Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/11/2026, 04:22
General
- Target 2026-11-12_438bc2bca0cda120b20e55a91f5488e4_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
- Size 18.3MB
- Sample261113-ezjbpsfv8s
- SHA256 69ec5739276987c0472b888783613c61bacf2d1d7c8fd818e3f7d5db484c8074
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 7 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Cryptocurrency Miner
Makes network request to known mining pool URL.
- Executes a file named after a Windows system binary 1 TTPs 2 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
- Executes dropped EXE 4 IoCs
- Power Settings 1 TTPs 2 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Embeds OpenSSL 1 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 27 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-12_438bc2bca0cda120b20e55a91f5488e4_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-12_438bc2bca0cda120b20e55a91f5488e4_cactus_coinminer_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe"1⤵
- Executes a file named after a Windows system binary
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c s^ch^ta^sks /C^re^ate /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe" /SC ONLOGON /RL HIGHEST2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe" /SC ONLOGON /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe"C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe"2⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c s^ch^ta^sks /C^re^ate /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe" /SC ONLOGON /RL HIGHEST3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /TN "Windows Host Process" /TR "C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe" /SC ONLOGON /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsHost'"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsHost'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c3⤵
- Power Settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c4⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe"C:\Users\Admin\AppData\Roaming\WindowsHost\svchost32.exe" --config="C:\Users\Admin\AppData\Roaming\WindowsHost\config.json"3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Roaming\WindowsHost\sys_net.exe"C:\Users\Admin\AppData\Roaming\WindowsHost\sys_net.exe" -f "C:\Users\Admin\AppData\Roaming\WindowsHost\net.cfg"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exeC:\Users\Admin\AppData\Roaming\WindowsHost\taskhostw.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_mmsfdc42.4tb.psm1
config.json
net.cfg
cached-certs.tmp
cached-microdescs.new
state
unverified-microdesc-consensus
svchost32.exe
sys_net.exe
taskhostw.exe
memory/3204-75-0x00007FF7CB340000-0x00007FF7CC49C000-memory.dmp
memory/3868-89-0x00000217A3CC0000-0x00000217A3CE0000-memory.dmp
memory/4600-74-0x00007FF67FFE0000-0x00007FF68113C000-memory.dmp
memory/4924-109-0x000001AEAC4F0000-0x000001AEAC4FA000-memory.dmp
memory/4924-107-0x000001AEAC4D0000-0x000001AEAC4EE000-memory.dmp
memory/4924-108-0x000001AEAC540000-0x000001AEAC5F2000-memory.dmp
memory/4924-97-0x000001AE93FD0000-0x000001AE93FF2000-memory.dmp
memory/5544-122-0x00007FF7CB340000-0x00007FF7CC49C000-memory.dmp