06c9ced691afc82cf332bad3286be928dc2f724f90924a903c9735fe573059ee

General

Target
2026-08-03_0cec0bc47cd6004cf8a03ceadae49fa2_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe
Size 86.1MB
Sample260804-d1833scc72
SHA256 06c9ced691afc82cf332bad3286be928dc2f724f90924a903c9735fe573059ee
MD5 0cec0bc47cd6004cf8a03ceadae49fa2
SHA1 19178bd170e7b87cbe25b78125f5bb272075344e
SHA512 6a3b2a3231282eb820b395bd159471f70e199ca7e2f85a8741f2ea9de002a3f0d3469a19d25fa47f3f4a9063eb1cb37a585ffc51742420fb9d17b5808b53580a
SSDEEP 786432:4AZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW:4AZui3zQz2jOZKft
TLSH
T14F187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3536	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	2026-08-03_0cec0bc47cd6004cf8a03ceadae49fa2_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	2026-08-03_0cec0bc47cd6004cf8a03ceadae49fa2_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
376	tasklist.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3536	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	376	tasklist.exe
Token: SeDebugPrivilege	3536	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 4628	2972	2026-08-03_0cec0bc47cd6004cf8a03ceadae49fa2_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe	86
PID 4628 wrote to memory of 3536	4628	2026-08-03_0cec0bc47cd6004cf8a03ceadae49fa2_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe	88
PID 4628 wrote to memory of 376	4628	2026-08-03_0cec0bc47cd6004cf8a03ceadae49fa2_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_0cec0bc47cd6004cf8a03ceadae49fa2_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_0cec0bc47cd6004cf8a03ceadae49fa2_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_0cec0bc47cd6004cf8a03ceadae49fa2_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-03_0cec0bc47cd6004cf8a03ceadae49fa2_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe C:\Users\Admin\AppData\Local\Temp\2026-08-03_0cec0bc47cd6004cf8a03ceadae49fa2_coinminer_glassworm_icedid_megazord_njrat_ryuk_stealc_zxxz.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBOAGEAbQBlACAAVwBpAG4AQQBQAEkAIAAtAE4AYQBtAGUAcwBwAGEAYwBlACAAQwBvAG4AcwBvAGwAZQAgAC0ATQBlAG0AYgBlAHIARABlAGYAaQBuAGkAdABpAG8AbgAgAEAAIgAKACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAARwBlAHQAQwBvAG4AcwBvAGwAZQBXAGkAbgBkAG8AdwAoACkAOwAKACAAIAAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAKACAAIAAgACAAWwByAGUAdAB1AHIAbgA6ACAATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4AQgBvAG8AbAApAF0ACgAgACAAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGIAbwBvAGwAIABTAGgAbwB3AFcAaQBuAGQAbwB3ACgASQBuAHQAUAB0AHIAIABoAFcAbgBkACwAIABpAG4AdAAgAG4AQwBtAGQAUwBoAG8AdwApADsACgAiAEAACgAkAGgAYQBuAGQAbABlACAAPQAgAFsAQwBvAG4AcwBvAGwAZQAuAFcAaQBuAEEAUABJAF0AOgA6AEcAZQB0AEMAbwBuAHMAbwBsAGUAVwBpAG4AZABvAHcAKAApAAoAaQBmACAAKAAkAGgAYQBuAGQAbABlACAALQBuAGUAIABbAEkAbgB0AFAAdAByAF0AOgA6AFoAZQByAG8AKQAgAHsAIABbAEMAbwBuAHMAbwBsAGUALgBXAGkAbgBBAFAASQBdADoAOgBTAGgAbwB3AFcAaQBuAGQAbwB3ACgAJABoAGEAbgBkAGwAZQAsACAAMAApACAAfQA=
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3536
- - C:\Windows\system32\tasklist.exe
    tasklist /fo csv /nh
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_vmnno4wg.j2q.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vmnno4wg.j2q.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3536-2-0x0000022B4FC60000-0x0000022B4FC82000-memory.dmp

Download

Analysis

Sharing