Overview

overview

10

Static

static

10

2026-06-04...ar.exe

windows10-2004-x64

9

2026-06-04...ar.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    98s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 11:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-04_43c54797aa018d347dd74902a1173091_cobalt-strike_coinminer_glassworm_hijackloader_vidar.exe
  • Size 20.2MB
  • Sample260604-nt8h3sdv4x
  • SHA256 393d94f6dd3325d6cb3a768bd47dbf69bfa5c5379d9fc8608309cdd07e23a290
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10

Malware Config

Signatures

  • Custom signature
    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 4 IoCs
  • Custom signature
    Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
  • Loads dropped DLL 14 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_43c54797aa018d347dd74902a1173091_cobalt-strike_coinminer_glassworm_hijackloader_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_43c54797aa018d347dd74902a1173091_cobalt-strike_coinminer_glassworm_hijackloader_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Users\Admin\AppData\Local\Temp\2026-06-04_43c54797aa018d347dd74902a1173091_cobalt-strike_coinminer_glassworm_hijackloader_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-06-04_43c54797aa018d347dd74902a1173091_cobalt-strike_coinminer_glassworm_hijackloader_vidar.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1568
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
          PID:4764

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          _raw_aes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_2040_526437_ea5NgFTndq4\Crypto\Cipher\_raw_aes.pyd
          • Size 34KB
          • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _raw_aesni.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_2040_526437_ea5NgFTndq4\Crypto\Cipher\_raw_aesni.pyd
          • Size 15KB
          • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cpuid_c.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_2040_526437_ea5NgFTndq4\Crypto\Util\_cpuid_c.pyd
          • Size 10KB
          • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_2040_526437_ea5NgFTndq4\VCRUNTIME140.dll
          • Size 96KB
          • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_2040_526437_ea5NgFTndq4\VCRUNTIME140_1.dll
          • Size 37KB
          • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_2040_526437_ea5NgFTndq4\_bz2.pyd
          • Size 81KB
          • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_2040_526437_ea5NgFTndq4\_ctypes.pyd
          • Size 120KB
          • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_2040_526437_ea5NgFTndq4\_lzma.pyd
          • Size 154KB
          • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_2040_526437_ea5NgFTndq4\libffi-8.dll
          • Size 34KB
          • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          main.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_2040_526437_ea5NgFTndq4\main.dll
          • Size 7.9MB
          • SHA256 8f5eb8d8b8f49ad7551ab39fcee96fe346ab3d131063c0003b6cd3aae46eec59
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_2040_526437_ea5NgFTndq4\python311.dll
          • Size 5.5MB
          • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pywintypes311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_2040_526437_ea5NgFTndq4\pywintypes311.dll
          • Size 132KB
          • SHA256 f33290cafcf91b6bd5b12b808198cbf816b68529e00e1b3563f63916529a0657
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32crypt.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_2040_526437_ea5NgFTndq4\win32crypt.pyd
          • Size 120KB
          • SHA256 fc5a93faa4b353a5e11efad460b6e552efeb040a8e44eca64d8d49bff655fdb6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/1568-69-0x00007FF8B8E50000-0x00007FF8B9647000-memory.dmp
          Download

          memory/1568-68-0x00007FF784D00000-0x00007FF78615D000-memory.dmp
          Download

          memory/2040-67-0x00007FF784D00000-0x00007FF78615D000-memory.dmp
          Download