3044a62f0d386b6f326a6dd01c0c9188ba370ac541755cc7257274b4cb76ecc5

General

Target
2026-10-01_98481fdaee170127d39d35b64e52c6ac_coinminer_elex_glassworm_icedid_njrat_nymaim_rhadamanthys.exe
Size 6.3MB
Sample261002-j5devsydme
SHA256 3044a62f0d386b6f326a6dd01c0c9188ba370ac541755cc7257274b4cb76ecc5
MD5 98481fdaee170127d39d35b64e52c6ac
SHA1 f2c8b17a9d1261fbbc5e8fa26c2657bb010bc79f
SHA512 b64a2d9c5b497b72053331e9d79e61294503a916174e017102b74f1be8041529c8fcdcfb7d83fa0335e1835b6f2a5be12f1d66e1fcde75da18f7cb83670e2624
SSDEEP 196608:9rmEdF3acIaGeFFVJWMvjm+qZ7URXUoEQQS:rf3acFGWJtm+qORXbQS
TLSH
T14D661241ABE414D1F4F2FA349EF69624AF36BC249AB2C35E2154E00B0D73A519F62773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Detects executables packed with VMProtect. 4 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c604-19.dat	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/6088-23-0x00007FF6FE970000-0x00007FF6FF232000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/6088-26-0x00007FF6FE970000-0x00007FF6FF232000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/6088-31-0x00007FF6FE970000-0x00007FF6FF232000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

Executes dropped EXE 2 IoCs

pid	Process
6088	2026-10-01_98481fdaee170127d39d35b64e52c6ac_coinminer_elex_glassworm_icedid_njrat_nymaim_rhadamanthys.exe
2840	maintenance.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
6088	2026-10-01_98481fdaee170127d39d35b64e52c6ac_coinminer_elex_glassworm_icedid_njrat_nymaim_rhadamanthys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
124	cmd.exe
4680	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-01_98481fdaee170127d39d35b64e52c6ac_coinminer_elex_glassworm_icedid_njrat_nymaim_rhadamanthys.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-01_98481fdaee170127d39d35b64e52c6ac_coinminer_elex_glassworm_icedid_njrat_nymaim_rhadamanthys.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenance.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_98481fdaee170127d39d35b64e52c6ac_coinminer_elex_glassworm_icedid_njrat_nymaim_rhadamanthys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5476	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4856	schtasks.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5140 wrote to memory of 124	5140	2026-10-01_98481fdaee170127d39d35b64e52c6ac_coinminer_elex_glassworm_icedid_njrat_nymaim_rhadamanthys.exe	88
PID 5140 wrote to memory of 4680	5140	2026-10-01_98481fdaee170127d39d35b64e52c6ac_coinminer_elex_glassworm_icedid_njrat_nymaim_rhadamanthys.exe	90
PID 124 wrote to memory of 1932	124	cmd.exe	92
PID 4680 wrote to memory of 4608	4680	cmd.exe	93
PID 124 wrote to memory of 4856	124	cmd.exe	94
PID 4680 wrote to memory of 6088	4680	cmd.exe	95
PID 4680 wrote to memory of 5476	4680	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-10-01_98481fdaee170127d39d35b64e52c6ac_coinminer_elex_glassworm_icedid_njrat_nymaim_rhadamanthys.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_98481fdaee170127d39d35b64e52c6ac_coinminer_elex_glassworm_icedid_njrat_nymaim_rhadamanthys.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zbe202610281452894.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:124
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks.Exe /delete /tn "Maintenance" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1932
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks.Exe /create /tn "Maintenance" /xml "C:\Users\Admin\AppData\Local\Temp\zx202610281452894.xml"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zb202610281452894.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4608
- - C:\Users\Admin\AppData\Local\Temp\2026-10-01_98481fdaee170127d39d35b64e52c6ac_coinminer_elex_glassworm_icedid_njrat_nymaim_rhadamanthys.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_98481fdaee170127d39d35b64e52c6ac_coinminer_elex_glassworm_icedid_njrat_nymaim_rhadamanthys.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Reads the TCP/IP host and domain name from the registry
    PID:6088
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5476

C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Debugger Evasion

1

T1622

Credential Access

Discovery

Debugger Evasion

1

T1622

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

zb202610281452894.bat

Path C:\Users\Admin\AppData\Local\Temp\zb202610281452894.bat
Size 904B
SHA256 3a96ea8da206fa87338bad511ed17d5eece1c5bb3aea665c164b31fb41995b65
MD5 206edde028f866d63daf88c78b7813e9
SHA1 cd5ae59e95e29ad9df871776b357ebe1047551da
SHA512 4c7b491c5507d9f0000c9f142c44c2a0eb9c52b301dcaf3fbd5f8dd8a12b82d3d4cf517e071ee89d200a6b31d5e08f24577480ab5dbb0b5efe40c0162ab527df
TLSH
T119115C445197CF9854AD92C715E4E9BCC1B164FD3E393310B770D89E568780FF892341
MD5 SHA1 SHA512 TLSH

Submit Download

zbe202610281452894.bat

Path C:\Users\Admin\AppData\Local\Temp\zbe202610281452894.bat
Size 399B
SHA256 4ed0ef81513d9d9773175f65674270320d2e7d1525030ff5b1c67a2de5854d5f
MD5 3e8b22c0d2112f0f57d7181ad59e55ba
SHA1 895fcebb26d29cc51d82a744fcb69ad7227cf096
SHA512 382dbe33b0f83790f1f4792f8c082bbb879c2fedecb8b3fa7da99ac77ce2c243f459c53431a1e7ebecb9c39f2a0e41924ef1af28cecbf6b71a0095e6d8ad67dc
TLSH
T1F0E0F12F1323844C108CB68B70D75311DCB5206F73E3B1046A52CC14C4C724BEC5B342
MD5 SHA1 SHA512 TLSH

Submit Download

ze202610281452894.tmp

Path C:\Users\Admin\AppData\Local\Temp\ze202610281452894.tmp
Size 6.3MB
SHA256 0b0da947f898725f8324190899b5d662392eccb701283e31b61a2b0e8be33bd9
MD5 99d7f5436c7c921ab0ef279ba035282c
SHA1 40198c3462c64440d8c6096ceca422451af1698e
SHA512 4b3bdbbda876859c703c59ccc85f25251d05beb0a6873724fcee1262ca33770965057c75e4cf648837e3ef5bd6bbf9a9a82f6c78e5bc4de1cc0e92ae9fe403a0
SSDEEP 196608:fcIaGeFFVJWMvjm+qZ7URXUoEQQ0vOYDM4:fcFGWJtm+qORXbQwDM4
TLSH
T1DF661241ABE818D5F4F3FB349EF586249F36BC299AB2C35E2154900B0D72A518F62773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zx202610281452894.xml

Path C:\Users\Admin\AppData\Local\Temp\zx202610281452894.xml
Size 1KB
SHA256 702eba68ab4f5fb39e5ae9cb5e629d07d2bf38c0ecdaad8bc65a6ddabbd69cc7
MD5 74f52405f07acecd348897153d02394d
SHA1 4696f6981baf895936af7de02774f11ecc10c4a0
SHA512 ff40c6cb3cd64fc3dbf26eda6ca953e28b9584a647d2b63f020ac7e41ff886ab225dc6e7ce557383820481a4051c16e6a28c54d1607ebc56aef48a16fa28613b
TLSH
T1BA31E3589CC0F72BB533922BE7515282EF768393496A4038F4CC4B7B2FF514A6153563
MD5 SHA1 SHA512 TLSH

Submit Download

maintenance.exe

Path C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
Size 2.2MB
SHA256 a77315296dc58edac4959c9ed69ec96e9517883684edaeba3e64c48a44c186ae
MD5 73ad6d009f1c53c23f5d068caa805299
SHA1 f50493f49c3b2b3697b5eb571738dbc70383cac0
SHA512 1f9c739c7b745ba57b3d7e50e00bac9d3019de25aab5bb22c0da810d963dab93d71c56686fccf737cf87a4c95fe53b8e4b3dda09ac1526fb4899aa0e1336e920
SSDEEP 49152:uo7TN6XYwGRV1LCnO9DivWp1daCCN2eLF6I5YDPRrBdSm2610V+9dmhBafgE:uC6NIDLCCiO/dat6I5YPFBx0VmKafgE
TLSH
T184B5337F996640A6FEB86ABC24127F7C892BD12703306D71D9D59C37045E223AB324ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6088-23-0x00007FF6FE970000-0x00007FF6FF232000-memory.dmp

Download

memory/6088-26-0x00007FF6FE970000-0x00007FF6FF232000-memory.dmp

Download

memory/6088-31-0x00007FF6FE970000-0x00007FF6FF232000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads