Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
24/08/2026, 17:11
General
- Target 2026-08-23_0ff83d84ecbe7405641564c553427b46_cobalt-strike_coinminer_glassworm_hijackloader_icedid_kr.exe
- Size 71.7MB
- Sample260824-vp83daap51
- SHA256 68a465322a0b1d931cd37ca5c48ccf87bcddea374441dd33ce3ad89d78913463
Malware Config
Signatures
- Custom signatureDetects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Loads dropped DLL 2 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_0ff83d84ecbe7405641564c553427b46_cobalt-strike_coinminer_glassworm_hijackloader_icedid_kr.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_0ff83d84ecbe7405641564c553427b46_cobalt-strike_coinminer_glassworm_hijackloader_icedid_kr.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
clrjit.dll
coreclr.dll
memory/4292-35-0x000001B5CB270000-0x000001B5CB274000-memory.dmp
memory/4292-16-0x000001B5CB250000-0x000001B5CB25A000-memory.dmp
memory/4292-12-0x0000000140060000-0x0000000140133000-memory.dmp
memory/4292-37-0x000001B5ED6A0000-0x000001B5ED6D4000-memory.dmp
memory/4292-7-0x000006448A000000-0x000006448A8F5000-memory.dmp
memory/4292-32-0x000001B5EB880000-0x000001B5EB8A5000-memory.dmp
memory/4292-29-0x000001B5EB770000-0x000001B5EB7B6000-memory.dmp
memory/4292-26-0x000001B5EB750000-0x000001B5EB763000-memory.dmp
memory/4292-23-0x000001B5CB240000-0x000001B5CB250000-memory.dmp
memory/4292-20-0x000001B5EB830000-0x000001B5EB873000-memory.dmp
memory/4292-17-0x000001B5EB7C0000-0x000001B5EB826000-memory.dmp
memory/4292-40-0x000001B5CB280000-0x000001B5CB286000-memory.dmp