33a877d3b5ab0c96f82ceaabc83c2246085afabd2bd1651f5e0f6f271ffaf37c

Analysis

max time kernel
149s
max time network
11s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_8c7b41a326558952363841ab930e16b3_coinminer_glassworm.exe
Size 12.0MB
Sample260707-maftaafw4w
SHA256 33a877d3b5ab0c96f82ceaabc83c2246085afabd2bd1651f5e0f6f271ffaf37c
MD5 8c7b41a326558952363841ab930e16b3
SHA1 5b2d9b1c806357c4f8316d05e08a87a900df5b41
SHA512 1a90ddb7a297589708e1f890e1eff7197ad231e3f313b100b4515a7808f3cd48bbf0b8e1fbb76b880fbbde4f7877d0a6793ae4c0fe60171133e40b45ca2453f4
SSDEEP 196608:7uIuBNsF+jRuV27Lx2SSCNtv13uFnCPwZbIqrWn:NsjRNReCNtv13uFnCPwZbLin
TLSH
T1E1C67B56F1A624EDCA5BC270C29F9373B734FC601161AF2B2610FA741E72ED01E5AB64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5556	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5556	powershell.exe
5556	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5556	powershell.exe
Token: SeIncreaseQuotaPrivilege	5556	powershell.exe
Token: SeSecurityPrivilege	5556	powershell.exe
Token: SeTakeOwnershipPrivilege	5556	powershell.exe
Token: SeLoadDriverPrivilege	5556	powershell.exe
Token: SeSystemProfilePrivilege	5556	powershell.exe
Token: SeSystemtimePrivilege	5556	powershell.exe
Token: SeProfSingleProcessPrivilege	5556	powershell.exe
Token: SeIncBasePriorityPrivilege	5556	powershell.exe
Token: SeCreatePagefilePrivilege	5556	powershell.exe
Token: SeBackupPrivilege	5556	powershell.exe
Token: SeRestorePrivilege	5556	powershell.exe
Token: SeShutdownPrivilege	5556	powershell.exe
Token: SeDebugPrivilege	5556	powershell.exe
Token: SeSystemEnvironmentPrivilege	5556	powershell.exe
Token: SeRemoteShutdownPrivilege	5556	powershell.exe
Token: SeUndockPrivilege	5556	powershell.exe
Token: SeManageVolumePrivilege	5556	powershell.exe
Token: 33	5556	powershell.exe
Token: 34	5556	powershell.exe
Token: 35	5556	powershell.exe
Token: 36	5556	powershell.exe
Token: SeIncreaseQuotaPrivilege	5556	powershell.exe
Token: SeSecurityPrivilege	5556	powershell.exe
Token: SeTakeOwnershipPrivilege	5556	powershell.exe
Token: SeLoadDriverPrivilege	5556	powershell.exe
Token: SeSystemProfilePrivilege	5556	powershell.exe
Token: SeSystemtimePrivilege	5556	powershell.exe
Token: SeProfSingleProcessPrivilege	5556	powershell.exe
Token: SeIncBasePriorityPrivilege	5556	powershell.exe
Token: SeCreatePagefilePrivilege	5556	powershell.exe
Token: SeBackupPrivilege	5556	powershell.exe
Token: SeRestorePrivilege	5556	powershell.exe
Token: SeShutdownPrivilege	5556	powershell.exe
Token: SeDebugPrivilege	5556	powershell.exe
Token: SeSystemEnvironmentPrivilege	5556	powershell.exe
Token: SeRemoteShutdownPrivilege	5556	powershell.exe
Token: SeUndockPrivilege	5556	powershell.exe
Token: SeManageVolumePrivilege	5556	powershell.exe
Token: 33	5556	powershell.exe
Token: 34	5556	powershell.exe
Token: 35	5556	powershell.exe
Token: 36	5556	powershell.exe
Token: SeIncreaseQuotaPrivilege	5556	powershell.exe
Token: SeSecurityPrivilege	5556	powershell.exe
Token: SeTakeOwnershipPrivilege	5556	powershell.exe
Token: SeLoadDriverPrivilege	5556	powershell.exe
Token: SeSystemProfilePrivilege	5556	powershell.exe
Token: SeSystemtimePrivilege	5556	powershell.exe
Token: SeProfSingleProcessPrivilege	5556	powershell.exe
Token: SeIncBasePriorityPrivilege	5556	powershell.exe
Token: SeCreatePagefilePrivilege	5556	powershell.exe
Token: SeBackupPrivilege	5556	powershell.exe
Token: SeRestorePrivilege	5556	powershell.exe
Token: SeShutdownPrivilege	5556	powershell.exe
Token: SeDebugPrivilege	5556	powershell.exe
Token: SeSystemEnvironmentPrivilege	5556	powershell.exe
Token: SeRemoteShutdownPrivilege	5556	powershell.exe
Token: SeUndockPrivilege	5556	powershell.exe
Token: SeManageVolumePrivilege	5556	powershell.exe
Token: 33	5556	powershell.exe
Token: 34	5556	powershell.exe
Token: 35	5556	powershell.exe
Token: 36	5556	powershell.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5636 wrote to memory of 5556	5636	2026-07-07_8c7b41a326558952363841ab930e16b3_coinminer_glassworm.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-07_8c7b41a326558952363841ab930e16b3_coinminer_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_8c7b41a326558952363841ab930e16b3_coinminer_glassworm.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$action = New-ScheduledTaskAction -Execute 'C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-07_8c7b41a326558952363841ab930e16b3_coinminer_glassworm.exe'; $trigger = New-ScheduledTaskTrigger -AtLogOn -User 'Admin'; Register-ScheduledTask -TaskName 'InitGameAtStartup' -Action $action -Trigger $trigger -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

keylogger_debug.log

Path C:\Users\Admin\AppData\Local\Temp\keylogger_debug.log
Size 4KB
SHA256 e4443d36d969c0e7113abf1c586643229323dbb31029dc89039382cd98f31064
MD5 cb0e72d49974f2d60e8bf95726f7f2f4
SHA1 6b241d16abcb0e474bf6bc6d1ec9faa7ecb720af
SHA512 8ded556644373bb86c047ddc4bd05180959c9b17c11a06e5ced0f522eac19006bde5f972a9fc65ee3f3ea74c508fd288bf237660467c84e7fdb1c6c4b1591fa4
SSDEEP 48:ozX264nHWD//iWDeWPBgz+SUcUIUqSa6MN0Z3lcTl9Z/8ohYKnOmPB:osHW/iMHB11Z3q
TLSH
T1BA914964748C6C13B2C42E6AE59A48D32524D0BB6B74807243F8C394E3787F69DDAE63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keylogger_debug.log

Path C:\Users\Admin\AppData\Local\Temp\keylogger_debug.log
Size 912B
SHA256 5512ae46a4e764b2ad46aae8d1afd14f9a330e3999f0c337872754cf1ef043c5
MD5 823cc352d00b88df607003efabbc5760
SHA1 eb916d6921b7db7f1b661b7dc7f0fa079ebd18d2
SHA512 b461071023d30425bcba108353edb7eeafd445c86d992995154e302ad95f30ab8b0d51811bd4cc85ee1b2e42df8e4ccc490283e52228042b5da31c68331d4003
TLSH
T10311E90800803973F2F34F0950BD1CD26939B6666728099833D85FCAEBB90C6AD21E07
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5556-37-0x000002D245C30000-0x000002D245C4E000-memory.dmp

Download

memory/5556-34-0x000002D245E80000-0x000002D245F32000-memory.dmp

Download

memory/5556-26-0x000002D245B60000-0x000002D245B82000-memory.dmp

Download

memory/5556-28-0x000002D22CDD0000-0x000002D22D774000-memory.dmp

Download

memory/5556-29-0x000002D22CDD0000-0x000002D22D774000-memory.dmp

Download

memory/5556-30-0x000002D22CDD0000-0x000002D22D774000-memory.dmp

Download

memory/5556-38-0x000002D22CDD0000-0x000002D22D774000-memory.dmp

Download

memory/5556-33-0x000002D245BF0000-0x000002D245C0E000-memory.dmp

Download

memory/5556-35-0x000002D22CDD0000-0x000002D22D774000-memory.dmp

Download

memory/5556-36-0x000002D245BE0000-0x000002D245BEA000-memory.dmp

Download

memory/5556-27-0x000002D22CDD0000-0x000002D22D774000-memory.dmp

Download

memory/5556-23-0x000002D22D56C000-0x000002D22D56D000-memory.dmp

Download

memory/5556-45-0x000002D22CDD0000-0x000002D22D774000-memory.dmp

Download

memory/5556-40-0x000002D22CDD0000-0x000002D22D774000-memory.dmp

Download

memory/5556-41-0x000002D22CDD0000-0x000002D22D774000-memory.dmp

Download

memory/5556-42-0x000002D22CDD0000-0x000002D22D774000-memory.dmp

Download

memory/5556-39-0x000002D22CDD0000-0x000002D22D774000-memory.dmp

Download

memory/5556-44-0x000002D22CDD0000-0x000002D22D774000-memory.dmp

Download

memory/5556-43-0x000002D22CDD0000-0x000002D22D774000-memory.dmp

Download

memory/5556-46-0x000002D22CDD0000-0x000002D22D774000-memory.dmp

Download

memory/5556-49-0x000002D22CDD0000-0x000002D22D774000-memory.dmp

Download

memory/5556-50-0x000002D22CDD0000-0x000002D22D774000-memory.dmp

Download

memory/5556-53-0x000002D22CDD0000-0x000002D22D774000-memory.dmp

Download

memory/5636-22-0x00007FF6B7F40000-0x00007FF6B897B000-memory.dmp

Download