Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 07:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_f9a28dc8e490af977589a08ee27db0e4_coinminer_glassworm_icedid_njrat_sliver_vidar.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_f9a28dc8e490af977589a08ee27db0e4_coinminer_glassworm_icedid_njrat_sliver_vidar.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-08-02_f9a28dc8e490af977589a08ee27db0e4_coinminer_glassworm_icedid_njrat_sliver_vidar.exe
- Size 7.7MB
- Sample260802-jjee2afb67
- SHA256 cd949b5338f081716551120a4c0fd5dbe738b56555b825d42d45ab737795d477
- MD5 f9a28dc8e490af977589a08ee27db0e4
- SHA1 713b180a2d031daeea6cb8c119aa15b185b3bc2e
- SHA512 70a9b7dbd4901e8af82c0aa2ebb6c1e101c8906b2841cef3f5b4fa185ad7be3d82e895cf6a74bc75fcbe55e873b4076e4ae904244461e96ad0c55d9a74152753
- SSDEEP 49152:5dEosBjhPiI3agfQ4jxlTr5vxnQYYYPq6wigFsjyek6V2CYeWUOqdo3ljMVu88Rd:TBI1DNwj6OkEeROqdEH4Aja6noqa4iCT
- TLSH T185865CBA27A902E5D0A9D139E88B4153F2F1B4044732CBDB4563723A4F37EED9D76A10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1212 2026-08-02_f9a28dc8e490af977589a08ee27db0e4_coinminer_glassworm_icedid_njrat_sliver_vidar.exe 1212 2026-08-02_f9a28dc8e490af977589a08ee27db0e4_coinminer_glassworm_icedid_njrat_sliver_vidar.exe 1212 2026-08-02_f9a28dc8e490af977589a08ee27db0e4_coinminer_glassworm_icedid_njrat_sliver_vidar.exe 1212 2026-08-02_f9a28dc8e490af977589a08ee27db0e4_coinminer_glassworm_icedid_njrat_sliver_vidar.exe - Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1212 2026-08-02_f9a28dc8e490af977589a08ee27db0e4_coinminer_glassworm_icedid_njrat_sliver_vidar.exe Token: SeRestorePrivilege 1212 2026-08-02_f9a28dc8e490af977589a08ee27db0e4_coinminer_glassworm_icedid_njrat_sliver_vidar.exe Token: SeBackupPrivilege 1212 2026-08-02_f9a28dc8e490af977589a08ee27db0e4_coinminer_glassworm_icedid_njrat_sliver_vidar.exe Token: SeSecurityPrivilege 1212 2026-08-02_f9a28dc8e490af977589a08ee27db0e4_coinminer_glassworm_icedid_njrat_sliver_vidar.exe Token: SeImpersonatePrivilege 1212 2026-08-02_f9a28dc8e490af977589a08ee27db0e4_coinminer_glassworm_icedid_njrat_sliver_vidar.exe Token: SeShutdownPrivilege 1212 2026-08-02_f9a28dc8e490af977589a08ee27db0e4_coinminer_glassworm_icedid_njrat_sliver_vidar.exe Token: 35 1212 2026-08-02_f9a28dc8e490af977589a08ee27db0e4_coinminer_glassworm_icedid_njrat_sliver_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_f9a28dc8e490af977589a08ee27db0e4_coinminer_glassworm_icedid_njrat_sliver_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_f9a28dc8e490af977589a08ee27db0e4_coinminer_glassworm_icedid_njrat_sliver_vidar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1212