6df033f1a5c1592e64f9c347daf58129162d8f73e6a0e947e3e8b115399bca4c

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_564dc4c18709fdf2c680689d3b56884f_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc.exe
Size 9.1MB
Sample260728-g6ctlsff49
SHA256 6df033f1a5c1592e64f9c347daf58129162d8f73e6a0e947e3e8b115399bca4c
MD5 564dc4c18709fdf2c680689d3b56884f
SHA1 48b18732931532877a38e0e7f02238e30405b7da
SHA512 0eac9ba48e02a70f344a05b6073ac2e2f2eeaf4dec7bf178b26313dde0c761a7ccccbb71a9ea4715e718170f3d72ad1596dcbda09161604b2e23af121deb53d2
SSDEEP 196608:sq9j4CgoobwSMzXIcDf5G3A7cT/k1aAEvB3GN1V:sq9j4CgoAICYcTcG2ND
TLSH
T152A61292A6D800FCD19BC7348243760AFAB134A95B34AADF17C059522F73ED54E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion

Malware Config

Signatures

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	2026-07-28_564dc4c18709fdf2c680689d3b56884f_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5044	2026-07-28_564dc4c18709fdf2c680689d3b56884f_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5044	2026-07-28_564dc4c18709fdf2c680689d3b56884f_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc.exe
Token: SeDebugPrivilege	5044	2026-07-28_564dc4c18709fdf2c680689d3b56884f_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_564dc4c18709fdf2c680689d3b56884f_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_564dc4c18709fdf2c680689d3b56884f_coinminer_glassworm_icedid_luca-stealer_njrat_remcos_stealc.exe"
1⤵
- Modify Registry: Disable Windows Driver Blocklist
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:5044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads