a5d9d6c4bc68e495ec3a3fdcdd3cecfb1330124840fd74be2d518068b014715d

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 05:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_61857cffe90f0340728350c068cb5d82_coinminer_glassworm_icedid.exe
Size 9.9MB
Sample260730-f97byscd64
SHA256 a5d9d6c4bc68e495ec3a3fdcdd3cecfb1330124840fd74be2d518068b014715d
MD5 61857cffe90f0340728350c068cb5d82
SHA1 29ca116d7d24dad54ed151a55b3b414c81bb004c
SHA512 3bd46d8077471de7ff5727c785ddba82f76a4c397b0990a75bd1303645fbb07bab921e5a89616a80de64d3d5d8f58d03ef1fac1e4ca5d40dd9be3ffee6fa1ea7
SSDEEP 24576:CBstTyO5pj2oZfuQwhjVjUKqC0gCxf9RGWvMdPzpw40b1Gci4gwvR00J:CBst+O5pj2oZfuQzKqcCf94yZpt
TLSH
T176A65B07FCA525F6C0AF9231896259927B71BC481F3123D72A90BB382FB6BD05D79B50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3096	powershell.exe
1056	powershell.exe
4528	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3096	powershell.exe
3096	powershell.exe
1056	powershell.exe
1056	powershell.exe
4528	powershell.exe
4528	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3096	powershell.exe
Token: SeDebugPrivilege	1056	powershell.exe
Token: SeDebugPrivilege	4528	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3248	2026-07-30_61857cffe90f0340728350c068cb5d82_coinminer_glassworm_icedid.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 3096	3248	2026-07-30_61857cffe90f0340728350c068cb5d82_coinminer_glassworm_icedid.exe	89
PID 3248 wrote to memory of 1056	3248	2026-07-30_61857cffe90f0340728350c068cb5d82_coinminer_glassworm_icedid.exe	91
PID 3248 wrote to memory of 4528	3248	2026-07-30_61857cffe90f0340728350c068cb5d82_coinminer_glassworm_icedid.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-30_61857cffe90f0340728350c068cb5d82_coinminer_glassworm_icedid.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_61857cffe90f0340728350c068cb5d82_coinminer_glassworm_icedid.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$s='VencordInstaller'; try { Write-EventLog -LogName Application -Source $s -EntryType Information -EventId 18 -Message '1230c9a0d82b186f04b0140e094ad1a2f11766e8c0457a2cb46938e9c5fcdf74' -EA Stop } catch { try { New-EventLog -LogName Application -Source $s -EA Stop; Write-EventLog -LogName Application -Source $s -EntryType Information -EventId 18 -Message '1230c9a0d82b186f04b0140e094ad1a2f11766e8c0457a2cb46938e9c5fcdf74' } catch {} }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$s='VencordInstaller'; try { Write-EventLog -LogName Application -Source $s -EntryType Information -EventId 19 -Message 'f11766e8c0457a2cb46938e9c5fcdf74' -EA Stop } catch { try { New-EventLog -LogName Application -Source $s -EA Stop; Write-EventLog -LogName Application -Source $s -EntryType Information -EventId 19 -Message 'f11766e8c0457a2cb46938e9c5fcdf74' } catch {} }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$s='VencordInstaller'; try { Write-EventLog -LogName Application -Source $s -EntryType Information -EventId 20 -Message 'f53631ab08f53feb4ee5b629264f5cc4' -EA Stop } catch { try { New-EventLog -LogName Application -Source $s -EA Stop; Write-EventLog -LogName Application -Source $s -EntryType Information -EventId 20 -Message 'f53631ab08f53feb4ee5b629264f5cc4' } catch {} }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 99fa38dcb51d136859af6314498ae12d7d2606e5d16310b0e1d1825470e83302
MD5 eea891d39625274b33f06a132b4fd68d
SHA1 fafa3030f36332baf4a06db8c73a85bdb70d5892
SHA512 3f05768f7d312f8ba11c49dcbee0c572f22a7bc8d410e68cd31bfc1b08442669fa3169d0c056bd1c107d469c4cc7ae35025c5eb44315c3d469925482771ca802
TLSH
T19D119733F3CC8664C89A413650CEAC1036B687DB418FCE9BBB84D154A43F69ACE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_h3zvb3ef.cpq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h3zvb3ef.cpq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3096-2-0x00000209BAB20000-0x00000209BAB42000-memory.dmp

Download