milleniumrat | 684ff466b783daab10a9f4fc860c4d6a8cb750534682194dfca4c05c45a46d91

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 13:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-20_ebef2bf988b54e2fefe05342df131e8f_elex_glassworm_icedid_luca-stealer_njrat_play_stealc.exe
Size 3.2MB
Sample260920-qgwpvsxeqf
SHA256 684ff466b783daab10a9f4fc860c4d6a8cb750534682194dfca4c05c45a46d91
MD5 ebef2bf988b54e2fefe05342df131e8f
SHA1 7620fbba01cd683c67a172c74fad998bc9bab90e
SHA512 f0dab4c7488aeb026a061257e87a51096b68081540c40dcd43952cf5ee69b409d755e9d5e5fc3f219d52dcbbfd5eefadab9d45c650e17469349e707421868138
SSDEEP 49152:iQFS9/Q9poBR00VN2lOjJYzmbdvOCcx+3BcoDNV+dqQJ7/pkgkU:tedNcOnOCcx+3BcoDNhgk
TLSH
T101E58E16B7A800F8D0A7C174CA575A07E772B819077097DF17D0CAAA6F23BE15A7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution milleniumrat persistence rat spyware stealer

Malware Config

Signatures

Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat

Detects MilleniumRAT stealer 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c558-4.dat	family_milleniumrat

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c558-4.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c558-4.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c558-4.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c558-4.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c558-4.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables containing possible sandbox analysis VM names 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c558-4.dat	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c558-4.dat	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c558-4.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Executes dropped EXE 1 IoCs

pid	Process
5604	steam.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
12	raw.githubusercontent.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3444	cmd.exe
2576	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-20_ebef2bf988b54e2fefe05342df131e8f_elex_glassworm_icedid_luca-stealer_njrat_play_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

Delays execution with timeout.exe 12 IoCs

defense_evasion

pid	Process
3912	timeout.exe
464	timeout.exe
4540	timeout.exe
1256	timeout.exe
6060	timeout.exe
2312	timeout.exe
3700	timeout.exe
2424	timeout.exe
5680	timeout.exe
4912	timeout.exe
1644	timeout.exe
3268	timeout.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
5604	steam.exe
5604	steam.exe
5604	steam.exe
5604	steam.exe
5604	steam.exe
5604	steam.exe
5604	steam.exe
5604	steam.exe
5604	steam.exe
5604	steam.exe
5604	steam.exe
5604	steam.exe
5604	steam.exe
5604	steam.exe
5604	steam.exe
5604	steam.exe
5604	steam.exe
5604	steam.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 5604	2888	2026-09-20_ebef2bf988b54e2fefe05342df131e8f_elex_glassworm_icedid_luca-stealer_njrat_play_stealc.exe	89
PID 5604 wrote to memory of 1728	5604	steam.exe	92
PID 5604 wrote to memory of 1728	5604	steam.exe	92
PID 5604 wrote to memory of 3608	5604	steam.exe	95
PID 5604 wrote to memory of 3608	5604	steam.exe	95
PID 5604 wrote to memory of 3444	5604	steam.exe	96
PID 3444 wrote to memory of 6060	3444	cmd.exe	98
PID 2888 wrote to memory of 2576	2888	2026-09-20_ebef2bf988b54e2fefe05342df131e8f_elex_glassworm_icedid_luca-stealer_njrat_play_stealc.exe	99
PID 2576 wrote to memory of 1808	2576	cmd.exe	101
PID 2576 wrote to memory of 1992	2576	cmd.exe	102
PID 2576 wrote to memory of 1644	2576	cmd.exe	103
PID 2576 wrote to memory of 3268	2576	cmd.exe	104
PID 2576 wrote to memory of 3912	2576	cmd.exe	105
PID 2576 wrote to memory of 2312	2576	cmd.exe	106
PID 2576 wrote to memory of 3700	2576	cmd.exe	107
PID 2576 wrote to memory of 2424	2576	cmd.exe	108
PID 2576 wrote to memory of 464	2576	cmd.exe	109
PID 2576 wrote to memory of 4540	2576	cmd.exe	110
PID 2576 wrote to memory of 1256	2576	cmd.exe	111
PID 2576 wrote to memory of 5680	2576	cmd.exe	112
PID 2576 wrote to memory of 4912	2576	cmd.exe	113
PID 2576 wrote to memory of 3372	2576	cmd.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-20_ebef2bf988b54e2fefe05342df131e8f_elex_glassworm_icedid_luca-stealer_njrat_play_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-20_ebef2bf988b54e2fefe05342df131e8f_elex_glassworm_icedid_luca-stealer_njrat_play_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\Launcher_2888\steam.exe
  "C:\Users\Admin\AppData\Local\Temp\Launcher_2888\steam.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:1728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:3608
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c timeout /t 3 /nobreak & del /f /q "C:\Users\Admin\AppData\Local\Temp\Launcher_2888\steam.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3444
  - - C:\Windows\system32\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:6060
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Launcher_2888\inicio.cmd"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1808
- - C:\Windows\SysWOW64\mode.com
    mode con cols=100 lines=30
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1992
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1644
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3268
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3912
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2312
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3700
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2424
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:464
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4540
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1256
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5680
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4912
- - C:\Windows\SysWOW64\choice.exe
    choice /c X /n /t 5 /d X
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3372

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

inicio.cmd

Path C:\Users\Admin\AppData\Local\Temp\Launcher_2888\inicio.cmd
Size 2KB
SHA256 d56cce28b8ba0e22de5ed75d9078270619059c8a8ee012a04756c69b2fd729b7
MD5 4b258f6aa5f2fb1a3a654f255cba9fb3
SHA1 37841851ee8c98fd39c7ab445f9694dd9167a521
SHA512 6c889bfdb0cff635fc90ce68fd51b53c22d288d19e64ed73298d7ad1823f90d59eda8a4f6b6909c34adef274b8a9e3f25f43128f8037144e21324808ccc87b96
TLSH
T1FC417B613C11E66882BACB932DF581A7F11116C71A019D6CB0EFC2B84F723C575EE478
MD5 SHA1 SHA512 TLSH

Submit Download

steam.exe

Path C:\Users\Admin\AppData\Local\Temp\Launcher_2888\steam.exe
Size 3.0MB
SHA256 f968d02e095f6f4edca0e21b1fa36dd8571588b5a3666b3f967e0048b1e194e9
MD5 aea690bbec122f8efbeb277939cb53e8
SHA1 62659161eabda588ecb3e2ab268244eb24c2445a
SHA512 937fec9b5e8b4b2c951a9edcc1af757ec3c64f84fc02df90b0fbf03e893fa276f1a69faef75407e752327032980ff1a9345d2977dd44ebd0ca972f74109f4a47
SSDEEP 49152:kFS9/Q9poBR00VN2lOjJYzmbdvOCcx+3BcoDNV+dqQJ7/pkgk:SedNcOnOCcx+3BcoDNhgk
TLSH
T1EAE58E16B7A800F8D0A7C174CA475907E7B2B819177097DF17D0CAAA6F23BE15A7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download