Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 00:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-01_93bf5261ad223c4ada20aa85f37b315a_coinminer_glassworm_magniber_remcos_stop.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_93bf5261ad223c4ada20aa85f37b315a_coinminer_glassworm_magniber_remcos_stop.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target 2026-07-01_93bf5261ad223c4ada20aa85f37b315a_coinminer_glassworm_magniber_remcos_stop.exe
- Size 57.1MB
- Sample260702-abq97af13m
- SHA256 1c800979a12d07d403168fd35739b3a41bdfb2e333488a8e3cc528034796e8e1
- MD5 93bf5261ad223c4ada20aa85f37b315a
- SHA1 946a64187daa38af409171187f1eb5da912fb894
- SHA512 093936842fd97b86506b35922cf3a00db63fd7cd49832a25c32bd268ad437fa07a25247ea92274a76e381a3b138472f20164f3a456b4bfa6e205b17d155f58a1
- SSDEEP 393216:J0Fj1e3ib9gKzijyHdN2zcu+wmlj7qq1DJtvH5b111cDLVNv8A9/ZwWhVwqJsv6s:JwgNlGJtvF10Lv8A97hVw77sJSdSKt
- TLSH T19DD75B0AFA7581E1D077C0BED183A61EEE72345557305BC76649AB2B1F337E4A83A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-07-01_93bf5261ad223c4ada20aa85f37b315a_coinminer_glassworm_magniber_remcos_stop.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2026-07-01_93bf5261ad223c4ada20aa85f37b315a_coinminer_glassworm_magniber_remcos_stop.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2026-07-01_93bf5261ad223c4ada20aa85f37b315a_coinminer_glassworm_magniber_remcos_stop.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSystemEnvironmentPrivilege 4912 2026-07-01_93bf5261ad223c4ada20aa85f37b315a_coinminer_glassworm_magniber_remcos_stop.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4912 2026-07-01_93bf5261ad223c4ada20aa85f37b315a_coinminer_glassworm_magniber_remcos_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_93bf5261ad223c4ada20aa85f37b315a_coinminer_glassworm_magniber_remcos_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_93bf5261ad223c4ada20aa85f37b315a_coinminer_glassworm_magniber_remcos_stop.exe"1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4912