Overview

overview

10

Static

static

10

2026-09-24...xz.exe

windows10-2004-x64

9

2026-09-24...xz.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 16:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_0170fa6d6145e57405d64675e37b3127_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz.exe
  • Size 5.7MB
  • Sample260925-tk815s116p
  • SHA256 93a3d7d1dc2af7d6a96e445b784c2936b372b340b1792c26c7199e9f1a43b6b1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionupx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 2 IoCs
  • Badlisted process makes network request 2 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 4 IoCs
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_0170fa6d6145e57405d64675e37b3127_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0170fa6d6145e57405d64675e37b3127_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz.exe"
    1⤵
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:484
    • C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\HYD5B74.tmp.1790352494\HTA\index.hta" "C:\Users\Admin\AppData\Local\Temp\2026-09-24_0170fa6d6145e57405d64675e37b3127_amadey_coinminer_elex_glassworm_magniber_maze_remcos_smoke-loader_stealc_zxxz.exe" /LOG "C:\Users\Admin\AppData\Local\Temp\HYD5B74.tmp.1790352494\index.hta.log" /PID "484" /CID "Qi9WmhzWEXo0m-KE" /VERSION "254121585" /OS "6.2" /BROWSERS "\"C:\Program Files\Mozilla Firefox\firefox.exe\",\"C:\Program Files\Google\Chrome\Application\chrome.exe\",C:\Program Files\Internet Explorer\iexplore.exe,\"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe\"" /ARCHITECTURE "64" /LANG "en" /USERNAME "Admin" /SID "S-1-5-21-2251218687-1689653882-3767565116-1000"
      2⤵
      • Badlisted process makes network request
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1812
      • C:\Windows\SysWOW64\PING.EXE
        "C:\Windows\System32\PING.EXE" 8.8.8.8 -n 1 -w 500
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:5996
      • C:\Windows\SysWOW64\RunDll32.exe
        RunDll32.exe "C:\Users\Admin\AppData\Local\Temp\HYD5B74.tmp.1790352494\HTA\3rdparty\OCSetupHlp.dll",_RHPID71RHEng2@16 1812,9E6227577D64415CBE0CA0B99839F0C9,0A725BB13DCA49399488ED854FD9C7F4,3CF1A579E166410E846909578160EEEB
        3⤵
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        PID:5220
      • C:\Windows\SysWOW64\cscript.exe
        "C:\Windows\System32\cscript.exe" shell_scripts/shell_ping_after_close.js "http://bench.utorrent.com/e?i=50&e=eyJldmVudE5hbWUiOiJoeWRyYTEiLCJhY3Rpb24iOiJodGFiZWdpbiIsInBpZCI6IjQ4NCIsImgiOiJRaTlXbWh6V0VYbzBtLUtFIiwidiI6IjI1NDEyMTU4NSIsImNsIjoidVRvcnJlbnQiLCJsbmciOiJlbiIsIm9zYSI6IjY0Iiwic2xuZyI6ImVuIiwiZGIiOiIiLCJkYnYiOiIxMS4wIiwiaWJyIjpbeyJuYW1lIjoiIiwidmVyc2lvbiI6IjEzNS4wIiwiZXhlTmFtZSI6ImZpcmVmb3gifSx7Im5hbWUiOiIiLCJ2ZXJzaW9uIjoiMTQwLjAiLCJleGVOYW1lIjoiY2hyb21lIn0seyJuYW1lIjoiIiwidmVyc2lvbiI6IjExLjAiLCJleGVOYW1lIjoiaWV4cGxvcmUifSx7Im5hbWUiOiIiLCJ2ZXJzaW9uIjoiMTM5LjAiLCJleGVOYW1lIjoibXNlZGdlIn1dLCJpcCI6Ijg1LjIwMy40Ni4xMzYiLCJjbiI6IlVuaXRlZCBLaW5nZG9tIiwicGFja2lkIjoiZGVmYXVsdCJ9"
        3⤵
        • Badlisted process makes network request
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:2912

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        OCComSDK.dll
        • Path C:\Users\Admin\AppData\Local\Temp\HYD5B74.tmp.1790352494\HTA\3rdparty\OCComSDK.dll
        • Size 190KB
        • SHA256 cb798c1fb947b109e65bbd3bf89c55af2cd319d471fd479805bd0a3a5954a85e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OCSetupHlp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\HYD5B74.tmp.1790352494\HTA\3rdparty\OCSetupHlp.dll
        • Size 825KB
        • SHA256 79ed6200ab7f1b65fc4dd79f187f25e2bafe806c1d2dd8f149e50cbaa1cab449
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        loading.gif
        • Path C:\Users\Admin\AppData\Local\Temp\HYD5B74.tmp.1790352494\HTA\images\loading.gif
        • Size 5KB
        • SHA256 00c62ed42795f996b5f963c69ce918c2623d72896ebb628dfd9bc800514900ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        main.ico
        • Path C:\Users\Admin\AppData\Local\Temp\HYD5B74.tmp.1790352494\HTA\images\main.ico
        • Size 104KB
        • SHA256 7c7279daebd88f6a34246603db9c0ecf9bbfa35ef820edd3278e5bc53f9e7680
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        main_icon.png
        • Path C:\Users\Admin\AppData\Local\Temp\HYD5B74.tmp.1790352494\HTA\images\main_icon.png
        • Size 3KB
        • SHA256 639bccb6ed0fce165cc979a2949d211ec8f1570133d644bf042a5400c3454c21
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        index.hta
        • Path C:\Users\Admin\AppData\Local\Temp\HYD5B74.tmp.1790352494\HTA\index.hta
        • Size 1KB
        • SHA256 9d25ab50dda6c4cd264dca1583d25824c83f299a292eb8ca2d2f369958824ea1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        install.1790352494.zip
        • Path C:\Users\Admin\AppData\Local\Temp\HYD5B74.tmp.1790352494\HTA\install.1790352494.zip
        • Size 1.9MB
        • SHA256 5624d205b18332c0f67b672dbb530fa996fc34ce17d1811328b483794260bf67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        common.js
        • Path C:\Users\Admin\AppData\Local\Temp\HYD5B74.tmp.1790352494\HTA\scripts\common.js
        • Size 357KB
        • SHA256 fb12a37cb14a61b4ea55a1b58c9793965e34b30c3f30db962dd870fde3d7fa39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        install.js
        • Path C:\Users\Admin\AppData\Local\Temp\HYD5B74.tmp.1790352494\HTA\scripts\install.js
        • Size 4KB
        • SHA256 27159e75ad618b893735f36afa550d314a115cb8a17f58d1218a0b78b07051d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shell_ping_after_close.js
        • Path C:\Users\Admin\AppData\Local\Temp\HYD5B74.tmp.1790352494\HTA\shell_scripts\shell_ping_after_close.js
        • Size 261B
        • SHA256 22e337cd0d760c32f77d4d51bfce095c14a93aa4351093065eb5b6e45af61d94
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        common.css
        • Path C:\Users\Admin\AppData\Local\Temp\HYD5B74.tmp.1790352494\HTA\styles\common.css
        • Size 99KB
        • SHA256 09fd28b922d2fdfdac6cda3f767ad4bc93dde7e374456c6af4beb413e56c9a60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        index.hta.log
        • Path C:\Users\Admin\AppData\Local\Temp\HYD5B74.tmp.1790352494\index.hta.log
        • Size 57B
        • SHA256 c928f8c9eb23fa344db00259282532778a548f3a54e001a5177d24f74d49b511
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/484-0-0x0000000000400000-0x00000000009BD000-memory.dmp
        Download

        memory/484-1-0x000000000060E000-0x000000000060F000-memory.dmp
        Download

        memory/484-559-0x0000000000400000-0x00000000009BD000-memory.dmp
        Download