f6087a6ca61477b9469783509422ab5203521bcff7a90b125f9f93bec13682dd

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_6408b189d762355b460fb3281c61290e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 5.4MB
Sample260805-a652tsvcna
SHA256 f6087a6ca61477b9469783509422ab5203521bcff7a90b125f9f93bec13682dd
MD5 6408b189d762355b460fb3281c61290e
SHA1 58fc0578a4422002a457781b3c6f2afceea5602d
SHA512 8385c844af2f8fd1ed7392d350973632bf797891ac2cc34cbec9323db3c6d6145d52b7bfd21de4131de731099ac8346025901c408301890fdf67c4aa4faa71e9
SSDEEP 49152:9OjPWdrDdu0pguXM8D0mhNDcFn/uqLm+w97aE4Pu3dyryq3mMP9Y8m58/onMwrmX:teG0Ru6n/4cFNbv0DzYCrt9
TLSH
T1EE469E26B7E801E9D5B7C138CE978617E7B2744817709BDF02A0467A1F27AE06E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5096	FiveV.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\FiveV\FiveV.app\desktop.ini	FiveV.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Colors	FiveV.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5900	2026-08-04_6408b189d762355b460fb3281c61290e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
5900	2026-08-04_6408b189d762355b460fb3281c61290e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
5096	FiveV.exe
5096	FiveV.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5096	FiveV.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5096	FiveV.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5900 wrote to memory of 5096	5900	2026-08-04_6408b189d762355b460fb3281c61290e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_6408b189d762355b460fb3281c61290e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_6408b189d762355b460fb3281c61290e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5900
- C:\Users\Admin\AppData\Local\FiveV\FiveV.exe
  "C:\Users\Admin\AppData\Local\FiveV\FiveV.exe"
  2⤵
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Modifies Control Panel
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini

Path C:\Users\Admin\AppData\Local\FiveV\FiveV.app\desktop.ini
Size 157B
SHA256 c7a1e86783a29c394d9e0c1ef4ca6d4900dae11863675efdb27c69cd905be151
MD5 1a496122ac7d3ca1a027b2ceba8a75c0
SHA1 9672acae1f94cf0d9b5b8cc17698121bf6452b9e
SHA512 c3bfd351752ebde378d438b2403180a7ef3315bd7aa8ea79669a8523d9b9d033b12296bad043ca92d048e8b7fda5715681a83cf57230dc5601254714a04c2233
TLSH
T15DC04C06818FC62DC43EC16B1DE25648C8BD0AA9AF6E7E14D6C0D50826D3F4EAC95685
MD5 SHA1 SHA512 TLSH

Submit Download

FiveV.exe

Path C:\Users\Admin\AppData\Local\FiveV\FiveV.exe
Size 5.4MB
SHA256 f6087a6ca61477b9469783509422ab5203521bcff7a90b125f9f93bec13682dd
MD5 6408b189d762355b460fb3281c61290e
SHA1 58fc0578a4422002a457781b3c6f2afceea5602d
SHA512 8385c844af2f8fd1ed7392d350973632bf797891ac2cc34cbec9323db3c6d6145d52b7bfd21de4131de731099ac8346025901c408301890fdf67c4aa4faa71e9
SSDEEP 49152:9OjPWdrDdu0pguXM8D0mhNDcFn/uqLm+w97aE4Pu3dyryq3mMP9Y8m58/onMwrmX:teG0Ru6n/4cFNbv0DzYCrt9
TLSH
T1EE469E26B7E801E9D5B7C138CE978617E7B2744817709BDF02A0467A1F27AE06E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FiveV.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FiveV.lnk
Size 2KB
SHA256 b8a3619ef2d24b7447e8d492a4c6e770c52ca1e7b4b45c9573d33648db9c4f3a
MD5 fe19cbb298779f7d84de47a019b087c9
SHA1 9e61a43729a115a953d0777a7df847e854c40fb5
SHA512 1b72470e7294387a27f3e67f9391cb293be4e0fdd760a0c8a65d7d8429cd3af058241d981f8530bf6e01e15ad8a86a662fa0f4acf4188194085f9af92ebf83b9
TLSH
T1C241DC074CEA5721E6EBC5310ABB72225775BDD6AA729F0C40A0C2081911E20A986E6A
MD5 SHA1 SHA512 TLSH

Submit Download

FiveV.lnk

Path C:\Users\Admin\Desktop\FiveV.lnk
Size 1KB
SHA256 b2934b78cb1979bcde7b4163326760307cc46d2324a972baf7ef2d19eda3a6f1
MD5 d8d581f023c677c088814d794c7a8b6d
SHA1 f0d1590de4b9f4a78a5348803f22a01e9fc96788
SHA512 34848306bde67b6be48c0a52affad06e05134c9bb8e464d6ca430b225018dd0fab6a8989a7a8dbee2e550d6c0dadf7b180de5789254b87c35a16f80c6ef499c9
TLSH
T13441F1034CD61621D6FBD5311AFB67165BB8BDD66B329F1C40B4C2081D11F50E986F6E
MD5 SHA1 SHA512 TLSH