Overview

overview

10

Static

static

10

2026-07-15...ig.exe

windows10-2004-x64

10

2026-07-15...ig.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/07/2026, 23:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-15_6e06037014e7056b19a9db0eec99b1ff_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe
  • Size 9.9MB
  • Sample260715-3wbdpaby7x
  • SHA256 c46446aad643dd2a5d39e00e9dfa03f844e8684edf9afe7cd21f9eef04406154
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionxmrigminerpersistenceransomware

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 7 IoCs
    miner
  • Clears Windows event logs 1 TTPs 2 IoCs
    defense_evasionransomware
  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-15_6e06037014e7056b19a9db0eec99b1ff_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-15_6e06037014e7056b19a9db0eec99b1ff_coinminer_glassworm_icedid_luca-stealer_njrat_stealc_xmrig.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2472
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c s^ch^ta^sks /C^re^ate /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4368
      • C:\Windows\system32\schtasks.exe
        schtasks /Create /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5572
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c w^ev^tu^ti^l cl "Windows-Security"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3292
      • C:\Windows\system32\wevtutil.exe
        wevtutil cl "Windows-Security"
        3⤵
        • Clears Windows event logs
        • Suspicious use of AdjustPrivilegeToken
        PID:4100
    • C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe
      "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5108
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c s^ch^ta^sks /C^re^ate /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5644
        • C:\Windows\system32\schtasks.exe
          schtasks /Create /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe" /SC ONLOGON /RL HIGHEST /DELAY 0005:00
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2492
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c w^ev^tu^ti^l cl "Windows-Security"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3280
        • C:\Windows\system32\wevtutil.exe
          wevtutil cl "Windows-Security"
          4⤵
          • Clears Windows event logs
          • Suspicious use of AdjustPrivilegeToken
          PID:1516
      • C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe
        "C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe" --config="C:\Users\Admin\AppData\Roaming\WindowsHost\config.json"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:5048
  • C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe
    C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe
    1⤵
    • Executes dropped EXE
    PID:1304

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        config.json
        • Path C:\Users\Admin\AppData\Roaming\WindowsHost\config.json
        • Size 2KB
        • SHA256 c64306b30281e43453f9019cb22d3040cbe65bee129ecbdef62cefdb8cdf494a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        svchost.exe
        • Path C:\Users\Admin\AppData\Roaming\WindowsHost\svchost.exe
        • Size 9.9MB
        • SHA256 c46446aad643dd2a5d39e00e9dfa03f844e8684edf9afe7cd21f9eef04406154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        svchost32.exe
        • Path C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe
        • Size 9.0MB
        • SHA256 42d5a2b519acaefc5690fd83fd0b095ae77aa92ece1549326113f387403e542e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1304-3-0x00007FF608560000-0x00007FF608F47000-memory.dmp
        Download

        memory/2472-1-0x00007FF6830A0000-0x00007FF683A87000-memory.dmp
        Download

        memory/5048-33-0x000001F507A50000-0x000001F507A70000-memory.dmp
        Download

        memory/5108-35-0x00007FF608560000-0x00007FF608F47000-memory.dmp
        Download