Overview

overview

10

Static

static

5

2026-10-26...nj.exe

windows10-2004-x64

10

2026-10-26...nj.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/10/2026, 16:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-26_60b66bff0dfc2d94d4ff49f5f3915f87_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
  • Size 5.6MB
  • Sample261027-tlfqzset6w
  • SHA256 746292c46cb19896440a03a5caf2af65bd266b50eac8d1421d4bac710d9a3fd8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverydarksideratspywaretrojan

Malware Config

Signatures

  • Family: DarkSideRAT

    DarkSideRAT is a remote access trojan.

    trojandarksiderat
  • Detects DarkSideRAT 3 IoCs
  • Loads dropped DLL 52 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-26_60b66bff0dfc2d94d4ff49f5f3915f87_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-26_60b66bff0dfc2d94d4ff49f5f3915f87_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies trusted root certificate store through registry
    • Reads the TCP/IP host and domain name from the registry
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Users\Admin\AppData\Local\Temp\2026-10-26_60b66bff0dfc2d94d4ff49f5f3915f87_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-26_60b66bff0dfc2d94d4ff49f5f3915f87_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
      2⤵
        PID:2316
      • C:\Users\Admin\AppData\Local\Temp\2026-10-26_60b66bff0dfc2d94d4ff49f5f3915f87_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
        C:\Users\Admin\AppData\Local\Temp\2026-10-26_60b66bff0dfc2d94d4ff49f5f3915f87_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2088
        • C:\Users\Admin\AppData\Local\Temp\2026-10-26_60b66bff0dfc2d94d4ff49f5f3915f87_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-10-26_60b66bff0dfc2d94d4ff49f5f3915f87_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_nj.exe"
          3⤵
            PID:2036

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            SDL3.dll
            • Path C:\Users\Admin\AppData\Local\Temp\SDL3.dll
            • Size 2.9MB
            • SHA256 e8656a70d57eb5cfa5e20a4c96c45f7f72325a3a109135e919d033f233fa3fb7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            crashhandler64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\crashhandler64.dll
            • Size 499KB
            • SHA256 71dac2711f6c23016e3fdd379e2fa2863303d2cdc26cf38249379eabfa1a96f1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libavcodec-62.dll
            • Path C:\Users\Admin\AppData\Local\Temp\libavcodec-62.dll
            • Size 7.2MB
            • SHA256 a7d85d28a2ede4e1767dc26f7017566b97f8b5533b2bd52431599850017eb2bc
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libavfilter-11.dll
            • Path C:\Users\Admin\AppData\Local\Temp\libavfilter-11.dll
            • Size 1.0MB
            • SHA256 5e7d3e8052088aac2b3ad93ad1539b796e4fcfb3d8d73445bb334c667105dcab
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libavformat-62.dll
            • Path C:\Users\Admin\AppData\Local\Temp\libavformat-62.dll
            • Size 2.2MB
            • SHA256 098ea9414c2127e9aa0c4fa06532a883b57504690ae607091c4c9296bf002a23
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libavutil-60.dll
            • Path C:\Users\Admin\AppData\Local\Temp\libavutil-60.dll
            • Size 2.3MB
            • SHA256 eaef6e4ba7283e1ac7ae80c26b41f8f05d5437640c7ff78719089d16b72974e0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libpyrowave-shared-1.dll
            • Path C:\Users\Admin\AppData\Local\Temp\libpyrowave-shared-1.dll
            • Size 2.6MB
            • SHA256 f6ef66e609865a2167493a635e5fa2da978b9e124bb26e62558892f071bb8a17
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libswresample-6.dll
            • Path C:\Users\Admin\AppData\Local\Temp\libswresample-6.dll
            • Size 805KB
            • SHA256 2ed49e82c7cab6b197b5229759c4d4e1a9eaa74fa5a8303680b34436de74d399
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            libswscale-9.dll
            • Path C:\Users\Admin\AppData\Local\Temp\libswscale-9.dll
            • Size 2.2MB
            • SHA256 e07af81134e1fdb31115625cd45835826a7ff85fb34f084c6336fff04f82e3b7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bootstrap_log.txt
            • Path C:\Users\Admin\AppData\Local\Temp\logs\bootstrap_log.txt
            • Size 13KB
            • SHA256 eb6dfb5073d70497682fc4494835da6de2265191ce3dcd7abb2ed589a955adf4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bins_codecs_win64.zip.vz.c01daf4a0716b88602056bd92acc644129b22e45_7421009
            • Path C:\Users\Admin\AppData\Local\Temp\package\bins_codecs_win64.zip.vz.c01daf4a0716b88602056bd92acc644129b22e45_7421009
            • Size 7.1MB
            • SHA256 4e0688746e470316fe915c2e0b672c840842525a11f4038c9bf5389ff30de210
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bins_hardware_all.zip.vz.b7bacd960fd19cefde78219c11c7774a8ee00d4c_298751
            • Path C:\Users\Admin\AppData\Local\Temp\package\bins_hardware_all.zip.vz.b7bacd960fd19cefde78219c11c7774a8ee00d4c_298751
            • Size 291KB
            • SHA256 abdcb4d7d038660f71732956f1902c18a5f4d854645cbb9196ae9997aed9f2d0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bins_hardware_win64.zip.827a01a60b8b7fd6c3df0f00c938f6c97b03276b
            • Path C:\Users\Admin\AppData\Local\Temp\package\bins_hardware_win64.zip.827a01a60b8b7fd6c3df0f00c938f6c97b03276b
            • Size 8.1MB
            • SHA256 0c6dbf35a61502b59da0477e09aa212b0acf0ef542815eb5f357feb264dadc62
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bins_misc_win64.zip.vz.7803168fa078e80df23870952e39eea3f424a5b7_12196250
            • Path C:\Users\Admin\AppData\Local\Temp\package\bins_misc_win64.zip.vz.7803168fa078e80df23870952e39eea3f424a5b7_12196250
            • Size 11.6MB
            • SHA256 494fe63824ef42a24de3cb1214ffbecb3ab50814dc05938f12f1ffa5bda895b6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bins_webhelpers_win64.zip.vz.c43eca2835681675168481d7353774725d92871e_2720066
            • Path C:\Users\Admin\AppData\Local\Temp\package\bins_webhelpers_win64.zip.vz.c43eca2835681675168481d7353774725d92871e_2720066
            • Size 2.6MB
            • SHA256 c3d1f587350db7c044eb022053862805cb91caf46884a6c4141847d2c1acb3c5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bins_win64.zip.vz.4a749655e9810ef81d0326e9436a7bea2a9f01cb_35488701
            • Path C:\Users\Admin\AppData\Local\Temp\package\bins_win64.zip.vz.4a749655e9810ef81d0326e9436a7bea2a9f01cb_35488701
            • Size 33.8MB
            • SHA256 7f44ab790e6461cc1015f0ead6beff20ac9e281990553028363f7f474cc01f9a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            public_all.zip.vz.54c72b908da906e7af3bee17206b30830d6f627a_25274088
            • Path C:\Users\Admin\AppData\Local\Temp\package\public_all.zip.vz.54c72b908da906e7af3bee17206b30830d6f627a_25274088
            • Size 24.1MB
            • SHA256 eb29b4c243cdcdc62b9d5453dfd46250613248995485ad60549f92cf015ed1c4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            resources_all.zip.vz.ef4c575e0ebeda2c391b9e56182d51ce688f222e_3488108
            • Path C:\Users\Admin\AppData\Local\Temp\package\resources_all.zip.vz.ef4c575e0ebeda2c391b9e56182d51ce688f222e_3488108
            • Size 3.3MB
            • SHA256 e3b3d053d2a4ac25a2d6175bb5df98726c046393090d8c7bbffcc85e03a297f1
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342
            • Path C:\Users\Admin\AppData\Local\Temp\package\resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342
            • Size 55KB
            • SHA256 e9cfba9af633e9d216a0cde97b1177d4cbca2a1aca7e83aaf38655dbd9be4b7d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934b8c_2224876
            • Path C:\Users\Admin\AppData\Local\Temp\package\resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934b8c_2224876
            • Size 2.1MB
            • SHA256 5e9ca0aac16b4d5caa2ac77ab2ce239e8dbcabe5ba6f0565112239ebb127ab2b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steam_client_metrics.bin
            • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_metrics.bin
            • Size 3KB
            • SHA256 70b2203d3ae2b915f42d2595ac64ee270b1c3d0f2a04b4405f590d927706ab83
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            steam_client_win64.installed
            • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win64.installed
            • Size 499KB
            • SHA256 87716d1f1141549250bc311d1d6c3da524f6793d0c2ffa9c8d370c74a03d22aa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steam_client_win64.manifest
            • Path C:\Users\Admin\AppData\Local\Temp\package\steam_client_win64.manifest
            • Size 7KB
            • SHA256 15ac2b305546f07bc33a2e9b2053685826fb5e9aa698b8c9a5961aef6f1cace6
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steam_win64_steamrow.zip.vz.e9430db5afee3e3932b6948af15ad0c4b4f19255_2166823
            • Path C:\Users\Admin\AppData\Local\Temp\package\steam_win64_steamrow.zip.vz.e9430db5afee3e3932b6948af15ad0c4b4f19255_2166823
            • Size 2.1MB
            • SHA256 d6d0567f01d3f7fe8678b470e7d375a205315702c0b91429227f78111ff11efe
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steamui_websrc_all.zip.vz.3dcd2f1c6a5e8a1f3bd080203b3c0fd48c324a25_28679233
            • Path C:\Users\Admin\AppData\Local\Temp\package\steamui_websrc_all.zip.vz.3dcd2f1c6a5e8a1f3bd080203b3c0fd48c324a25_28679233
            • Size 27.4MB
            • SHA256 8a60b5bcc3899c9df081e58552250abf7e1e8975b32bd3b4f9dab261b589dd3d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steamui_websrc_movies_all.zip.40e78cdda48e9a8a74baf614e0cdc7a6b96d26d1
            • Path C:\Users\Admin\AppData\Local\Temp\package\steamui_websrc_movies_all.zip.40e78cdda48e9a8a74baf614e0cdc7a6b96d26d1
            • Size 10.4MB
            • SHA256 885a32533327f0fd5ea98e6c6f13552e965cab4852dad7ce9ccf3d929d726b5b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steamui_websrc_sounds_all.zip.vz.5ba6acd8f4dfe4b93437895b20344fab5bb3ff96_3714779
            • Path C:\Users\Admin\AppData\Local\Temp\package\steamui_websrc_sounds_all.zip.vz.5ba6acd8f4dfe4b93437895b20344fab5bb3ff96_3714779
            • Size 3.5MB
            • SHA256 ac62e3d0e6213bcbdcfe973c624eda0486977dccdc4098c10b60b62e894ea93b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            strings_all.zip.vz.1518f222a37456b048acfb3d6c3d97865a612666_2079871
            • Path C:\Users\Admin\AppData\Local\Temp\package\strings_all.zip.vz.1518f222a37456b048acfb3d6c3d97865a612666_2079871
            • Size 2.0MB
            • SHA256 da8abc499d1b675f4b303823e85f228a0385b4341ba785ba6fa3b8ea1d4df124
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            strings_en_all.zip.e716a67d7fa91ba70490a6417e25d45c5435e393
            • Path C:\Users\Admin\AppData\Local\Temp\package\strings_en_all.zip.e716a67d7fa91ba70490a6417e25d45c5435e393
            • Size 111KB
            • SHA256 0c56193fac4fa518eaaac0dc66ecd21a3cee510ece85594b6c308f8d31ee98a3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tenfoot_images_all.zip.vz.193cb8c4eb4446698ea2c0a9e8c4e6b6a623dac7_5572671
            • Path C:\Users\Admin\AppData\Local\Temp\package\tenfoot_images_all.zip.vz.193cb8c4eb4446698ea2c0a9e8c4e6b6a623dac7_5572671
            • Size 5.3MB
            • SHA256 e1fee3beffa9d08a415a35ddc7d3141af6c44269c67e67aa0a3eea6e56889bd7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            btnOvrOffTop.tga_
            • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\btnOvrOffTop.tga_
            • Size 444B
            • SHA256 ecd13153d9d438809a38de30f3abbb0f6f92837a7e3cacb442a9a9309bcd78d9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            [email protected]_
            • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
            • Size 15KB
            • SHA256 d3af480fe975487ea4754c88dd56df0d4cfe68633eb9abb2458f42ae3df34479
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            [email protected]_
            • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\[email protected]_
            • Size 92KB
            • SHA256 f200aca23ac6739a6d521298094972383f835d8fcac24b7bdef820181ae8c37a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            icon_button_news.tga_
            • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\icon_button_news.tga_
            • Size 20KB
            • SHA256 42c410136a35b64c7e0a410b1d2fd2e2712782039cd7237615219ea57d7c40fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tabStdTop.tga_
            • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\graphics\tabStdTop.tga_
            • Size 48B
            • SHA256 5caa5fa3e79dcd8ec5ec20256ed7c77efaae77e0ae8d89e4a974c484cb177d84
            • MD5 SHA1 SHA512
            Submit Download

            steam_updating.ico_
            • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_updating.ico_
            • Size 47KB
            • SHA256 5aaca90948de8f7d11264ed608a2f96acba061e6463d337d658b00ed1c552449
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steam_updating_posix.tga_
            • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\public\steam_updating_posix.tga_
            • Size 64KB
            • SHA256 fd2abb8945c06a6b9c5444baf6ea523b52bf7a03a58b34ebe0a6a110630ed5f8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            filter_banned_thai.txt.gz_
            • Path C:\Users\Admin\AppData\Local\Temp\package\tmp\resource\filter_banned_thai.txt.gz_
            • Size 23B
            • SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
            • MD5 SHA1 SHA512
            Submit Download

            steambootstrapper_english.txt
            • Path C:\Users\Admin\AppData\Local\Temp\public\steambootstrapper_english.txt
            • Size 4KB
            • SHA256 fbc09c1b9a55d04b57be8fb2ad5ab58b38f76054ecd3d1b70440a2d08191b05b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            steamui.dll
            • Path C:\Users\Admin\AppData\Local\Temp\steamui.dll
            • Size 18.6MB
            • SHA256 cd9226db4e6c28942df70c22c0475d91fdd62cba5f100baae2d65af57cabb610
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tier0_s64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\tier0_s64.dll
            • Size 867KB
            • SHA256 8559e6bd32eb3fddd95079633272866deb292211ec4f7e69aeb0ec48fdafef72
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            video64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\video64.dll
            • Size 5.1MB
            • SHA256 e84cb3391b4206feb03e1162b0d6815316905034a7ae190c66d0fa7fb00d48ba
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            vstdlib_s64.dll
            • Path C:\Users\Admin\AppData\Local\Temp\vstdlib_s64.dll
            • Size 476KB
            • SHA256 f63f348bb18460b3046db5293a0646af593fc9a21e6a2b1743e7e5074722b564
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1792-6651-0x0000000140000000-0x000000014072F000-memory.dmp
            Download

            memory/1792-22-0x0000000140000000-0x000000014072F000-memory.dmp
            Download

            memory/1792-0-0x0000000140000000-0x000000014072F000-memory.dmp
            Download

            memory/2036-6657-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/2088-6652-0x0000000140000000-0x000000014072F000-memory.dmp
            Download

            memory/2088-6720-0x0000000140000000-0x000000014072F000-memory.dmp
            Download

            memory/2316-1-0x0000000140000000-0x0000000140015000-memory.dmp
            Download

            memory/2316-2-0x0000000140000000-0x0000000140015000-memory.dmp
            Download