Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/07/2026, 11:46
General
- Target 2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
- Size 15.5MB
- Sample260710-nxpkdaax5p
- SHA256 22b684a8a3ea8dc855bc72425a51e5da080be37b3e0813390acffccbc8895908
Malware Config
Signatures
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 20 IoCs
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 20 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 20 IoCs
- Detects executables containing artifacts associated with disabling Widnows Defender 20 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 20 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Modifies Windows Firewall 2 TTPs 3 IoCs
- Drops startup file 1 IoCs
- Executes dropped EXE 5 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- GoLang User-Agent 6 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe"1⤵
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NonInteractive -WindowStyle Hidden -NoProfile -Command "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemComponent.lnk');$s.TargetPath='C:\Users\Admin\AppData\Local\Microsoft\Windows\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe';$s.WindowStyle=7;$s.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn MicrosoftWindowsManagementClient /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe\" /sc ONLOGON /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn MicrosoftWindowsManagementClientBoot /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe\" /sc ONSTART /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn MicrosoftWindowsManagementClientPerf /tr \"C:\Users\Admin\AppData\Local\Microsoft\Windows\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe\" /sc MINUTE /mo 5 /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule "name=RemoteX Client"2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NonInteractive -WindowStyle Hidden -NoProfile -Command "$s=(New-Object -COM WScript.Shell).CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\WindowsSystemComponent.lnk');$s.TargetPath='C:\ProgramData\Microsoft\Windows\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe';$s.WindowStyle=7;$s.Save()"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule "name=RemoteX Client" dir=out action=allow program=C:\Users\Admin\AppData\Local\Temp\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn MicrosoftWindowsManagementClientSystem /tr \"C:\ProgramData\Microsoft\Windows\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe\" /sc ONLOGON /ru SYSTEM /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn MicrosoftWindowsManagementClientSystemBoot /tr \"C:\ProgramData\Microsoft\Windows\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe\" /sc ONSTART /ru SYSTEM /rl HIGHEST /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule "name=RemoteX Client In" dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe"1⤵
- Executes dropped EXE
-
C:\ProgramData\Microsoft\Windows\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exeC:\ProgramData\Microsoft\Windows\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe1⤵
- Executes dropped EXE
-
C:\ProgramData\Microsoft\Windows\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe"C:\ProgramData\Microsoft\Windows\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe"1⤵
- Executes dropped EXE
-
C:\PROGRA~3\MICROS~1\Windows\2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exeC:\PROGRA~3\MICROS~1\Windows\2026-0~1.EXE1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
2026-07-10_692ed12514a7195f9dabeb9cbba5ff0c_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
StartupProfileData-NonInteractive
memory/996-24-0x00007FF7CBB60000-0x00007FF7CCB46000-memory.dmp
memory/1292-11-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/1292-13-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/1292-9-0x0000029772C20000-0x0000029772C42000-memory.dmp
memory/1292-6-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/1292-10-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/1292-36-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/1292-12-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/1292-5-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/1292-17-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/1292-19-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/1292-4-0x00007FFA79600000-0x00007FFA79FA4000-memory.dmp
memory/1292-3-0x00007FFA7978F000-0x00007FFA79790000-memory.dmp
memory/2128-34-0x00007FF7242A0000-0x00007FF725286000-memory.dmp
memory/2924-33-0x00007FF7242A0000-0x00007FF725286000-memory.dmp
memory/4968-2-0x00007FF7CBB60000-0x00007FF7CCB46000-memory.dmp
memory/5964-40-0x00007FF730CA0000-0x00007FF731C86000-memory.dmp
memory/5964-41-0x00007FF730CA0000-0x00007FF731C86000-memory.dmp
memory/5964-48-0x00007FF730CA0000-0x00007FF731C86000-memory.dmp
memory/5964-37-0x00007FF730CA0000-0x00007FF731C86000-memory.dmp
memory/5964-38-0x00007FF730CA0000-0x00007FF731C86000-memory.dmp
memory/5964-39-0x00007FF730CA0000-0x00007FF731C86000-memory.dmp
memory/5964-26-0x00007FF730CA0000-0x00007FF731C86000-memory.dmp
memory/5964-35-0x00007FF730CA0000-0x00007FF731C86000-memory.dmp
memory/5964-42-0x00007FF730CA0000-0x00007FF731C86000-memory.dmp
memory/5964-43-0x00007FF730CA0000-0x00007FF731C86000-memory.dmp
memory/5964-44-0x00007FF730CA0000-0x00007FF731C86000-memory.dmp
memory/5964-45-0x00007FF730CA0000-0x00007FF731C86000-memory.dmp
memory/5964-46-0x00007FF730CA0000-0x00007FF731C86000-memory.dmp
memory/5964-47-0x00007FF730CA0000-0x00007FF731C86000-memory.dmp
memory/6088-27-0x00007FF7242A0000-0x00007FF725286000-memory.dmp