Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 18:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_fef5bf0c2dc9f46dc2c7ed336ee3401a_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_fef5bf0c2dc9f46dc2c7ed336ee3401a_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260710-en
2 signatures
150 seconds
General
- Target 2026-07-20_fef5bf0c2dc9f46dc2c7ed336ee3401a_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
- Size 3.6MB
- Sample260720-xa9fpsdv3x
- SHA256 37dd0ce1962eca7f000806ecc229215d01364ba7c8cdcd8d458a27ab0996ed79
- MD5 fef5bf0c2dc9f46dc2c7ed336ee3401a
- SHA1 34ea2364dc78028273179769050370b1ee3f5f48
- SHA512 8b69d79f58ed73f97d5ad336916a69e04609d0f4468f28a4deae1b59330072534251a772f485124f34e517234f9ffc82f7e75b434fc351bf463fe06826f4cfb9
- SSDEEP 49152:E0H2E9NkriFLC/afAEIP6J+5pakVBoIoWk2ByJJdJC2GmQXNYIOEbYJobdPRzYTz:Z4uSm6z9E2bLz2/MfJ5HUWeZE9
- TLSH T1DB06C057A7A401E8C4B7C178CA578903E7F1B8451371ABDB03F19AA52F63AE15E3EB01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-07-20_fef5bf0c2dc9f46dc2c7ed336ee3401a_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-20_fef5bf0c2dc9f46dc2c7ed336ee3401a_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 2500 2026-07-20_fef5bf0c2dc9f46dc2c7ed336ee3401a_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_fef5bf0c2dc9f46dc2c7ed336ee3401a_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_fef5bf0c2dc9f46dc2c7ed336ee3401a_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2500