Overview

overview

10

Static

static

10

2026-10-01...lc.exe

windows10-2004-x64

7

2026-10-01...lc.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/10/2026, 09:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-01_8dce46e7ccac6b501ab10cf02665a85e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
  • Size 8.2MB
  • Sample261002-k6lcjaef79
  • SHA256 1d5b2584db736fce25002ca6f744f8e9713a87290bb9a847dc0ac6db5839d824
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
    defense_evasion
  • Drops file in Windows directory 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies system certificate store 2 TTPs 60 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-01_8dce46e7ccac6b501ab10cf02665a85e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-01_8dce46e7ccac6b501ab10cf02665a85e_coinminer_glassworm_icedid_luca-stealer_njrat_stealc.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies trusted root certificate store through registry
    • Reads the TCP/IP host and domain name from the registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5676
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$d=$env:SystemDrive.TrimEnd(':');$p=Get-Partition -DriveLetter $d -ErrorAction Stop|Select-Object -First 1;$disk=Get-Disk -Number $p.DiskNumber -ErrorAction Stop;Write-Output $disk.PartitionStyle"
      2⤵
      • Enumerates connected drives
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1088
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
      2⤵
      • Enumerates connected drives
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6000
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$p=Get-CimInstance Win32_Processor|Select-Object -First 1;$c=Get-CimInstance Win32_ComputerSystem;Write-Output ('Firmware=' + [int][bool]$p.VirtualizationFirmwareEnabled);Write-Output ('Monitor=' + [int][bool]$p.VMMonitorModeExtensions);Write-Output ('Slat=' + [int][bool]$p.SecondLevelAddressTranslationExtensions);Write-Output ('Hypervisor=' + [int][bool]$c.HypervisorPresent)"
      2⤵
      • Enumerates connected drives
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      PID:4240
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$names=@('Microsoft-Hyper-V-All','VirtualMachinePlatform','HypervisorPlatform');$features=Get-WindowsOptionalFeature -Online;foreach($n in $names){$f=$features|Where-Object{$_.FeatureName -eq $n}|Select-Object -First 1;if($null -eq $f){Write-Output ($n + '=NotPresent')}else{Write-Output ($f.FeatureName + '=' + $f.State)}}"
      2⤵
      • Enumerates connected drives
      • Drops file in Windows directory
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Windows\System32\Dism\dismhost.exe
        C:\Windows\System32\Dism\dismhost.exe {BA3CDFA8-E2FB-4E4A-BEEA-73CD4AF72D4F}
        3⤵
        • Drops file in Windows directory
        PID:1668

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        0CB652C796BAB51B3514BE21AACE5383
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0CB652C796BAB51B3514BE21AACE5383
        • Size 656B
        • SHA256 97658de8c68dfa98ace1e5028a63d54a1aae911b3e21471076c6850cd08cbab4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        4E3E4B05E877647EF3D7B912F256A94C
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E3E4B05E877647EF3D7B912F256A94C
        • Size 1KB
        • SHA256 ee5f7abd6981bb0255632cd8f49283451b4b18844d12040b44ee00f07b8fe2c6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Size 4KB
        • SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        BDE28772A83DB7274166C9CC07B6A827
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BDE28772A83DB7274166C9CC07B6A827
        • Size 682B
        • SHA256 0fc0901cca2bae9e9fdbb02d50d02f1094f7b36672086991b9e897626dc485f0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        0CB652C796BAB51B3514BE21AACE5383
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0CB652C796BAB51B3514BE21AACE5383
        • Size 194B
        • SHA256 c324b55040c41cdacc92ba07807dc2065285ef2b47970310d5db7c2906378b8a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        4E3E4B05E877647EF3D7B912F256A94C
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E3E4B05E877647EF3D7B912F256A94C
        • Size 192B
        • SHA256 20a87021f5926166778afd09df14f646ef5a28c3494885556a90337bbe7367f5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
        • Size 342B
        • SHA256 883300505ff4dc4d751be99a7e66b607b5c6c54f7a63b3740346160ada528187
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        BDE28772A83DB7274166C9CC07B6A827
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BDE28772A83DB7274166C9CC07B6A827
        • Size 192B
        • SHA256 042421884b8155be7404af2c475aa13776ff2ae173b254d3bf7acb10ea9380ad
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 b55b0aea95d706672e4073ff7bced85ca372bb9eeaf17932b8db8c150ec55202
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 b607578f9516d749c7278af5a3bc2d077bb6b4a219c7015d61183c93e779f5fc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 18b3c30f87c93ff3ec3be6539565369c32f4b244a61570854b4b25ad048dbc72
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        loader_diag.log
        • Path C:\Users\Admin\AppData\Local\Ring-1\loader_diag.log
        • Size 400B
        • SHA256 3e712808083885184d16d59c8bdd7663f05388102dc5af78873f9efaf825f974
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        loader_diag.log
        • Path C:\Users\Admin\AppData\Local\Ring-1\loader_diag.log
        • Size 1KB
        • SHA256 9a4dba2e58f005e27ba71a5b803197ee2f39d2c5d134efdb41c9c7ee3e9437e6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_wqn3dp0e.xhj.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wqn3dp0e.xhj.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dism.log
        • Path C:\Windows\Logs\DISM\dism.log
        • Size 292KB
        • SHA256 56f7b9802b90d08f6b3652328e59d7fc1aa13a6927cb4a2b23d0180d9596fa71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dism.log
        • Path C:\Windows\Logs\DISM\dism.log
        • Size 297KB
        • SHA256 9a50f34d93ca1789e134ff39f48d3833d2eb744dff01c14b08f3cfffd45f0721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1088-118-0x0000017164B30000-0x0000017164B4E000-memory.dmp
        Download

        memory/1088-127-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/1088-114-0x0000017164AE0000-0x0000017164AFE000-memory.dmp
        Download

        memory/1088-115-0x0000017164B80000-0x0000017164C32000-memory.dmp
        Download

        memory/1088-116-0x0000017164B00000-0x0000017164B0A000-memory.dmp
        Download

        memory/1088-117-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/1088-106-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/1088-119-0x0000017164B10000-0x0000017164B1A000-memory.dmp
        Download

        memory/1088-120-0x0000017164B20000-0x0000017164B2A000-memory.dmp
        Download

        memory/1088-121-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/1088-122-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/1088-123-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/1088-124-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/1088-125-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/1088-126-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/1088-107-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/1088-128-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/1088-129-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/1088-130-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/1088-131-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/1088-133-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/1088-104-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/1088-95-0x00007FFED542F000-0x00007FFED5430000-memory.dmp
        Download

        memory/1088-96-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/1088-103-0x000001714C5E0000-0x000001714C602000-memory.dmp
        Download

        memory/1088-97-0x00007FFED52A0000-0x00007FFED5C44000-memory.dmp
        Download

        memory/2480-177-0x000001D5E90E0000-0x000001D5E9108000-memory.dmp
        Download

        memory/6000-148-0x00000296D6C10000-0x00000296D6C34000-memory.dmp
        Download

        memory/6000-147-0x00000296D6C10000-0x00000296D6C3A000-memory.dmp
        Download