Overview

overview

7

Static

static

3

2026-07-10...xz.exe

windows10-2004-x64

2026-07-10...xz.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    6s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 04:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
  • Size 31.7MB
  • Sample260710-e6nj1ac14l
  • SHA256 61189fdf8c4ecbfdd956efbc7dbc6b1da182e006812f6076713e104eed69108f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_1f9d01478d27e2c9cbef318a89790ea9_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:6132
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:7012
      • C:\Windows\system32\reg.exe
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable
        3⤵
          PID:4892
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:7000
        • C:\Windows\system32\net.exe
          net session
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2280
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            4⤵
              PID:4468
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2612
          • C:\Windows\system32\tasklist.exe
            tasklist
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:5612
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command -
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3516
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yor2xvnk\yor2xvnk.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:4172
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4973.tmp" "c:\Users\Admin\AppData\Local\Temp\yor2xvnk\CSC43127E0BB53B4B7A99294779E1F9AF3C.TMP"
              4⤵
                PID:3528
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:5516
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:6664
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "getmac"
            2⤵
              PID:2980
              • C:\Windows\system32\getmac.exe
                getmac
                3⤵
                  PID:6388
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                2⤵
                  PID:7068
                  • C:\Windows\system32\tasklist.exe
                    tasklist
                    3⤵
                    • Enumerates processes with tasklist
                    PID:6580
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name""
                  2⤵
                    PID:5596
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name"
                      3⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:704
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im svchost.exe"
                    2⤵
                      PID:6228
                      • C:\Windows\system32\taskkill.exe
                        taskkill /f /im svchost.exe
                        3⤵
                        • Kills process with taskkill
                        PID:4824

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 4340926393e47ae590060abfee64c85f47fd56e5dfc0875f1c701ddc5f517425
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        RES4973.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\RES4973.tmp
                        • Size 1KB
                        • SHA256 55fe3b6f872bf8ef4765806a7e7d28933cc9038a67a16ec68805f9ddc26c3292
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        __PSScriptPolicyTest_wsydfkvo.tky.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wsydfkvo.tky.ps1
                        • Size 60B
                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        yor2xvnk.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\yor2xvnk\yor2xvnk.dll
                        • Size 3KB
                        • SHA256 bf8012a46435f71d339063c3c8f7fbfcbc1aaf9d912c0a71b046e8e46a9bcc4a
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        CSC43127E0BB53B4B7A99294779E1F9AF3C.TMP
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\yor2xvnk\CSC43127E0BB53B4B7A99294779E1F9AF3C.TMP
                        • Size 652B
                        • SHA256 fddb066e8deb5f7fe0c3ee26d097695e18178a01eeef9ae4bd0ddec915732568
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        yor2xvnk.0.cs
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\yor2xvnk\yor2xvnk.0.cs
                        • Size 420B
                        • SHA256 53cb9811b76702330a10ba42de7799eac897ffa610ec709442af108b4deadbb2
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        yor2xvnk.cmdline
                        • Path \??\c:\Users\Admin\AppData\Local\Temp\yor2xvnk\yor2xvnk.cmdline
                        • Size 369B
                        • SHA256 eb419276ca4a7a48d3dbc6b8818d119a8203ec63fbeeef184411c7804efd3614
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        memory/3516-4-0x000001E6D7B90000-0x000001E6D7BD8000-memory.dmp
                        Download

                        memory/3516-18-0x000001E6D7B40000-0x000001E6D7B48000-memory.dmp
                        Download

                        memory/3516-3-0x000001E6BFAC0000-0x000001E6BFAE2000-memory.dmp
                        Download

                        memory/4172-16-0x000001ED94360000-0x000001ED94D04000-memory.dmp
                        Download

                        memory/6664-25-0x00000178732C0000-0x0000017873372000-memory.dmp
                        Download

                        memory/6664-26-0x0000017873380000-0x000001787338A000-memory.dmp
                        Download

                        memory/6664-27-0x0000017873830000-0x000001787385A000-memory.dmp
                        Download

                        memory/6664-28-0x0000017873830000-0x0000017873854000-memory.dmp
                        Download

                        memory/6664-24-0x00000178732A0000-0x00000178732BE000-memory.dmp
                        Download