrivilege 836 wmic.exe Token: SeBackupPrivilege 836 wmic.exe Token: SeRestorePrivilege 836 wmic.exe Token: SeShutdownPrivilege 836 wmic.exe Token: SeDebugPrivilege 836 wmic.exe Token: SeSystemEnvironmentPrivilege 836 wmic.exe Token: SeRemoteShutdownPrivilege 836 wmic.exe Token: SeUndockPrivilege 836 wmic.exe Token: SeManageVolumePrivilege 836 wmic.exe Token: 33 836 wmic.exe Token: 34 836 wmic.exe Token: 35 836 wmic.exe Token: 36 836 wmic.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 492 wrote to memory of 836 492 2026-05-23_0a8b26e24743ab28fa694865ea30b724_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_0a8b26e24743ab28fa694865ea30b724_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_0a8b26e24743ab28fa694865ea30b724_coinminer_glassworm_icedid_njrat_ryuk_sliver.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Windows\system32\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- Suspicious use of AdjustPrivilegeToken
PID:836
-