Overview

overview

10

Static

static

3

2026-11-12...om.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/11/2026, 02:51

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-12_558ed3e6bdff0abeb4b9739f8553d948_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  • Size 8.3MB
  • Sample261113-db5dlay16n
  • SHA256 b11d5e674c4d4c18240d0f12bbf3571581043753f13625f788019f5021dbcfef
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryxmrigminerpersistenceprivilege_escalationspywarestealerupx

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 1 IoCs
    miner
  • Downloads MZ/PE file 1 IoCs
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory 25 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-12_558ed3e6bdff0abeb4b9739f8553d948_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-12_558ed3e6bdff0abeb4b9739f8553d948_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4572
    • C:\Users\Admin\AppData\Local\Temp\2026-11-12_558ed3e6bdff0abeb4b9739f8553d948_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-11-12_558ed3e6bdff0abeb4b9739f8553d948_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=139.0.6053.38 --initial-client-data=0x2bc,0x2c0,0x2c4,0x2b8,0x2c8,0x7ff6d201bde8,0x7ff6d201bdf8,0x7ff6d201be08
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4708
      • C:\Users\Admin\AppData\Roaming\240823046.tmp
        "C:\Users\Admin\AppData\Roaming\240823046.tmp"
        3⤵
        • Downloads MZ/PE file
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3816
        • C:\Users\Admin\AppData\Local\Temp\eqcwhulf.exe
          "C:\Users\Admin\AppData\Local\Temp\eqcwhulf.exe"
          4⤵
          • Sets service image path in registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Reads the TCP/IP host and domain name from the registry
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4168
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks.exe /Delete /TN "MicrosoftEdgeUpdateTaskMachine39103607" /F
            5⤵
              PID:3856
            • C:\ProgramData\5e31b9edee9c9f9e\E07F8A1239103607\E07F8A1239103607.exe
              "C:\ProgramData\5e31b9edee9c9f9e\E07F8A1239103607\E07F8A1239103607.exe" --host
              5⤵
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • Checks processor information in registry
              PID:2948
    • C:\ProgramData\5e31b9edee9c9f9e\E07F8A1239103607\E07F8A1239103607.exe
      "C:\ProgramData\5e31b9edee9c9f9e\E07F8A1239103607\E07F8A1239103607.exe"
      1⤵
      • Executes dropped EXE
      • Reads the TCP/IP host and domain name from the registry
      PID:2464
    • C:\ProgramData\5e31b9edee9c9f9e\E07F8A1239103607\E07F8A1239103607.exe
      C:\ProgramData\5e31b9edee9c9f9e\E07F8A1239103607\E07F8A1239103607.exe
      1⤵
      • Executes dropped EXE
      PID:2580

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Privilege Escalation

          Boot or Logon Autostart Execution

          2
          T1547

          Registry Run Keys / Startup Folder

          2
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Event Triggered Execution

          1
          T1546

          Component Object Model Hijacking

          1
          T1546.015

          Defense Evasion

          Modify Registry

          2
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Query Registry

          3
          T1012

          System Information Discovery

          2
          T1082

          System Network Configuration Discovery

          1
          T1016

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Web Service

          1
          T1102

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          elevation_service.exe
          • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
          • Size 2.9MB
          • SHA256 347671ccc06ff16fc62b3408289db2e25c191f59246c40ed8e6f551287d7db26
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          maintenanceservice.exe
          • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
          • Size 1017KB
          • SHA256 544db489e82efda3316f7626e92c8576144dff2b950b36c955d0d7516762a271
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OSE.EXE
          • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
          • Size 997KB
          • SHA256 dd691b1bb8edd98bb31508155057c43a9b67d4982ef855f32a7f4cc681cdc6c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
          • Size 6.8MB
          • SHA256 e2a89f2b1b76b55fbf5ffb7e13dfc9ec55f5d642ebd164d45cefbe30f6e2ddbd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          elevation_service.exe
          • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          • Size 3.0MB
          • SHA256 98975d62fd38933875057f06a3f0f2ac2b3f43ac642e9435bf8a4c6a86e76ba0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wmpnetwk.exe
          • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
          • Size 1.7MB
          • SHA256 3a9118b7663d01439f13c46ac8652769011c94c882a7c77cdd7e6ec762f5c411
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          E07F8A1239103607.dll
          • Path C:\ProgramData\5e31b9edee9c9f9e\E07F8A1239103607\E07F8A1239103607.dll
          • Size 3.4MB
          • SHA256 361a4277fb4fd7f7fa02d16de2db5cf8583b510be99a8138b76a005ab3d26080
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          b67950883ebf79cc
          • Path C:\ProgramData\5e31b9edee9c9f9e\b67950883ebf79cc
          • Size 17B
          • SHA256 2bfd88a6d6b2c28bdf323c6552ff4c24f26422168cdb925323c86fe712f61708
          • MD5 SHA1 SHA512
          Submit Download

          eqcwhulf.exe
          • Path C:\Users\Admin\AppData\Local\Temp\eqcwhulf.exe
          • Size 3.9MB
          • SHA256 96c38f706d0dbf6d7c4f63784f326c9119e2ff9cd6d0dd73c086fbebc639b683
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          240823046.tmp
          • Path C:\Users\Admin\AppData\Roaming\240823046.tmp
          • Size 4KB
          • SHA256 51bb056e70a295d38b11e94711505e585989e987726652529c0327b1bb48d4bf
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          886880719b11239b.bin
          • Path C:\Users\Admin\AppData\Roaming\886880719b11239b.bin
          • Size 12KB
          • SHA256 7facec16fb0b867944b71990158ac796b1dc89295b1939a15628c996730f78f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          perfhost.exe
          • Path C:\Windows\SysWOW64\perfhost.exe
          • Size 778KB
          • SHA256 a03a67ca725fac2e9a853d01da5d72e5ccea29194e4ee3a1d4749a15753b4e92
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AgentService.exe
          • Path C:\Windows\System32\AgentService.exe
          • Size 1.9MB
          • SHA256 9387a196b7029c8580b9245f67b0d0f974cea8e1f514a1bcc738436814bc7aa7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Locator.exe
          • Path C:\Windows\System32\Locator.exe
          • Size 767KB
          • SHA256 90cbf434aec2601749707caa46cb7ab84bcf94220fe9498182841326d2a05c49
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ssh-agent.exe
          • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
          • Size 1.1MB
          • SHA256 223baadddafbc071a9096602c0956d31ae41dc64d9f3b0c0de763fabe0dd48b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          PerceptionSimulationService.exe
          • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
          • Size 860KB
          • SHA256 1f721c6ce188d594f1c7a37e62f0328b2ab786b39e7815260e9f90285f95ac94
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SearchIndexer.exe
          • Path C:\Windows\System32\SearchIndexer.exe
          • Size 1.6MB
          • SHA256 7d7c4e6863e5fb80f0d22149ba3a0e059334f65a44a7bcc3f02088a2dd0755e1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SensorDataService.exe
          • Path C:\Windows\System32\SensorDataService.exe
          • Size 1.9MB
          • SHA256 2bde53de76af94246ae490bc73f5a623968ca516abc30f383b2bb572688f68f4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          SgrmBroker.exe
          • Path C:\Windows\System32\SgrmBroker.exe
          • Size 1.0MB
          • SHA256 75749633bf5f47335b683a80edaafb716b11e24c093e0a508948289245fc2f4d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Spectrum.exe
          • Path C:\Windows\System32\Spectrum.exe
          • Size 1.6MB
          • SHA256 0a1b5f46b4b51f51e9d8320ea5b99bc0a5bd5363e7633509791f13aee5bb2b0f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          TieringEngineService.exe
          • Path C:\Windows\System32\TieringEngineService.exe
          • Size 1.0MB
          • SHA256 3b473144926749986fd8e8d65c555a80e68d275d61d5273ffac1672aa90c0b82
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VSSVC.exe
          • Path C:\Windows\System32\VSSVC.exe
          • Size 2.1MB
          • SHA256 ef420197256b3d32162501211f79fc8b8906f95351aa6de252f0234f61d050ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          alg.exe
          • Path C:\Windows\System32\alg.exe
          • Size 850KB
          • SHA256 bf93133f264201f66232246f3589db44d72ac0a0f2120717b9f51243c4fe37aa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msdtc.exe
          • Path C:\Windows\System32\msdtc.exe
          • Size 901KB
          • SHA256 68525b4d01f9e485773df08e0408fc48f25a803966946427f5b1dfc6eecc4904
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          msiexec.exe
          • Path C:\Windows\System32\msiexec.exe
          • Size 824KB
          • SHA256 72ce0ddcc8e0aef144c788f5a659bcf484e464dfb0ebdb6b309607ecf5aa37c9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          snmptrap.exe
          • Path C:\Windows\System32\snmptrap.exe
          • Size 773KB
          • SHA256 67fdb2a7d9968bec0b3fcf75c46536cd921611dff8efc01c6e9c228eaa9ee6f9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vds.exe
          • Path C:\Windows\System32\vds.exe
          • Size 1.4MB
          • SHA256 ad9f87ffe8a783ad7e32b3cc7cc1199d54d8a44a695533e4b7ab1f0e4026243f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WmiApSrv.exe
          • Path C:\Windows\System32\wbem\WmiApSrv.exe
          • Size 961KB
          • SHA256 98187a257aa4409777c033db61f9db1c4cc690eef58a5006a104bf7482adefb3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wbengine.exe
          • Path C:\Windows\System32\wbengine.exe
          • Size 2.3MB
          • SHA256 654f1556a766bdf557307a65fa024eb827f69b7f7a4cef51714c04a44c3a761c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AppVClient.exe
          • Path C:\Windows\system32\AppVClient.exe
          • Size 1.5MB
          • SHA256 ddb352b97d801e67a3c070f277e7ff5e0161e0eff9c5eda9baa7a8fac2d90286
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          DiagnosticsHub.StandardCollector.Service.exe
          • Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
          • Size 848KB
          • SHA256 d7fb38b120c99b747fc397125d4f8f234b720edba6cc54f825cb76d9d327bdb8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          fxssvc.exe
          • Path C:\Windows\system32\fxssvc.exe
          • Size 1.4MB
          • SHA256 96c41c4047a4ae1386018e75fbe5d46af2d60580abb6c4cee5faff9117f0a477
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2948-345-0x00000000017F0000-0x0000000001BFF000-memory.dmp
          Download

          memory/2948-344-0x0000000000C80000-0x0000000000FF2000-memory.dmp
          Download

          memory/2948-353-0x0000000000BB0000-0x0000000000BD0000-memory.dmp
          Download

          memory/2948-355-0x0000000000C80000-0x0000000000FF2000-memory.dmp
          Download

          memory/4168-286-0x0000000140000000-0x0000000140404000-memory.dmp
          Download

          memory/4572-0-0x00000210DA1E0000-0x00000210DA2DD000-memory.dmp
          Download

          memory/4572-20-0x00000210DA3F0000-0x00000210DA473000-memory.dmp
          Download

          memory/4572-3-0x00000210DA3F0000-0x00000210DA473000-memory.dmp
          Download

          memory/4572-1-0x00000210DA3F0000-0x00000210DA473000-memory.dmp
          Download

          memory/4708-12-0x0000024D846B0000-0x0000024D84733000-memory.dmp
          Download

          memory/4708-10-0x0000024D846B0000-0x0000024D84733000-memory.dmp
          Download