ec4bdc3aa8abc8937d733db13fc9829775e11d2e189f2a5446825100680024ba

Analysis

max time kernel
150s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 03:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_6777a6dbd29e24616d60004627734c9f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
Size 88.0MB
Sample260711-dhm3wsc161
SHA256 ec4bdc3aa8abc8937d733db13fc9829775e11d2e189f2a5446825100680024ba
MD5 6777a6dbd29e24616d60004627734c9f
SHA1 12d275a17741eb625133ac5a57eed297471e286b
SHA512 b3987f56d01d2c01bf3a64d3932a0ce7b1e2225d92ad2c706d81b8ca4bf5ca7aee735ade6ce221344b19137e17298b3ab0cc321390d303169d111583108dc5d0
SSDEEP 393216:d8nVxhanA6rh7CLBAwOdC1yJ8w65aPahY7ZZiRT4VpaUgPj1BiGUtlVpFzeBNsia:d8nvEA6rpCLBwb658a8ZZiOpgPVlcmK
TLSH
T113187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2332	powershell.exe
5716	powershell.exe
1656	powershell.exe
2512	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
992	node.exe
4492	node.exe
5164	node.exe
1320	node.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\0be276c4-7dfb-4d5f-a8e2-fd7c5735c489 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\node.exe\" -e \"require('child_process').spawn(process.execPath, ['C:\\\\Users\\\\Admin\\\\AppData\\\\Local\\\\Temp\\\\tonrat_js_7f348c1e.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()\""	powershell.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	node.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
3272	powershell.exe
1656	powershell.exe
1656	powershell.exe
2512	powershell.exe
2512	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe
5992	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3272	powershell.exe
Token: SeDebugPrivilege	1656	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	5992	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	2332	powershell.exe
Token: SeDebugPrivilege	5716	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 992	4676	2026-07-11_6777a6dbd29e24616d60004627734c9f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe	89
PID 992 wrote to memory of 3272	992	node.exe	90
PID 992 wrote to memory of 1656	992	node.exe	92
PID 992 wrote to memory of 2512	992	node.exe	94
PID 4492 wrote to memory of 5164	4492	node.exe	98
PID 5164 wrote to memory of 5992	5164	node.exe	99
PID 992 wrote to memory of 4952	992	node.exe	101
PID 992 wrote to memory of 2332	992	node.exe	103
PID 2332 wrote to memory of 5716	2332	powershell.exe	105
PID 5716 wrote to memory of 1320	5716	powershell.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-07-11_6777a6dbd29e24616d60004627734c9f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_6777a6dbd29e24616d60004627734c9f_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_zxxz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Users\Admin\AppData\Local\Temp\node.exe
  .\node.exe tonrat_js_7f348c1e.js
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "(Get-Process | Where-Object { $_.Path -eq \"C:\Users\Admin\AppData\Local\Temp\node.exe\" }).Count"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "(Get-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"0be276c4-7dfb-4d5f-a8e2-fd7c5735c489\").\"0be276c4-7dfb-4d5f-a8e2-fd7c5735c489\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "$code = \"require('child_process').spawn(process.execPath, ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tonrat_js_7f348c1e.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()\"; $command = \"\"\"C:\Users\Admin\AppData\Local\Temp\node.exe\"\" -e \"\"$code\"\"\"; Set-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"0be276c4-7dfb-4d5f-a8e2-fd7c5735c489\" -Value $command"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "(Get-ItemProperty -Path \"HKLM:\SOFTWARE\Microsoft\Cryptography\" -Name \"MachineGuid\").\"MachineGuid\""
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "Start-Process -File powershell.exe -ArgumentList \"-c \"\"Start-Sleep 3; Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\node.exe' -ArgumentList 'C:\Users\Admin\AppData\Local\Temp\tonrat_js_7f348c1e.js' -WindowStyle Hidden\"\"\" -WindowStyle Hidden"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "Start-Sleep 3; Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\node.exe' -ArgumentList 'C:\Users\Admin\AppData\Local\Temp\tonrat_js_7f348c1e.js' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\node.exe
        
        "C:\Users\Admin\AppData\Local\Temp\node.exe" C:\Users\Admin\AppData\Local\Temp\tonrat_js_7f348c1e.js
        5⤵
        Executes dropped EXE
        
        PID:1320

C:\Users\Admin\AppData\Local\Temp\node.exe
"C:\Users\Admin\AppData\Local\Temp\node.exe" -e "require('child_process').spawn(process.execPath, ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tonrat_js_7f348c1e.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\AppData\Local\Temp\node.exe
  C:\Users\Admin\AppData\Local\Temp\node.exe C:\Users\Admin\AppData\Local\Temp\tonrat_js_7f348c1e.js
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "(Get-Process | Where-Object { $_.Path -eq \"C:\Users\Admin\AppData\Local\Temp\node.exe\" }).Count"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1644a8734b1a870853c20608b2c652c71a46e3cce6318ad116a4f9159a76d282
MD5 c104f03b2b4f3402a8cad00e56679300
SHA1 e1d3b9ab2d030f209415f08f5a8c3906bb5c86db
SHA512 d6e259d5aecf849e0b812f786147f10cfb7971150c06d1319d6907093c09ffb05f4a5559fbf4850a5f8dd99f00e9c06b994e9677baa707d549eb65a2042c9eb2
TLSH
T182215333F3CC8624CC9A403A50CEAC1036B687DB419EDFABBB84D155A43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 54aa570220e696de49a9a588711123e43032522c4578b6fa4f918d2666c1cb32
MD5 27db61c440595c38f5a7b661c618d0c9
SHA1 87613fdda39013791c068bdeec060f945fa2e908
SHA512 e367d57ce85719fa4e3cfd8083e0a5f71110b3f845c1ea7d3a0a3393066cfa90b96712701f044b731fab41ff6a751b7f4db794795c1f3aec955f642c3df25586
TLSH
T1FC115733F3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F699DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_p4f55353.pfy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p4f55353.pfy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

tonrat_js_7f348c1e.js

Path C:\Users\Admin\AppData\Local\Temp\tonrat_js_7f348c1e.js
Size 399KB
SHA256 870621a246709c55b7dd5dcabaa1ad0aa34db0dfc02b4c8054b44fcdd96de03f
MD5 ed6097861ef94311256b89cc58645be1
SHA1 87d6752e8f75cd7e2872489e6017fc17b820f3ff
SHA512 5435d20d05488707c7265ef4c7b302fe80ccf28f20de96a7bcbceebdf199dbfcde9698c894e683b515c75fb2a5cd88ad05cb94863cb2cdaf4807c38477a71fff
SSDEEP 6144:j3osg0xAlBl4oYguLzmawPb9AGkeSZTNksNc6suJ2FotMA0k+EdMatfAEaeMer53:z1o3YtRTnsuJnv0GdMqYEaeMed3Ldh
TLSH
T120943B8C36EEB094117FBEB7AB2B2198E915CD8553084058F6C8749FFF1437A94AAF14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tonrat_js_7f348c1e.js

Path C:\Users\Admin\AppData\Local\Temp\tonrat_js_7f348c1e.js
Size 304KB
SHA256 7f348c1e4ee6c58f50e0cadd09b4ce8f0336cd968cf62b05c14aa7f78bdb7845
MD5 0fe2a01dc88eafc8530119885d4dbec6
SHA1 d6db6c0ba71d8f33b8fb34df8dbab567ef61529f
SHA512 5d96726983d7230a8aa12c7347e3d678b228b117c6a06e027096c5d571e4a04fc1ea1118f28680afdedb409f5c2cdc46ca20a0f640a05364947d139c8263586c
SSDEEP 6144:NyxhaFYCQEZh9a0As1mLXaZU7aGGdLFnXsBvOXfGqPa0:ya3Gx74MvO+m
TLSH
T18B64F78863CEB450117BBCF76AF26151FB589CA1D14850E4FBD477AFEC903398CA9A24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3272-8-0x000001FF6F950000-0x000001FF6F972000-memory.dmp

Download