Overview

overview

7

Static

static

3

2026-07-09...xz.exe

windows10-2004-x64

2026-07-09...xz.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    6s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 02:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    2026-07-09_853f312ef2922030f84fb47c8fa3d7e8_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
  • Size 31.6MB
  • Sample260709-chvx3abx2r
  • SHA256 e957eb7d532d0dc0cecdd4ca6ba50dd67d12e4cdb3e4dc9b60a4c4ec5e09f001
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_853f312ef2922030f84fb47c8fa3d7e8_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_853f312ef2922030f84fb47c8fa3d7e8_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5816
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4440
      • C:\Windows\system32\reg.exe
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable
        3⤵
          PID:3052
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1412
        • C:\Windows\system32\net.exe
          net session
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1736
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            4⤵
              PID:4116
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2360
          • C:\Windows\system32\tasklist.exe
            tasklist
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1920
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command -
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3928
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r3qof0gq\r3qof0gq.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4192
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3CE0.tmp" "c:\Users\Admin\AppData\Local\Temp\r3qof0gq\CSC3C399D4E56B94E92B1F2455B5F69E33.TMP"
              4⤵
                PID:2120
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5528
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3444
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "getmac"
            2⤵
              PID:4160
              • C:\Windows\system32\getmac.exe
                getmac
                3⤵
                  PID:3644
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                2⤵
                  PID:2708
                  • C:\Windows\system32\tasklist.exe
                    tasklist
                    3⤵
                    • Enumerates processes with tasklist
                    PID:3228
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name""
                  2⤵
                    PID:248
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name"
                      3⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:2428
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im svchost.exe"
                    2⤵
                      PID:4400
                      • C:\Windows\system32\taskkill.exe
                        taskkill /f /im svchost.exe
                        3⤵
                        • Kills process with taskkill
                        PID:2224

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 7d5423fab0bc688fe408ae455cf60ad90cd6398b0ebb0c5a535b34f8e429bcb9
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        RES3CE0.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\RES3CE0.tmp
                        • Size 1KB
                        • SHA256 9add189cbb41c3c72c2a73bc5db7828273582eb4797036f9d6a2d3b30ed8e5b1
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        __PSScriptPolicyTest_jvuezil4.3cv.psm1
                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jvuezil4.3cv.psm1
                        • Size 60B
                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        r3qof0gq.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\r3qof0gq\r3qof0gq.dll
                        • Size 3KB
                        • SHA256 5f2d9d1a902360d8ea9f37e9868746c1fdc9e0754167ba3abfa4f6c902680eff
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        CSC3C399D4E56B94E92B1F2455B5F69E33.TMP
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\r3qof0gq\CSC3C399D4E56B94E92B1F2455B5F69E33.TMP
                        • Size 652B
                        • SHA256 740fc78b8e8a0baf780b5249e339f957106d6c756ae670ed4ac7b7eddfffd271
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        r3qof0gq.0.cs
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\r3qof0gq\r3qof0gq.0.cs
                        • Size 420B
                        • SHA256 53cb9811b76702330a10ba42de7799eac897ffa610ec709442af108b4deadbb2
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        r3qof0gq.cmdline
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\r3qof0gq\r3qof0gq.cmdline
                        • Size 369B
                        • SHA256 8148083216f4d38085d41466c397de13ea75f32c9c8fa4148b5800d05289498f
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        memory/2428-34-0x0000020326070000-0x0000020326122000-memory.dmp
                        Download

                        memory/3444-23-0x0000021BBD590000-0x0000021BBD5AE000-memory.dmp
                        Download

                        memory/3444-24-0x0000021BD5BB0000-0x0000021BD5C62000-memory.dmp
                        Download

                        memory/3444-25-0x0000021BBD5B0000-0x0000021BBD5BA000-memory.dmp
                        Download

                        memory/3444-26-0x0000021BD6100000-0x0000021BD612A000-memory.dmp
                        Download

                        memory/3444-27-0x0000021BD6100000-0x0000021BD6124000-memory.dmp
                        Download

                        memory/3928-3-0x0000015BB7F80000-0x0000015BB7FA2000-memory.dmp
                        Download

                        memory/3928-17-0x0000015BD01B0000-0x0000015BD01B8000-memory.dmp
                        Download

                        memory/3928-4-0x0000015BD0560000-0x0000015BD05A8000-memory.dmp
                        Download