Analysis
- max time kernel
148s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 01:02
General
- Target 2026-08-01_329ddb57806b74b9f1ef4c801a149be1_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe
- Size 9.6MB
- Sample260802-bd3axa1shx
- SHA256 c21293420b40555be9e7e4907a90df0ac626606a672338b1d52291619fc26048
Malware Config
Signatures
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Drops file in Program Files directory 3 IoCs
- Executes dropped EXE 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 17 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_329ddb57806b74b9f1ef4c801a149be1_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_329ddb57806b74b9f1ef4c801a149be1_cobalt-strike_coinminer_glassworm_hijackloader_icedid_lu.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall show rule name=adu.exe2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall show rule name=adu.exe3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "New-NetFirewallRule -DisplayName 'adu.exe' -Direction Inbound -Action Allow -Program 'C:\Users\Admin\AppData\Local\Temp\adu.exe' -Description 'AsusDriverUpdate'"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "New-NetFirewallRule -DisplayName 'adu.exe' -Direction Inbound -Action Allow -Program 'C:\Users\Admin\AppData\Local\Temp\adu.exe' -Description 'AsusDriverUpdate'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files\ASUS\AsusDriverHub\ASUS DriverHub.exe"C:\Program Files\ASUS\AsusDriverHub\ASUS DriverHub.exe" -driverhub -notifyinfo2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "(Get-AppxPackage B9ECED6F.ArmouryCrate).Version"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
ASUS DriverHub.exe
setup.ini
StartupProfileData-NonInteractive
__PSScriptPolicyTest_bucdhvrv.fyn.ps1
memory/472-11-0x0000021067A50000-0x0000021067A5E000-memory.dmp
memory/472-12-0x0000021067B80000-0x0000021067B9A000-memory.dmp
memory/472-10-0x0000021067B40000-0x0000021067B5E000-memory.dmp
memory/472-9-0x0000021067A40000-0x0000021067A4A000-memory.dmp
memory/472-7-0x00000210003F0000-0x000002100040E000-memory.dmp
memory/472-8-0x0000021000630000-0x00000210006E2000-memory.dmp
memory/472-4-0x0000021067A80000-0x0000021067AA2000-memory.dmp
memory/4792-59-0x000001C9F2180000-0x000001C9F21A6000-memory.dmp
memory/4792-39-0x000001C9D6650000-0x000001C9D66CA000-memory.dmp
memory/4792-42-0x000001C9D6BA0000-0x000001C9D6BCC000-memory.dmp
memory/4792-61-0x000001C9F21E0000-0x000001C9F21E8000-memory.dmp
memory/5448-50-0x0000019748300000-0x00000197483B2000-memory.dmp
memory/5448-53-0x0000019748070000-0x0000019748078000-memory.dmp
memory/5448-54-0x0000019748080000-0x0000019748086000-memory.dmp
memory/5448-55-0x0000019748090000-0x000001974809A000-memory.dmp
memory/5448-56-0x00000197480A0000-0x00000197480A8000-memory.dmp
memory/5448-57-0x0000019748640000-0x0000019748666000-memory.dmp
memory/5448-52-0x0000019748780000-0x00000197487AA000-memory.dmp
memory/5448-51-0x0000019748990000-0x0000019748B94000-memory.dmp