Overview

overview

10

Static

static

10

2026-09-24...xz.exe

windows10-2004-x64

9

2026-09-24...xz.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 14:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_1450257f15d84eda02d00ccebb1b5cf8_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz.exe
  • Size 6.2MB
  • Sample260925-rxvceatzfs
  • SHA256 c8b3945b70e4ece7bd1008e0b69c8be457462800463bfdc22b934326b78fec4f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionupx

Malware Config

Signatures

  • Detects JavaScript files used for persistence and executable or script execution 1 IoCs
  • UPX dump on OEP (original entry point) 2 IoCs
  • Badlisted process makes network request 3 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 4 IoCs
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_1450257f15d84eda02d00ccebb1b5cf8_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_1450257f15d84eda02d00ccebb1b5cf8_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz.exe"
    1⤵
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\HTA\index.hta?bittorrent" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_1450257f15d84eda02d00ccebb1b5cf8_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz.exe" /LOG "C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\index.hta.log" /PID "2340" /CID "Nh7-CaLYK15iN_5R" /VERSION "254254905" /OS "6.2" /BROWSERS "\"C:\Program Files\Mozilla Firefox\firefox.exe\",\"C:\Program Files\Google\Chrome\Application\chrome.exe\",C:\Program Files\Internet Explorer\iexplore.exe,\"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe\"" /ARCHITECTURE "64" /LANG "en" /USERNAME "Admin" /SID "S-1-5-21-4057491610-3392471755-192832105-1000" /CLIENT "bittorrent"
      2⤵
      • Badlisted process makes network request
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:424
      • C:\Windows\SysWOW64\cscript.exe
        "C:\Windows\System32\cscript.exe" "shell_scripts/check_if_cscript_is_working.js"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5536
      • C:\Windows\SysWOW64\PING.EXE
        "C:\Windows\System32\PING.EXE" 8.8.8.8 -n 2 -w 500
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1324
      • C:\Windows\SysWOW64\RunDll32.exe
        RunDll32.exe "C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\HTA\3rdparty\OCSetupHlp.dll",_RHPID71RHEng2@16 424,04A8EB875C98432FAE34A3249B4FE7B1,4991C09632A746D7A6C3F090C4878DD6,77E1AEA32C0C4827A4952F62A6599A67
        3⤵
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:2088
      • C:\Windows\SysWOW64\cscript.exe
        "C:\Windows\System32\cscript.exe" shell_scripts/shell_ping_after_close.js "http://bench.utorrent.com/e?i=50&e=eyJldmVudE5hbWUiOiJoeWRyYTEiLCJhY3Rpb24iOiJodGFiZWdpbiIsInBpZCI6IjIzNDAiLCJoIjoiTmg3LUNhTFlLMTVpTl81UiIsInYiOiIyNTQyNTQ5MDUiLCJiIjo0MDc2MSwiY2wiOiJCaXRUb3JyZW50IiwibG5nIjoicnUiLCJvc2EiOiI2NCIsInNsbmciOiJlbiIsImRiIjoiIiwiZGJ2IjoiMTEuMCIsImliciI6W3sibmFtZSI6IiIsInZlcnNpb24iOiIxMzUuMCIsImV4ZU5hbWUiOiJmaXJlZm94In0seyJuYW1lIjoiIiwidmVyc2lvbiI6IjE0MC4wIiwiZXhlTmFtZSI6ImNocm9tZSJ9LHsibmFtZSI6IiIsInZlcnNpb24iOiIxMS4wIiwiZXhlTmFtZSI6ImlleHBsb3JlIn0seyJuYW1lIjoiIiwidmVyc2lvbiI6IjEzOS4wIiwiZXhlTmFtZSI6Im1zZWRnZSJ9XSwiaXAiOiI4NS4yMDMuNDYuMTI5IiwiY24iOiJVbml0ZWQgS2luZ2RvbSIsInBhY2tpZCI6InJ1X3lhbmRleF9vYyJ9"
        3⤵
        • Badlisted process makes network request
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:6112

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OCComSDK.dll
        • Path C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\HTA\3rdparty\OCComSDK.dll
        • Size 190KB
        • SHA256 cb798c1fb947b109e65bbd3bf89c55af2cd319d471fd479805bd0a3a5954a85e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OCSetupHlp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\HTA\3rdparty\OCSetupHlp.dll
        • Size 825KB
        • SHA256 79ed6200ab7f1b65fc4dd79f187f25e2bafe806c1d2dd8f149e50cbaa1cab449
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ru.json
        • Path C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\HTA\i18n\ru.json
        • Size 9KB
        • SHA256 618ea1dd11aa4e00fc7ff510456b328a001ce3e2c9a16a7862484cae6c15d8b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bt_icon_48px.png
        • Path C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\HTA\images\bt_icon_48px.png
        • Size 3KB
        • SHA256 7c5123103dc089c1912b1eae0bbbe2b7c32e39ecf83649a53a8e9f3aea960602
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        loading.gif
        • Path C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\HTA\images\loading.gif
        • Size 5KB
        • SHA256 00c62ed42795f996b5f963c69ce918c2623d72896ebb628dfd9bc800514900ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logo_Yandex_RU_UA_vertical.png
        • Path C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\HTA\images\logo_Yandex_RU_UA_vertical.png
        • Size 6KB
        • SHA256 a25560f82caff6881c106161c97e124a22f592b9149bbae2c3f7cf8ad3407d2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        main_bittorrent.ico
        • Path C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\HTA\images\main_bittorrent.ico
        • Size 100KB
        • SHA256 aa5daecee872ca7c079b5363c2ffb0a6bbb335414ac3ce2006bc18015fcd45e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        index.hta
        • Path C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\HTA\index.hta
        • Size 522B
        • SHA256 61acd6e7405fad348433f8de4b12ed97b42caccbcf28fe0e4ba4b4a5d2ea707e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        install.1790346900.zip
        • Path C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\HTA\install.1790346900.zip
        • Size 2.1MB
        • SHA256 b7dcabe1ebe2ec84daf6b0689d84759c5486369c4a3df773766173072d245cd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        common.js
        • Path C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\HTA\scripts\common.js
        • Size 389KB
        • SHA256 4a8a7063b889227d508d5c11d328a2f88e96bfe5da3fea7257bc2c9eed0a6bfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        initialize.js
        • Path C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\HTA\scripts\initialize.js
        • Size 978B
        • SHA256 e12037adeb71f62eb46ee77ded18cd226c1beba95b266a2e820cfc6eb0fe5fad
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        install.js
        • Path C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\HTA\scripts\install.js
        • Size 18KB
        • SHA256 45276043c25079735321a9631ea357e070edbca85d5d902c0db1208b51af9944
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        check_if_cscript_is_working.js
        • Path C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\HTA\shell_scripts\check_if_cscript_is_working.js
        • Size 18B
        • SHA256 d1b9d32702d7d7a184ab4654c204e6d385a9499fde63e0b06bda60f8077a7862
        • MD5 SHA1 SHA512
        Submit Download

        shell_ping_after_close.js
        • Path C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\HTA\shell_scripts\shell_ping_after_close.js
        • Size 312B
        • SHA256 5e872715109b381c99aa19e2435628640505794e09a1998de7b92c2a5aea38e1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        common.css
        • Path C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\HTA\styles\common.css
        • Size 99KB
        • SHA256 879fc3da65370131d5363a724b969a23a1f6bb9963284b8418f1e98daf196845
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        index.hta.log
        • Path C:\Users\Admin\AppData\Local\Temp\HYD342.tmp.1790346900\index.hta.log
        • Size 57B
        • SHA256 edbce952aa91a43d708c23ab54d9bb49fcc68f2efc946c6b7796c3bf5c98893a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2340-1-0x0000000000617000-0x0000000000618000-memory.dmp
        Download

        memory/2340-0-0x0000000000400000-0x0000000000A35000-memory.dmp
        Download

        memory/2340-114-0x0000000000400000-0x0000000000A35000-memory.dmp
        Download