Analysis
- max time kernel
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/09/2026, 00:58
Behavioral task
behavioral1
Sample
2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe
- Size 11.6MB
- Sample260913-bbrfmayglf
- SHA256 c67e9a45d56ee3093f05f38d2f9d59b08c561c9e5606afb08cd7cbe9cd98ab50
- MD5 5ed22c2e347952b18b4d8d6d7ab2020a
- SHA1 7d989407546dbcb3f0fe264b028aeacd38147b7b
- SHA512 40fab426d2190388b93911cc9b2d3a2006465844a68f0dac3e81d8b0275e0ddc99d54ebf7d3a8ea13a33966acd14f40ea4c79a8621b8503db772c7ea2aa7b880
- SSDEEP 196608:TBtBtBtBIeGZF6bUpMBF1p/kjRm4OWi2b:TBtBtBtBcIbUwF1VERmj2b
- TLSH T11CC6E01177D0C076E4B306709AF6E6726BBABD216B31D64F678A173D0F317C0AA2531A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 16 IoCs
resource yara_rule behavioral1/memory/2532-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2532-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2532-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2532-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2532-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2532-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2532-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2532-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2532-9-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2532-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2532-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2532-12-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2532-14-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2532-15-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2532-16-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/2532-17-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\charmap.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\doskey.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\mmc.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\autoconv.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\recover.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\relog.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\wusa.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\autofmt.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\print.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\setx.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\regedit.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\where.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\explorer.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\autochk.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\ftp.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\printui.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe -
resource yara_rule behavioral1/memory/2532-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2532-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2532-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2532-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2532-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2532-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2532-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2532-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2532-9-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2532-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2532-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2532-12-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2532-14-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2532-15-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2532-16-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/2532-17-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iediag_31bf3856ad364e35_11.0.19041.1_none_00c2b5589b88ca78\iediagcmd.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.19041.1_none_60ade0eff94c37fc\osk.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.1266_none_ab5bdb26141e0be5\f\vmms.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVDllSurrogate.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.19041.423_none_15f557c171018574\CHXSmartScreen.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.264_none_29367e02ede71097\wbadmin.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.746_none_c1db40c45e8f2d9e\f\wbengine.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.19041.1_none_597912734561c5f4\ucsvc.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.84_none_d062347205e52d46\r\PerceptionSimulationService.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.19041.1288_none_ff9a0c377d92f65b\f\wpnpinst.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15805.0_none_468e01fabfc37212\ComSvcConfig.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.1288_none_6c70124c60e2b4ef\f\vmcompute.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\UevAgentPolicyGenerator.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\r\FileExplorer.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorQuickStart.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.19041.746_none_492c8c53f3547077\PerceptionSimulationInput.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_3bcd0306a19592e2\r\Robocopy.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.19041.746_none_45062eb997366a7f\RemoteAppLifetimeManager.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.19041.1266_none_b9c280a4d350d170\r\MDMAgent.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.1_none_5106d54a804dbfc3\immersivetpmvscmgrsvr.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.19041.1023_none_9583d52fd3076014\f\SystemSettingsAdminFlows.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4478665ed379a3fc\AtBroker.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\winresume.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\f\SystemSettings.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.19041.1_none_bf2412b3ea69b4cb\lpkinstall.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.19041.1_none_62d38a38e1f19c9f\nfsclnt.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_a4bfcaa32abfcf0e\r\raserver.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_ac2441dbb712f006\msra.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.1_none_5c015a65c60d8097\hnsdiag.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.19041.746_none_a5ade2e84580e250\f\DmNotificationBroker.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_d9e841974c1d46e8\setupugc.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1_none_6bb2ce5b63f82957\FsIso.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.19041.1_none_2318682da2c7a3ea\PresentationSettings.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_72c6a00123f43c47\quickassist.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_edd345b6c42269da\r\rasautou.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.19041.1023_none_9583d52fd3076014\r\SystemSettingsAdminFlows.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.19041.572_none_bfb752f1e1449c59\f\dnscacheugc.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-makecab_31bf3856ad364e35_10.0.19041.207_none_cef5032ec7ecd573\makecab.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdge.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.19041.844_none_95c651508e565d13\r\provtool.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.928_none_1d29b4735b607954\f\services.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.1202_none_1a780ff3456b7bcd\r\CredentialEnrollmentManager.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_770f598aef14382e\r\dfrgui.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.1266_none_d375b5361b806b32\WpcTok.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\f\HvsiSettingsWorker.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\winhlp32.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.1_none_4f5d06c149db5ae8\control.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.844_none_3ca0ef366c7d7a84\n\Dism.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3\f\fontdrvhost.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.19041.1_none_34bfdd0c0f979e4b\EASPolicyManagerBrokerHost.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_e2f3aaf24de135ec\r\Magnify.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1_none_906b4c073d1d970c\msconfig.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_4b16fb7fab206eb1\f\printui.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.19041.1_none_0c1f19c50b5e5f6e\tar.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.264_none_62496caeba2daa52\nvspinfo.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.19041.1_none_ceb3891c2721fc43\chkntfs.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.19041.1202_none_fceb29af5a61f7e6\f\bcdedit.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1237_none_9ad73d125ac89655\f\bfsvc.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_9e3e509d4c4881e1\r\MuiUnattend.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.1266_none_bfb5312df2d5c960\WpcMon.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.928_none_1d29b4735b607954\r\services.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.1023_none_5c93ef2449c89609\r\securekernel.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVShNotify.exe 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_5ed22c2e347952b18b4d8d6d7ab2020a_coinminer_elex_glassworm_luca-stealer_memery_njrat_remco.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2532