Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
20/10/2026, 16:24
General
- Target 2026-10-19_74455a5f6eed90be247afa404e62b9a5_coinminer_glassworm_icedid_njrat_stealc.exe
- Size 5.3MB
- Sample261020-twmbhsstd1
- SHA256 7d6fa679075466c24cf569937ce24c187623a4809600c27b5e0a7d7757a0309a
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Program Files directory 2 IoCs
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-19_74455a5f6eed90be247afa404e62b9a5_coinminer_glassworm_icedid_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-19_74455a5f6eed90be247afa404e62b9a5_coinminer_glassworm_icedid_njrat_stealc.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Program Files directory
- Direct Volume Access: Opens a physical disk for reading
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken