milleniumrat | 86ca55917d82127bbbc985556773ab11bd92c4136a120e6580f2abefb7e6d9fb

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_520fd364b39be33da02372b4bdcf2dfc_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 3.0MB
Sample260830-c3d52sgl7s
SHA256 86ca55917d82127bbbc985556773ab11bd92c4136a120e6580f2abefb7e6d9fb
MD5 520fd364b39be33da02372b4bdcf2dfc
SHA1 ac2d5d0d9593fcba451e937865481d93f78ce189
SHA512 6158da78f545a51f117336ccc80044bc5710f04236c2062c0a2cf5628b628e7646a66e9a2a856a4ac12bd17004562e5ee57e6f3cd6d4faad39df21b45ead8235
SSDEEP 49152:hFS9/Q9poBR00VN2lOjJYzmbdvOCcx+3BcoDNV+dqQJ7/VkEk:hedNcOnOCcx+3BcoDNNEk
TLSH
T1E1E58E56B7A800F8D0A7C174CA475907E7B2B819077097DF17D0CAAA6F23BE15A7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution milleniumrat persistence rat spyware stealer

Malware Config

Signatures

Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat

Detects MilleniumRAT stealer 1 IoCs

resource	yara_rule
behavioral2/files/0x002300000001c2ca-0.dat	family_milleniumrat

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x002300000001c2ca-0.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x002300000001c2ca-0.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
behavioral2/files/0x002300000001c2ca-0.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x002300000001c2ca-0.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x002300000001c2ca-0.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables containing possible sandbox analysis VM names 1 IoCs

resource	yara_rule
behavioral2/files/0x002300000001c2ca-0.dat	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
behavioral2/files/0x002300000001c2ca-0.dat	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral2/files/0x002300000001c2ca-0.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Executes dropped EXE 1 IoCs

pid	Process
3556	vshost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
1	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4632	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1676	timeout.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3556	vshost.exe
3556	vshost.exe
3556	vshost.exe
3556	vshost.exe
3556	vshost.exe
3556	vshost.exe
3556	vshost.exe
3556	vshost.exe
3556	vshost.exe
3556	vshost.exe
3556	vshost.exe
3556	vshost.exe
3556	vshost.exe
3556	vshost.exe
3556	vshost.exe
3556	vshost.exe
3556	vshost.exe
3556	vshost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 3556	4140	2026-08-28_520fd364b39be33da02372b4bdcf2dfc_glassworm_icedid_luca-stealer_njrat_stealc.exe	89
PID 3556 wrote to memory of 4900	3556	vshost.exe	91
PID 3556 wrote to memory of 4900	3556	vshost.exe	91
PID 3556 wrote to memory of 4536	3556	vshost.exe	94
PID 3556 wrote to memory of 4536	3556	vshost.exe	94
PID 3556 wrote to memory of 4632	3556	vshost.exe	95
PID 4632 wrote to memory of 1676	4632	cmd.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-28_520fd364b39be33da02372b4bdcf2dfc_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_520fd364b39be33da02372b4bdcf2dfc_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Local\Temp\5sx4EdfdoKydpD\vshost.exe
  "C:\Users\Admin\AppData\Local\Temp\\5sx4EdfdoKydpD\vshost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:4536
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c timeout /t 3 /nobreak & rd /s /q "C:\Users\Admin\AppData\Local\Temp\5sx4EdfdoKydpD"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\system32\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1676

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vshost.exe

Path C:\Users\Admin\AppData\Local\Temp\5sx4EdfdoKydpD\vshost.exe
Size 3.0MB
SHA256 86ca55917d82127bbbc985556773ab11bd92c4136a120e6580f2abefb7e6d9fb
MD5 520fd364b39be33da02372b4bdcf2dfc
SHA1 ac2d5d0d9593fcba451e937865481d93f78ce189
SHA512 6158da78f545a51f117336ccc80044bc5710f04236c2062c0a2cf5628b628e7646a66e9a2a856a4ac12bd17004562e5ee57e6f3cd6d4faad39df21b45ead8235
SSDEEP 49152:hFS9/Q9poBR00VN2lOjJYzmbdvOCcx+3BcoDNV+dqQJ7/VkEk:hedNcOnOCcx+3BcoDNNEk
TLSH
T1E1E58E56B7A800F8D0A7C174CA475907E7B2B819077097DF17D0CAAA6F23BE15A7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download