d5e622767eafb5627721b6feb6461a5649d25089a15700b6572e69ba14a2cb43

Analysis

max time kernel
149s
max time network
111s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 03:48

Target
2026-06-05_85fc4f6982b24d67fb9a17c2222a5299_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc.exe
Size 32.2MB
Sample260605-ec4dcsay5w
SHA256 d5e622767eafb5627721b6feb6461a5649d25089a15700b6572e69ba14a2cb43
MD5 85fc4f6982b24d67fb9a17c2222a5299
SHA1 49ea3c0ed2084041dc0439484cab6d5f62e7a8fa
SHA512 c814ed42d59c7b3e1745fda00bac3af32ae388b55df95517e4d2ed954c8f34206e96c128d97d7c74944a732a741995a94f544d50320143eeefbc64c79123dd75
SSDEEP 786432:sQvzLP2lP1dG1gxvL182Ms2TMtYIS0L10Gnr+8vnUfNgs/T0+ctrZxa:ZvzaXQQ/x1PPwgs/strZx
TLSH
T1C5774CDF16E7658DF4F8AC34C0002D1AE5607E2D9F19A5E3C176B17037399C82A6EA93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
324	2026-06-05_85fc4f6982b24d67fb9a17c2222a5299_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc.exe
324	2026-06-05_85fc4f6982b24d67fb9a17c2222a5299_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-05_85fc4f6982b24d67fb9a17c2222a5299_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-05_85fc4f6982b24d67fb9a17c2222a5299_cobalt-strike_coinminer_glassworm_icedid_njrat_stealc.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:324