b72b611c8c563308797bc78afc233933af9e88204256637b9e67c868b6d1f33e

Analysis

max time kernel
52s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 05:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_bf5a3a2b647c331986f5631461f1858a_coinminer_elex_glassworm_hawkeye_icedid_luca-stealer_njr.exe
Size 12.3MB
Sample260804-gajx2sdf85
SHA256 b72b611c8c563308797bc78afc233933af9e88204256637b9e67c868b6d1f33e
MD5 bf5a3a2b647c331986f5631461f1858a
SHA1 dd935d2d92b4c62455ac6805d1e34eb6ec30a306
SHA512 33a192d6f4253311cd87e32d3edcacd8a5dc11663529760b6d4f115158a019e6dec8e24216c14bba5f33f3ea67c8c606d2eb8cd81f1535a26a653b9a109b176d
SSDEEP 196608:HV0dEdfdWfm8eGZF6bUpMBF1p/kjRm4OWi2bLdMdt3d6h:HGIbUwF1VERmj2bV
TLSH
T1B7D6D00173E48075F1B36B35CEBA96219A7A7C229F34D24F13D8565D0E72690EA39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe You_are_a_wanker.exe"	2026-08-04_bf5a3a2b647c331986f5631461f1858a_coinminer_elex_glassworm_hawkeye_icedid_luca-stealer_njr.exe

Custom signature

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/3548-0-0x0000000000400000-0x0000000000427000-memory.dmp	UPX
behavioral2/files/0x000c00000001c50c-8.dat	UPX

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\You_are_a_wanker.exe	2026-08-04_bf5a3a2b647c331986f5631461f1858a_coinminer_elex_glassworm_hawkeye_icedid_luca-stealer_njr.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3548-0-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral2/files/0x000c00000001c50c-8.dat	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_bf5a3a2b647c331986f5631461f1858a_coinminer_elex_glassworm_hawkeye_icedid_luca-stealer_njr.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_bf5a3a2b647c331986f5631461f1858a_coinminer_elex_glassworm_hawkeye_icedid_luca-stealer_njr.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_bf5a3a2b647c331986f5631461f1858a_coinminer_elex_glassworm_hawkeye_icedid_luca-stealer_njr.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setup.exe-

Path C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe-
Size 12.8MB
SHA256 aef86f528bf67edad4df06368781191919a58ce4602492ea3c73983e1684444f
MD5 eed97b830689a6dcffb3b50f699a6eb7
SHA1 4cc77cf153ed55e105cc88f095ae9a9e832a29e4
SHA512 1b4b5e850edc6d3d4561cb6e670ec055d718acf9ca06b527eb7f8d87dfde5feaec0d995b9d67606f0699dd4297e702a9a0bb1f02b8adbd86183fe80ea2544e34
SSDEEP 196608:HV0dEdfdWfm8eGZF6bUpMBF1p/kjRm4OWi2bLdMdt3d6V:HGIbUwF1VERmj2bx
TLSH
T1E1D6CF0273E48075F1F36B358EBA96219A7A7C619F34D24F13D8561D0E72690EA39B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3548-0-0x0000000000400000-0x0000000000427000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads