Analysis
- max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 06:37
Static task
static1
Behavioral task
behavioral1
Sample
2026-08-03_c40c44ad279c890afe6a427aee0b4697_coinminer_glassworm_icedid_luca-stealer_megazord_njrat_poet-rat_stealc.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_c40c44ad279c890afe6a427aee0b4697_coinminer_glassworm_icedid_luca-stealer_megazord_njrat_poet-rat_stealc.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-08-03_c40c44ad279c890afe6a427aee0b4697_coinminer_glassworm_icedid_luca-stealer_megazord_njrat_poet-rat_stealc.exe
- Size 43.6MB
- Sample260803-hdn7lsdd55
- SHA256 2cbd831475a7d625378f987826a894a1c9fdce30d73155d32d3b62196af89fbb
- MD5 c40c44ad279c890afe6a427aee0b4697
- SHA1 a89bf253c370e86a8111bcd000364fd2cf86436b
- SHA512 3e2e1ea9e8a2e302edca81b8f78ed0daa5d4a9ce28931062555c2f81af95f47a85ca69ff78f7d178b0ff75d16dc28a287581211e41c1c9b82ec380817b30210d
- SSDEEP 393216:LVwzHYYZzF/o+bNgYa4Es6x/DUwy7W4BIPSLYZnvEzyNQqgxxTVXKG00tiPYaiaV:yY8KYcOEkxTjlM5QQ
- TLSH T1B3A77D4AB3B910D6F136C03D871AA117E6B33434037047EB41B24767AFABAE51D7AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-08-03_c40c44ad279c890afe6a427aee0b4697_coinminer_glassworm_icedid_luca-stealer_megazord_njrat_poet-rat_stealc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision 2026-08-03_c40c44ad279c890afe6a427aee0b4697_coinminer_glassworm_icedid_luca-stealer_megazord_njrat_poet-rat_stealc.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4400 2026-08-03_c40c44ad279c890afe6a427aee0b4697_coinminer_glassworm_icedid_luca-stealer_megazord_njrat_poet-rat_stealc.exe 4400 2026-08-03_c40c44ad279c890afe6a427aee0b4697_coinminer_glassworm_icedid_luca-stealer_megazord_njrat_poet-rat_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_c40c44ad279c890afe6a427aee0b4697_coinminer_glassworm_icedid_luca-stealer_megazord_njrat_poet-rat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_c40c44ad279c890afe6a427aee0b4697_coinminer_glassworm_icedid_luca-stealer_megazord_njrat_poet-rat_stealc.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4400