a65c56388919239277de3a447038ceb2b4e1090e5f4e36959bf1666a8fac8d13

General

Target
2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Size 7.0MB
Sample260708-epe7asav3x
SHA256 a65c56388919239277de3a447038ceb2b4e1090e5f4e36959bf1666a8fac8d13
MD5 e0c1ea2f2dc61a3afdc5a3149b4a138b
SHA1 0ae7e60563a8a7db41f9ee96b23ce7fe3166e866
SHA512 f3b14f23fef4e9919d35cd534229dd1fafc20fd929a1c7e31cb3708e0ebcf2db7b77c5be1860821699f676d9a8f0eb49164d8ac0a5502cb193326870cdcb8a81
SSDEEP 98304:B+stFgNz7FnkU9/YyeAAYf4KYTJcGthLOlrKR3dws7BMuO1LldCcUu:B9eR7FkU6ybAagcGLSitw6MP1LGcv
TLSH
T16976E152B6B401B4D97AC1788D924A6BEBB5B47523A057CF43B4CA771F23EE0163E318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Indicator Removal: Clear Windows Event Logs 1 TTPs 27 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\System.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Key Management Service.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-PowerShell%4Admin.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Internet Explorer.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Application.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\HardwareEvents.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\OAlerts.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Store%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Security.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Windows PowerShell.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4FirewallDiagnostics.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Privacy-Auditing%4Operational.evtx	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
412	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
412	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 412 set thread context of 5004	412	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	85

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Prefetch	powershell.exe
File opened for modification	C:\Windows\ServiceState\EventLog\Data\lastalive0.dat	svchost.exe
File opened for modification	C:\Windows\ServiceState\EventLog\Data\lastalive1.dat	svchost.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2488	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3280	timeout.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackEnabled = "0"	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\RulesLastAudienceReported	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs = "0"	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackEnabled = "0"	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs = "0"	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Size = "1"	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
412	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
412	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
412	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
412	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
412	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
412	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
2488	powershell.exe
2488	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	412	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeProfSingleProcessPrivilege	412	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	412	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeCreatePagefilePrivilege	412	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
Token: SeDebugPrivilege	2488	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 5004	412	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	85
PID 412 wrote to memory of 1852	412	2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe	87
PID 1852 wrote to memory of 3280	1852	cmd.exe	89
PID 1852 wrote to memory of 2488	1852	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_e0c1ea2f2dc61a3afdc5a3149b4a138b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_vidar.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:412
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c
  2⤵
  PID:5004
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout /t 8 & rmdir "C:\Windows\Prefetch" /s /q & md "C:\Windows\Prefetch" & "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -command "Get-Item 'C:\Windows\Prefetch' | ForEach-Object { $_.CreationTime = $_.CreationTime.AddSeconds(-366151) }
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\system32\timeout.exe
    timeout /t 8
    3⤵
    - Delays execution with timeout.exe
    PID:3280
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -command "Get-Item 'C:\Windows\Prefetch' | ForEach-Object { $_.CreationTime = $_.CreationTime.AddSeconds(-366151) }
    3⤵
    - Drops file in Windows directory
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
- Drops file in Windows directory
- Checks processor information in registry
PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

1

T1070

Clear Windows Event Logs

1

T1070.001

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_eq4trhlg.y5g.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eq4trhlg.y5g.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Analysis

Sharing