59fcc4f993fadcfaa626224bcd6cc3d76f4af80cc28116140e0ba7e625694543

General

Target
2026-06-01_dd6d2ff359ca88312d788d545370d1a0_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe
Size 603KB
Sample260601-rm3wssft7z
SHA256 59fcc4f993fadcfaa626224bcd6cc3d76f4af80cc28116140e0ba7e625694543
MD5 dd6d2ff359ca88312d788d545370d1a0
SHA1 61b26d1ec5890699151aeedcf3fe6003414ad18c
SHA512 810ae1e6f6326fe4536ae2041559c972b91e85df44df38767f907cda6928c3c8c5f9dcba84a2e0de33ef6c1c398dc2cd019586c3ad6de5b15971726f48205656
SSDEEP 12288:88JL/7OPeBvzO5je5hRrvHaplxpBgHop5ouU:nJ77OPeBbO5je1rvHa5pBgHs5
TLSH
T15BD46C55A3D541F4D07BC234CAC25537E2B2BC056670466F03D74E6B6F233A2AF2AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	word.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	word.exe

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
behavioral2/files/0x001d00000002b376-4.dat	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Executes dropped EXE 1 IoCs

pid	Process
4348	word.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-3U1SYT = "\"C:\\ProgramData\\appdata\\word.exe\""	2026-06-01_dd6d2ff359ca88312d788d545370d1a0_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-3U1SYT = "\"C:\\ProgramData\\appdata\\word.exe\""	2026-06-01_dd6d2ff359ca88312d788d545370d1a0_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-3U1SYT = "\"C:\\ProgramData\\appdata\\word.exe\""	word.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-3U1SYT = "\"C:\\ProgramData\\appdata\\word.exe\""	word.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	word.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4348	word.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 4348	728	2026-06-01_dd6d2ff359ca88312d788d545370d1a0_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe	82
PID 4348 wrote to memory of 392	4348	word.exe	84

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	word.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	word.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	word.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-01_dd6d2ff359ca88312d788d545370d1a0_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_dd6d2ff359ca88312d788d545370d1a0_cobalt-strike_coinminer_icedid_njrat_remcos_vidar.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:728
- C:\ProgramData\appdata\word.exe
  "C:\ProgramData\appdata\word.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4348
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\nqsmxkr.vbs"
    3⤵
    PID:392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

registros.dat

Path C:\ProgramData\appdata\registros.dat
Size 184B
SHA256 ffd0010bb82951cc281b7007c2cf8e666cfe343fa8b935eec1e79bc3b4846d4c
MD5 4f77aa8ea4f9fcf872555f78f4d9adae
SHA1 52a348b17e549d6f1efb6e669ad36efea7ae2b04
SHA512 05aec5b4145508347d73f2495f2f2df35098471ac4f434086871b7cb21fe1e21fbdd5d5ac4004b6d996c52d6e36c0ebdff41b09bb757f7f08ba0889d82abe1c2
TLSH
T11FC04C7927D51C2F7AB3E25F54F308277B71BD952238980E51E2034C29F25086181BDF
MD5 SHA1 SHA512 TLSH

Submit Download

word.exe

Path C:\ProgramData\appdata\word.exe
Size 603KB
SHA256 59fcc4f993fadcfaa626224bcd6cc3d76f4af80cc28116140e0ba7e625694543
MD5 dd6d2ff359ca88312d788d545370d1a0
SHA1 61b26d1ec5890699151aeedcf3fe6003414ad18c
SHA512 810ae1e6f6326fe4536ae2041559c972b91e85df44df38767f907cda6928c3c8c5f9dcba84a2e0de33ef6c1c398dc2cd019586c3ad6de5b15971726f48205656
SSDEEP 12288:88JL/7OPeBvzO5je5hRrvHaplxpBgHop5ouU:nJ77OPeBbO5je1rvHa5pBgHs5
TLSH
T15BD46C55A3D541F4D07BC234CAC25537E2B2BC056670466F03D74E6B6F233A2AF2AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nqsmxkr.vbs

Path C:\Users\Admin\AppData\Local\Temp\nqsmxkr.vbs
Size 528B
SHA256 5590f6f01377e80a72bfe8f6a9f0fbe305ad946d2d31315ef7018c3ef5c33ff7
MD5 6aa79c4a7501c51e275bb350f220dd30
SHA1 1da66bb7b3aa94d90830b15f15c8bb1318a851bb
SHA512 5227beb15b3e7f4ac9564129340dc2f0fbf941d77469dae00d9ee555bb28df83be00d21eb3e2f3aab720d48d22a4db6a2ed405146e7e35cdb2416d8b5845f02e
TLSH
T1F1F030226BF9112CB3F3AA913E7568540D3EF534E926D2AD8494098D08B1A14CE32B67
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads