Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/09/2026, 22:32
General
- Target 2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
- Size 24.5MB
- Sample260901-2f7lhsfa88
- SHA256 fde588edbc62bd2ed0b3561d321af36cf10eab7980f02eb8e43aea58c0356786
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-01_00811e386d3f50a135a58e4cd3e34145_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Public\CbGtQR\OM5BQH.exe"C:\Users\Public\CbGtQR\OM5BQH.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
OM5BQH.exe
UxEnhance64.dll
adoresd.dat
msadox.tb
memory/1148-537-0x0000015A71760000-0x0000015A71FE7000-memory.dmp
memory/1148-539-0x00007FF8A3D80000-0x00007FF8A3D82000-memory.dmp
memory/1148-547-0x0000015A71760000-0x0000015A71FE7000-memory.dmp
memory/1148-546-0x0000015A71760000-0x0000015A71FE7000-memory.dmp
memory/1148-531-0x00007FF8A3D70000-0x00007FF8A3D72000-memory.dmp
memory/1148-532-0x00007FF8810E0000-0x00007FF8815FE000-memory.dmp
memory/1148-545-0x0000015A71760000-0x0000015A71FE7000-memory.dmp
memory/1148-540-0x0000015A71760000-0x0000015A71FE7000-memory.dmp
memory/1148-544-0x0000015A71760000-0x0000015A71FE7000-memory.dmp
memory/4296-0-0x0000000000480000-0x000000000048E000-memory.dmp
memory/4296-526-0x00007FF88D340000-0x00007FF88D352000-memory.dmp
memory/4296-1-0x0000000000480000-0x000000000048E000-memory.dmp
memory/4296-2-0x0000000000490000-0x000000000049C000-memory.dmp
memory/4296-504-0x00007FF88D340000-0x00007FF88D352000-memory.dmp
memory/4296-525-0x0000000000480000-0x000000000048E000-memory.dmp