Analysis
- max time kernel
149s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 16:27
General
- Target 2026-06-02_3c8099a06531afcf8501cce24b682ec1_coinminer_glassworm_icedid_njrat_stealc.exe
- Size 17.7MB
- Sample260602-tx24csat81
- SHA256 65ae04aca16d9866da92847b26f18e50720a65b7f75aebd8fb517969b73d3af7
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
- Custom signatureDetects executables Discord URL observed in first stage droppers 1 IoCs
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 1 IoCs
- Custom signatureDetects executables packed with ConfuserEx Mod 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_3c8099a06531afcf8501cce24b682ec1_coinminer_glassworm_icedid_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_3c8099a06531afcf8501cce24b682ec1_coinminer_glassworm_icedid_njrat_stealc.exe"1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
UIDBypassDll.dll
memory/3308-0-0x000001F20A600000-0x000001F20B7BA000-memory.dmp
memory/3308-1-0x000001F227290000-0x000001F2272A0000-memory.dmp
memory/3308-7-0x000001F20BC40000-0x000001F20BC52000-memory.dmp
memory/3308-9-0x000001F22AF00000-0x000001F22B11C000-memory.dmp
memory/3308-10-0x000001F227290000-0x000001F2272A0000-memory.dmp