Overview

overview

10

Static

static

10

2026-08-07...xz.exe

windows10-2004-x64

9

2026-08-07...xz.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 01:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_31cc115ce660dfde11326e37f92051e0_coinminer_elex_glassworm_magniber_maze_remcos_stealc_zxxz.exe
  • Size 5.5MB
  • Sample260808-b1daasfm9z
  • SHA256 87b1bc0f82e0525aa217e85ba39140459540743f809c1c17c751cf6cc343b250
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionupx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 2 IoCs
  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_31cc115ce660dfde11326e37f92051e0_coinminer_elex_glassworm_magniber_maze_remcos_stealc_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_31cc115ce660dfde11326e37f92051e0_coinminer_elex_glassworm_magniber_maze_remcos_stealc_zxxz.exe"
    1⤵
    • Identifies Wine through registry keys
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4108
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\HYD59EE.tmp.1786152984\HTA\index.hta" "C:\Users\Admin\AppData\Local\Temp\2026-08-07_31cc115ce660dfde11326e37f92051e0_coinminer_elex_glassworm_magniber_maze_remcos_stealc_zxxz.exe" /LOG "C:\Users\Admin\AppData\Local\Temp\HYD59EE.tmp.1786152984\index.hta.log" /PID "4108" /CID "6CciRDLLn_FtHP0Z" /VERSION "109353363" /OS "6.2" /BROWSERS "\"C:\Program Files\Mozilla Firefox\firefox.exe\",\"C:\Program Files\Google\Chrome\Application\chrome.exe\",C:\Program Files\Internet Explorer\iexplore.exe,\"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe\"" /ARCHITECTURE "64" /LANG "en" /USERNAME "Admin" /SID "S-1-5-21-1738198120-2966725515-3980530802-1000"
      2⤵
      • Badlisted process makes network request
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4468
      • C:\Windows\SysWOW64\PING.EXE
        "C:\Windows\System32\PING.EXE" 8.8.8.8 -n 1 -w 500
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:3900
      • C:\Windows\SysWOW64\cscript.exe
        "C:\Windows\System32\cscript.exe" shell_scripts/shell_ping_after_close.js "http://bench.utorrent.com/e?i=50&e=eyJldmVudE5hbWUiOiJoeWRyYTEiLCJhY3Rpb24iOiJodGFiZWdpbiIsInBpZCI6IjQxMDgiLCJoIjoiNkNjaVJETExuX0Z0SFAwWiIsInYiOiIxMDkzNTMzNjMiLCJjbCI6InVUb3JyZW50IiwibG5nIjoiZW4iLCJvc2EiOiI2NCIsInNsbmciOiJlbiIsImRiIjoiIiwiZGJ2IjoiMTEuMCIsImliciI6W3sibmFtZSI6IiIsInZlcnNpb24iOiIxMzUuMCIsImV4ZU5hbWUiOiJmaXJlZm94In0seyJuYW1lIjoiIiwidmVyc2lvbiI6IjE0MC4wIiwiZXhlTmFtZSI6ImNocm9tZSJ9LHsibmFtZSI6IiIsInZlcnNpb24iOiIxMS4wIiwiZXhlTmFtZSI6ImlleHBsb3JlIn0seyJuYW1lIjoiIiwidmVyc2lvbiI6IjEzOS4wIiwiZXhlTmFtZSI6Im1zZWRnZSJ9XSwiaXAiOiI4NS4yMDMuNDYuNjIiLCJjbiI6IlVuaXRlZCBLaW5nZG9tIiwicGFja2lkIjoiZGVmYXVsdCJ9"
        3⤵
        • Badlisted process makes network request
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:1132

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        loading.gif
        • Path C:\Users\Admin\AppData\Local\Temp\HYD59EE.tmp.1786152984\HTA\images\loading.gif
        • Size 5KB
        • SHA256 00c62ed42795f996b5f963c69ce918c2623d72896ebb628dfd9bc800514900ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        main_icon.png
        • Path C:\Users\Admin\AppData\Local\Temp\HYD59EE.tmp.1786152984\HTA\images\main_icon.png
        • Size 3KB
        • SHA256 639bccb6ed0fce165cc979a2949d211ec8f1570133d644bf042a5400c3454c21
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        main_utorrent.ico
        • Path C:\Users\Admin\AppData\Local\Temp\HYD59EE.tmp.1786152984\HTA\images\main_utorrent.ico
        • Size 104KB
        • SHA256 7c7279daebd88f6a34246603db9c0ecf9bbfa35ef820edd3278e5bc53f9e7680
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        index.hta
        • Path C:\Users\Admin\AppData\Local\Temp\HYD59EE.tmp.1786152984\HTA\index.hta
        • Size 522B
        • SHA256 61acd6e7405fad348433f8de4b12ed97b42caccbcf28fe0e4ba4b4a5d2ea707e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        install.1786152984.zip
        • Path C:\Users\Admin\AppData\Local\Temp\HYD59EE.tmp.1786152984\HTA\install.1786152984.zip
        • Size 1.1MB
        • SHA256 0a0e7d908ba91e52fdb9ce0474f3964e8a210aa415cbaf29b687b6fa68775d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        common.js
        • Path C:\Users\Admin\AppData\Local\Temp\HYD59EE.tmp.1786152984\HTA\scripts\common.js
        • Size 439KB
        • SHA256 c60f14b43d4976e3f94838809e0f87b6c1617164d9116626634f02afc51a718c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        initialize.js
        • Path C:\Users\Admin\AppData\Local\Temp\HYD59EE.tmp.1786152984\HTA\scripts\initialize.js
        • Size 978B
        • SHA256 e12037adeb71f62eb46ee77ded18cd226c1beba95b266a2e820cfc6eb0fe5fad
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        install.js
        • Path C:\Users\Admin\AppData\Local\Temp\HYD59EE.tmp.1786152984\HTA\scripts\install.js
        • Size 18KB
        • SHA256 7155de561d597cb2f5fc0899866c702791999c59fcd491ec20f3e933d78d366a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shell_ping_after_close.js
        • Path C:\Users\Admin\AppData\Local\Temp\HYD59EE.tmp.1786152984\HTA\shell_scripts\shell_ping_after_close.js
        • Size 272B
        • SHA256 3c3dcece425ab87666c35925760ecd83a1d734c0ae54ddd60d44fdb08d41873f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        common.css
        • Path C:\Users\Admin\AppData\Local\Temp\HYD59EE.tmp.1786152984\HTA\styles\common.css
        • Size 99KB
        • SHA256 950538c5c0bee8a79ddc1fe17a287c5f7d8e4d747c4b264c425b927ec2bc5d59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        index.hta.log
        • Path C:\Users\Admin\AppData\Local\Temp\HYD59EE.tmp.1786152984\index.hta.log
        • Size 57B
        • SHA256 bc8adda176deecf62dfbed552d07f3f2e68deccbfb16785949f865554ca06084
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/4108-0-0x0000000000400000-0x0000000000984000-memory.dmp
        Download

        memory/4108-1-0x0000000000622000-0x0000000000623000-memory.dmp
        Download

        memory/4108-613-0x0000000000400000-0x0000000000984000-memory.dmp
        Download