Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 04:21
Behavioral task
behavioral1
Sample
2026-10-16_e5fed3d45e22e4fb1904ace1636c9fbd_coinminer_glassworm_icedid_njrat_ryuk_xmrig.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-16_e5fed3d45e22e4fb1904ace1636c9fbd_coinminer_glassworm_icedid_njrat_ryuk_xmrig.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-16_e5fed3d45e22e4fb1904ace1636c9fbd_coinminer_glassworm_icedid_njrat_ryuk_xmrig.exe
- Size 3.2MB
- Sample261017-eyshzssv4n
- SHA256 93e7334d2a2d3ade1277831f3c863634f714aacfe4161c62fd54c80e75123e0b
- MD5 e5fed3d45e22e4fb1904ace1636c9fbd
- SHA1 a87c83e9aa4ee80ce959d25b07a87dffcbbe206f
- SHA512 40ce4379982a7f073feb037fb70dc0bfec52f59479899787e802ef34445fe0984ec3e6f2ff5400cefda11fc3bd6c242d9bb7ccfcc74b99baf827a78ed2105379
- SSDEEP 49152:DrVwASO2GtlqhJ6pLLbc9xWFqKQ99cb+s55Dy4182bezqAVoXQXqAi2cda+R1zVM:MCLUHDK4qV8+nCOP3+Ee+u4
- TLSH T199F5BF1AAB6440E0D5B7C138C9768767E3F1B45903B29BDB06A8C27E1F236E54E7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4248 2026-10-16_e5fed3d45e22e4fb1904ace1636c9fbd_coinminer_glassworm_icedid_njrat_ryuk_xmrig.exe 4248 2026-10-16_e5fed3d45e22e4fb1904ace1636c9fbd_coinminer_glassworm_icedid_njrat_ryuk_xmrig.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 4248 2026-10-16_e5fed3d45e22e4fb1904ace1636c9fbd_coinminer_glassworm_icedid_njrat_ryuk_xmrig.exe Token: SeLockMemoryPrivilege 4248 2026-10-16_e5fed3d45e22e4fb1904ace1636c9fbd_coinminer_glassworm_icedid_njrat_ryuk_xmrig.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4248 2026-10-16_e5fed3d45e22e4fb1904ace1636c9fbd_coinminer_glassworm_icedid_njrat_ryuk_xmrig.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-16_e5fed3d45e22e4fb1904ace1636c9fbd_coinminer_glassworm_icedid_njrat_ryuk_xmrig.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-16_e5fed3d45e22e4fb1904ace1636c9fbd_coinminer_glassworm_icedid_njrat_ryuk_xmrig.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4248