87bfaf818f4dea2f8fba36180a12cd53b4e9068647c1c5e174671f94783a0690

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 02:50

Target
2026-07-30_d73a61e6dafd5fe7d0601509f1d0fd36_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 2.7MB
Sample260730-db2byabp7z
SHA256 87bfaf818f4dea2f8fba36180a12cd53b4e9068647c1c5e174671f94783a0690
MD5 d73a61e6dafd5fe7d0601509f1d0fd36
SHA1 3dad4a25a0b24dc3ddf0188d585981fad8711d36
SHA512 32723664c32a973c76b3066688f0aeaf2707183f44a127f63e5ffe864e8f84c6ddeca85c7720ecdf224b3cc3b409638261bd0ea177879920e1c94328b78ae7f8
SSDEEP 49152:gGtlquVwASO5IU6iB/xlJ6xnHy3EX74XWVYUSOfWrgUyAayPq7mpejnO:c+DX5udfT7m
TLSH
T11DD5BF66B6B401E8D4B6C078C6934237E7F2B85917B09BDB06A4C6B60F237E11E3E745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2412	2026-07-30_d73a61e6dafd5fe7d0601509f1d0fd36_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
2412	2026-07-30_d73a61e6dafd5fe7d0601509f1d0fd36_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2412	2026-07-30_d73a61e6dafd5fe7d0601509f1d0fd36_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Token: SeDebugPrivilege	2412	2026-07-30_d73a61e6dafd5fe7d0601509f1d0fd36_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_d73a61e6dafd5fe7d0601509f1d0fd36_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_d73a61e6dafd5fe7d0601509f1d0fd36_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2412
- C:\Users\Admin\AppData\Local\Temp\2026-07-30_d73a61e6dafd5fe7d0601509f1d0fd36_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-30_d73a61e6dafd5fe7d0601509f1d0fd36_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
  2⤵
  PID:3308