Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/06/2026, 04:03
Behavioral task
behavioral1
Sample
2026-06-29_bfbc9501eeb114e281b9e1f626fb2d23_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-29_bfbc9501eeb114e281b9e1f626fb2d23_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-06-29_bfbc9501eeb114e281b9e1f626fb2d23_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe
- Size 12.6MB
- Sample260630-empyqaex5m
- SHA256 8e0dca4dff21d30c00d36f33c3920ef1312dee4149f86a65a77e48c8c15bda20
- MD5 bfbc9501eeb114e281b9e1f626fb2d23
- SHA1 78c0a3edf2ef5dbd9d7eaed8d8dad823dba99609
- SHA512 8a02fb8140932b328728252d6f3c0c6750b7fa7a4e7f60170aab48cea5afe349455f497f448e9dc030cd1fe1d3f1f2db79951f476cbabad7ab436692f8cd9024
- SSDEEP 196608:ARC/NM0rDoxrix2PkZvdAv5n1gpgiXRC/NM0rDoxrix2PkZvdAv5n1gpgi:Ahex2PkZvdm51PiXhex2PkZvdm51Pi
- TLSH T12DD69D26B7A401E8C87AC53CCA469607E7F2B81A5370A7DB17B0567A1F336D45E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- XMRig Miner payload 4 IoCs
resource yara_rule behavioral2/files/0x000e00000001c549-5.dat family_xmrig behavioral2/files/0x000e00000001c549-5.dat xmrig behavioral2/files/0x000d00000001c54c-14.dat family_xmrig behavioral2/files/0x000d00000001c54c-14.dat xmrig - Cryptocurrency Miner
Makes network request to known mining pool URL.
- Executes dropped EXE 5 IoCs
pid Process 5004 SecurityHealthServiceHost.exe 3280 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 3900 SecurityHealthServiceHost.exe 4504 WmiPrvServiceHost.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\SecurityHealth\\SecurityHealthServiceHost.exe" 2026-06-29_bfbc9501eeb114e281b9e1f626fb2d23_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe Set value (str) \REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvService = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\WmiPrvServiceHost.exe" 2026-06-29_bfbc9501eeb114e281b9e1f626fb2d23_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\miner.log SecurityHealthServiceHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 3280 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe 4804 WmiPrvServiceHost.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeLockMemoryPrivilege 5004 SecurityHealthServiceHost.exe Token: SeLockMemoryPrivilege 5004 SecurityHealthServiceHost.exe Token: SeLockMemoryPrivilege 3900 SecurityHealthServiceHost.exe Token: SeLockMemoryPrivilege 3900 SecurityHealthServiceHost.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5004 SecurityHealthServiceHost.exe 3900 SecurityHealthServiceHost.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4188 wrote to memory of 5004 4188 2026-06-29_bfbc9501eeb114e281b9e1f626fb2d23_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe 87 PID 4188 wrote to memory of 3280 4188 2026-06-29_bfbc9501eeb114e281b9e1f626fb2d23_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe 89 PID 4188 wrote to memory of 4804 4188 2026-06-29_bfbc9501eeb114e281b9e1f626fb2d23_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_bfbc9501eeb114e281b9e1f626fb2d23_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_bfbc9501eeb114e281b9e1f626fb2d23_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\SecurityHealthServiceHost.exe"C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\SecurityHealthServiceHost.exe" --max-threads-hint=50 --coin=monero --donate-level=1 --log-file=miner.log --background2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5004
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\WmiPrvServiceHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\WmiPrvServiceHost.exe" --id 12⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3280
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\WmiPrvServiceHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\WmiPrvServiceHost.exe" --id 22⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4804
-
-
C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\SecurityHealthServiceHost.exeC:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\SecurityHealthServiceHost.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3900
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\WmiPrvServiceHost.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\WmiPrvServiceHost.exe1⤵
- Executes dropped EXE
PID:4504
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\SecurityHealthServiceHost.exe
- Size 6.2MB
- SHA256 bf39aec7e6a2215d05cd5b6c5178b1e37255bde3604f157c76bd46781ef6d88d
- MD5 55cdff7126514cff81e2dc6acc770732
- SHA1 2c6126717f37e26ddb584be9868b1cebf48a4e3d
- SHA512 7e0a08016539c39bbf7bdf3c80337c81d174a31851f87ba6028455e5e5012c82dbd374fd376f0f1f7ce0931f44dfbe17b547eb8087a33133eb690d2522cffcfe
- SSDEEP 98304:UqFp6S568NMyOefiH7cXdHkByf1WCseto4tMQXfXDox+Sxw427x2vHkZvfl3TDQW:URC/NM0rDoxrix2PkZvdAv5n1gpgi
- TLSH T17E569D26B7A401E8C87AC53CC6469A13E7F2B81A5370A7DB17B0567A1F336D45E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\SecurityHealth\config.json
- Size 1KB
- SHA256 cc865df76ce20fbf1a7590b6bb4e3c44e151d681b8cfd7f6debf07acdc357506
- MD5 98d585351b7ce009d450ed6cfc520cee
- SHA1 1a4a0f5e2c815086c25cfb117f45f57f83f7a944
- SHA512 12b5e6a4449219e94b73b48563899dfebfb2bf36ec6742600cd29c1cf303986290841b30ce23c2d1a52c475f9bdb1fc6d5bad767b3d6a9f0aad2ef9ac9ce91a7
- TLSH T1FD410625C9740CFB1195A07C88FDA2935668C2075E693C39B90C5A4C2F0EB3E75B7BE6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WmiPrvServiceHost.exe
- Size 6.3MB
- SHA256 baf8845693e758efecfa50569fa088f77efce8aba863d6859c27222e312449e5
- MD5 26d882f9f4dd579dc4f4e544a7a813fb
- SHA1 2b545d577bb6c59ef8fd4e05f7bce57e73578655
- SHA512 69eabd646ad1889df0f5f5b25f5301889d23e27a9a8cf452ba90ba6ef4895bbe23195a7b484c0138adcadaf15cee3267755267f0d9b4381b68a993a434f85297
- SSDEEP 98304:sqFp6S568NMyOefiH7cXdHkByf1WCseto4tMQXfXDox+Sxw427x2vHkZvfl3TDQW:sRC/NM0rDoxrix2PkZvdAv5n1gpgi
- TLSH T150669D26B7A401E8C87AC53CCA469607E7F2B81A5370A7DB17B0567A1F336D45E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH