Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 17:10
General
- Target 2026-05-11_f1f88f3ebe19f22ab37d27a5c87e16ce_cobalt-strike_glassworm_icedid_njrat_remcos_vidar.exe
- Size 3.1MB
- Sample260511-vppczaay4l
- SHA256 c6534876e33f47fb83c921e73fcd2169af9c8aa678e556dfbbc98b0ce4762673
Malware Config
Signatures
- Family: MetaQuotes
MetaQuotes is a Windows adware family.
- Detects MetaQuotes adware 1 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Program Files directory 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_f1f88f3ebe19f22ab37d27a5c87e16ce_cobalt-strike_glassworm_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_f1f88f3ebe19f22ab37d27a5c87e16ce_cobalt-strike_glassworm_icedid_njrat_remcos_vidar.exe"1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Enumerates system info in registry
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4716-0-0x0000000000D50000-0x0000000001098000-memory.dmp
memory/4716-1-0x0000000000A00000-0x0000000000ABE000-memory.dmp
memory/4716-4-0x0000000000CF0000-0x0000000000D17000-memory.dmp
memory/4716-6-0x0000000000D20000-0x0000000000D4B000-memory.dmp
memory/4716-5-0x0000000001520000-0x0000000001676000-memory.dmp
memory/4716-3-0x0000000001470000-0x000000000151C000-memory.dmp
memory/4716-2-0x00000000010A0000-0x0000000001369000-memory.dmp
memory/4716-8-0x00000000017E0000-0x00000000018AD000-memory.dmp
memory/4716-7-0x00000000016B0000-0x00000000017DA000-memory.dmp
memory/4716-12-0x0000000002200000-0x0000000002260000-memory.dmp
memory/4716-10-0x0000000001FF0000-0x0000000002045000-memory.dmp
memory/4716-9-0x00000000018B0000-0x0000000001FEF000-memory.dmp
memory/4716-15-0x0000000002570000-0x0000000002754000-memory.dmp
memory/4716-24-0x0000000002C80000-0x0000000002CA2000-memory.dmp
memory/4716-25-0x0000000002CB0000-0x0000000002DBB000-memory.dmp
memory/4716-31-0x0000000004B70000-0x0000000004B82000-memory.dmp
memory/4716-38-0x0000000005DE0000-0x0000000005DF9000-memory.dmp
memory/4716-45-0x00000000064E0000-0x00000000065F5000-memory.dmp
memory/4716-44-0x0000000005C80000-0x0000000005C8A000-memory.dmp
memory/4716-43-0x0000000005970000-0x0000000005978000-memory.dmp
memory/4716-42-0x0000000005D20000-0x0000000005D5B000-memory.dmp
memory/4716-41-0x0000000006310000-0x00000000063DC000-memory.dmp
memory/4716-40-0x0000000005CB0000-0x0000000005D1A000-memory.dmp
memory/4716-39-0x00000000058C0000-0x000000000595E000-memory.dmp
memory/4716-37-0x0000000005800000-0x00000000058A9000-memory.dmp
memory/4716-36-0x0000000005760000-0x00000000057E3000-memory.dmp
memory/4716-32-0x0000000004B90000-0x0000000005320000-memory.dmp
memory/4716-30-0x0000000003270000-0x00000000032A0000-memory.dmp
memory/4716-29-0x00000000031F0000-0x0000000003221000-memory.dmp
memory/4716-28-0x00000000031C0000-0x00000000031EC000-memory.dmp
memory/4716-27-0x0000000003120000-0x00000000031BD000-memory.dmp
memory/4716-35-0x0000000005740000-0x0000000005752000-memory.dmp
memory/4716-34-0x0000000005350000-0x00000000053FD000-memory.dmp
memory/4716-33-0x0000000005320000-0x000000000534C000-memory.dmp
memory/4716-16-0x0000000002760000-0x0000000002909000-memory.dmp
memory/4716-26-0x0000000002DC0000-0x0000000003115000-memory.dmp
memory/4716-23-0x0000000002B80000-0x0000000002C80000-memory.dmp
memory/4716-22-0x0000000002A50000-0x0000000002B7A000-memory.dmp
memory/4716-21-0x00000000029B0000-0x0000000002A4B000-memory.dmp
memory/4716-20-0x0000000002910000-0x00000000029AE000-memory.dmp
memory/4716-19-0x0000000000B90000-0x0000000000B9A000-memory.dmp
memory/4716-18-0x00000000007F0000-0x00000000007FC000-memory.dmp
memory/4716-17-0x00000000007B0000-0x00000000007B7000-memory.dmp
memory/4716-14-0x00000000022D0000-0x000000000256A000-memory.dmp
memory/4716-11-0x0000000002050000-0x00000000021F1000-memory.dmp
memory/4716-13-0x0000000002260000-0x00000000022CB000-memory.dmp