Overview

overview

7

Static

static

3

2026-07-09...xz.exe

windows10-2004-x64

2026-07-09...xz.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    5s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 01:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    2026-07-09_b1374c01519d6b35008121fdcf84f00c_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
  • Size 32.7MB
  • Sample260709-cc247acv9w
  • SHA256 5bb363bbf944ba0d6f5e0ad504a35ef650ce92967d26bc69ad547beba7c3f6f9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_b1374c01519d6b35008121fdcf84f00c_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_b1374c01519d6b35008121fdcf84f00c_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:924
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1692
      • C:\Windows\system32\reg.exe
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable
        3⤵
          PID:5248
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4012
        • C:\Windows\system32\net.exe
          net session
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:124
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            4⤵
              PID:240
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3832
          • C:\Windows\system32\tasklist.exe
            tasklist
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4024
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command -
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5744
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fpjtwu5z\fpjtwu5z.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:528
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7BBE.tmp" "c:\Users\Admin\AppData\Local\Temp\fpjtwu5z\CSCFFDBDC249F41459BBD4DC917DB8AB9E2.TMP"
              4⤵
                PID:1060
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List""
            2⤵
              PID:2092
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -NoProfile -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List"
                3⤵
                • Command and Scripting Interpreter: PowerShell
                PID:1140
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "getmac"
              2⤵
                PID:2784
                • C:\Windows\system32\getmac.exe
                  getmac
                  3⤵
                    PID:2668
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                  2⤵
                    PID:4172
                    • C:\Windows\system32\tasklist.exe
                      tasklist
                      3⤵
                      • Enumerates processes with tasklist
                      PID:5028
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name""
                    2⤵
                      PID:4072
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name"
                        3⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:4584
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im svchost.exe"
                      2⤵
                        PID:6104
                        • C:\Windows\system32\taskkill.exe
                          taskkill /f /im svchost.exe
                          3⤵
                          • Kills process with taskkill
                          PID:1384

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 7d5423fab0bc688fe408ae455cf60ad90cd6398b0ebb0c5a535b34f8e429bcb9
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          RES7BBE.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\RES7BBE.tmp
                          • Size 1KB
                          • SHA256 d4300252fe967a1e20d1badb89dc7a24bee05e6815df781c8f1fc803f94bbfb4
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          __PSScriptPolicyTest_bcswsykb.epr.psm1
                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bcswsykb.epr.psm1
                          • Size 60B
                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          fpjtwu5z.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\fpjtwu5z\fpjtwu5z.dll
                          • Size 3KB
                          • SHA256 2ca4e1246617a4b93ef256124f0ee3761eccea0421355920d11c47faf739bf6c
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          CSCFFDBDC249F41459BBD4DC917DB8AB9E2.TMP
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\fpjtwu5z\CSCFFDBDC249F41459BBD4DC917DB8AB9E2.TMP
                          • Size 652B
                          • SHA256 2a91e89158b7cd75c9711098f68830e7050d95edf61379ad8369b6e4eaf06560
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          fpjtwu5z.0.cs
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\fpjtwu5z\fpjtwu5z.0.cs
                          • Size 420B
                          • SHA256 53cb9811b76702330a10ba42de7799eac897ffa610ec709442af108b4deadbb2
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          fpjtwu5z.cmdline
                          • Path \??\c:\Users\Admin\AppData\Local\Temp\fpjtwu5z\fpjtwu5z.cmdline
                          • Size 369B
                          • SHA256 90ca0f332c76d0c0ad5545ad8e8eaf4a15f140d8ec47a644f7d82461f7aa6824
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          memory/1140-23-0x000001604F950000-0x000001604F96E000-memory.dmp
                          Download

                          memory/1140-24-0x000001604FBB0000-0x000001604FC62000-memory.dmp
                          Download

                          memory/1140-25-0x000001604F970000-0x000001604F97A000-memory.dmp
                          Download

                          memory/1140-26-0x000001604FDF0000-0x000001604FE1A000-memory.dmp
                          Download

                          memory/1140-27-0x000001604FDF0000-0x000001604FE14000-memory.dmp
                          Download

                          memory/4584-34-0x000001E87C620000-0x000001E87C6D2000-memory.dmp
                          Download

                          memory/5744-1-0x000001E1D3D50000-0x000001E1D3D72000-memory.dmp
                          Download

                          memory/5744-17-0x000001E1D3DE0000-0x000001E1D3DE8000-memory.dmp
                          Download

                          memory/5744-4-0x000001E1EBEB0000-0x000001E1EBEF8000-memory.dmp
                          Download