Overview

overview

10

Static

static

10

2026-10-17...xz.exe

windows10-2004-x64

9

2026-10-17...xz.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/10/2026, 23:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-17_97b1788658f0feb58c8c07fbdc4eea57_coinminer_elex_glassworm_hawkeye_luca-stealer_magniber_njrat_remcos_zxxz.exe
  • Size 5.2MB
  • Sample261018-3khcvsav5m
  • SHA256 bfbbc0c7097bded7e551caa63283772d34daf6118823533a121687313357b39d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoveryspywareupx

Malware Config

Signatures

  • UPX dump on OEP (original entry point) 6 IoCs
  • Executes dropped EXE 10 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-17_97b1788658f0feb58c8c07fbdc4eea57_coinminer_elex_glassworm_hawkeye_luca-stealer_magniber_njrat_remcos_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-17_97b1788658f0feb58c8c07fbdc4eea57_coinminer_elex_glassworm_hawkeye_luca-stealer_magniber_njrat_remcos_zxxz.exe"
    1⤵
    • Identifies Wine through registry keys
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
      uTorrent.exe /NOINSTALL /BRINGTOFRONT
      2⤵
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Reads the TCP/IP host and domain name from the registry
      • System Location Discovery: System Language Discovery
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3180
      • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe
        "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe" uTorrent_3180_00D2AE90_1217585865 µTorrent4823DF041B09 uTorrent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3480
      • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe
        "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe" uTorrent_3180_00D2AE90_730596741 µTorrent4823DF041B09 uTorrent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1304
      • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe
        "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe" uTorrent_3180_00D2AE90_1661142835 µTorrent4823DF041B09 uTorrent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3512
      • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe
        "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe" uTorrent_3180_00D2AE90_1080883835 µTorrent4823DF041B09 uTorrent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4816
      • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe
        "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe" uTorrent_3180_00D2AE90_236541202 µTorrent4823DF041B09 uTorrent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1104
      • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe
        "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe" uTorrent_3180_00D2AE90_1895002664 µTorrent4823DF041B09 uTorrent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2552
      • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe
        "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe" uTorrent_3180_00D2AE90_150915243 µTorrent4823DF041B09 uTorrent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:6128
      • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe
        "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe" uTorrent_3180_00D2AE90_1887568091 µTorrent4823DF041B09 uTorrent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:736
      • C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe
        "C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe" uTorrent_3180_00D2AE90_1569387175 µTorrent4823DF041B09 uTorrent
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:5700
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{E2B3C97F-6AE1-41AC-817A-F6F92166D7DD}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1684
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:6116

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          utt5897.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\utt5897.tmp
          • Size 170B
          • SHA256 c54348ea3d7ff4f5fd5cbdc1dc3a62920d8f507ec8b53f2eea3e5372db452bd6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          1f91d2d17ea675d4c2c3192e241743f9_a467fcbb-2f37-4473-b47b-6fb52ffaaf67
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-53044966-3830981193-2402648431-1000\1f91d2d17ea675d4c2c3192e241743f9_a467fcbb-2f37-4473-b47b-6fb52ffaaf67
          • Size 1KB
          • SHA256 ad6f1fae6c0f89950107c43e0aa729c0b617a6fe652b58fba2de1139e1493038
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          plus.btapp
          • Path C:\Users\Admin\AppData\Roaming\uTorrent\apps\plus.btapp
          • Size 264B
          • SHA256 4c5153e7948b56eb14f39a0340302cec301af8b5bb2e38f631ea03978e8f1182
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          settings.dat
          • Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat
          • Size 7KB
          • SHA256 a351d2ef39587eb288899bb8bc13bb04c72f5f3c731e757f64f498c5919e219f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          settings.dat
          • Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat
          • Size 8KB
          • SHA256 d47dc821ee79a4fae34983ddd6a723ae5426ba71c923a05aa11e127e88b66f4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          settings.dat
          • Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat
          • Size 8KB
          • SHA256 5f0e2310383b553b3464a2cfc67400d40feec22d177a2c4021e06f089e2cc491
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          settings.dat
          • Path C:\Users\Admin\AppData\Roaming\uTorrent\settings.dat
          • Size 8KB
          • SHA256 37805fd777c2a5a8e3dc885250ced996113a3333d2f44fe47e55b3c68d26476d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          utt9F20.tmp.zip
          • Path C:\Users\Admin\AppData\Roaming\uTorrent\tmp\utt9F20.tmp.zip
          • Size 242KB
          • SHA256 d46d7a30a0a29cc41714514911fd316a60798ee8d5bc5462495dea9e1671e9da
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          uTorrent.exe
          • Path C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe
          • Size 5.2MB
          • SHA256 bfbbc0c7097bded7e551caa63283772d34daf6118823533a121687313357b39d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          updates.dat
          • Path C:\Users\Admin\AppData\Roaming\uTorrent\updates.dat
          • Size 344B
          • SHA256 a520ba3f7c61a18088840370da9fee3c2e2f4bc3426d7046662b925d861832b3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          utorrentie.exe
          • Path C:\Users\Admin\AppData\Roaming\uTorrent\updates\3.5.0_44294\utorrentie.exe
          • Size 387KB
          • SHA256 2ac2bfa46bdc2fbbe3ffcf6e8d46653ad2cfa57a33180e315566f889380fb33d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2032-56-0x0000000000400000-0x0000000000928000-memory.dmp
          Download

          memory/2032-0-0x0000000000400000-0x0000000000928000-memory.dmp
          Download

          memory/2032-27-0x0000000000400000-0x0000000000928000-memory.dmp
          Download

          memory/3180-49-0x0000000000400000-0x0000000000928000-memory.dmp
          Download

          memory/3180-74-0x0000000000400000-0x0000000000928000-memory.dmp
          Download