Overview

overview

10

Static

static

10

260822-ym4...ed.zip

windows10-2004-x64

1

260822-ym4...ed.zip

windows11-ltsc_2024-x64

1

2026-08-21...ig.exe

windows10-2004-x64

8

2026-08-21...ig.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    22/08/2026, 20:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_01b13eaed23b6e2abca1b24f3e9ba3a5_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_sliver_snatch_vidar_xmrig.exe
  • Size 9.8MB
  • Sample260822-ysbstsyemb
  • SHA256 3939817a6e82b672cfedcbe5c6ad3c643bd1008e784e89505f8af9e1365b1ce4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistence

Malware Config

Signatures

  • Contacts a large (1819) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Loads dropped DLL 3 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Connections Discovery 1 TTPs 4 IoCs

    Attempt to get a listing of network connections.

    discovery
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_01b13eaed23b6e2abca1b24f3e9ba3a5_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_sliver_snatch_vidar_xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_01b13eaed23b6e2abca1b24f3e9ba3a5_coinminer_glassworm_icedid_luca-stealer_njrat_poet-rat_sliver_snatch_vidar_xmrig.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4680
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "sc stop npf"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4424
      • C:\Windows\system32\sc.exe
        sc stop npf
        3⤵
        • Launches sc.exe
        PID:4940
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "sc delete npf"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1892
      • C:\Windows\system32\sc.exe
        sc delete npf
        3⤵
        • Launches sc.exe
        PID:2236
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "sc create npf type= kernel start= auto binpath= C:\Users\Admin\AppData\Local\Temp\npf.sys"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4604
      • C:\Windows\system32\sc.exe
        sc create npf type= kernel start= auto binpath= C:\Users\Admin\AppData\Local\Temp\npf.sys
        3⤵
        • Launches sc.exe
        PID:2436
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "sc start npf"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:924
      • C:\Windows\system32\sc.exe
        sc start npf
        3⤵
        • Launches sc.exe
        PID:4084
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "netstat -ano | findstr TCP"
      2⤵
      • Executes a command shell one-liner
      • System Network Connections Discovery
      • Suspicious use of WriteProcessMemory
      PID:1716
      • C:\Windows\system32\NETSTAT.EXE
        netstat -ano
        3⤵
        • System Network Connections Discovery
        • Gathers network information
        • Suspicious use of AdjustPrivilegeToken
        PID:976
      • C:\Windows\system32\findstr.exe
        findstr TCP
        3⤵
          PID:4860
      • C:\Windows\system32\cmd.exe
        cmd.exe /c "netstat -ano | findstr TCP"
        2⤵
        • Executes a command shell one-liner
        • System Network Connections Discovery
        • Suspicious use of WriteProcessMemory
        PID:1520
        • C:\Windows\system32\NETSTAT.EXE
          netstat -ano
          3⤵
          • System Network Connections Discovery
          • Gathers network information
          • Suspicious use of AdjustPrivilegeToken
          PID:2176
        • C:\Windows\system32\findstr.exe
          findstr TCP
          3⤵
            PID:4456

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            Packet.dll
            • Path C:\Users\Admin\AppData\Local\Temp\Packet.dll
            • Size 105KB
            • SHA256 ab3cce674f5216895fd26a073771f82b05d4c8b214a89f0f288a59774a06b14b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wpcap.dll
            • Path C:\Users\Admin\AppData\Local\Temp\wpcap.dll
            • Size 361KB
            • SHA256 35aab6caaaf1720a4d888ae0de9e2a8e19604f3ea0e4dd882c3eeae4f39af117
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/4680-9-0x0000000001C90000-0x0000000001CAF000-memory.dmp
            Download