Overview

overview

7

Static

static

3

2026-07-10...xz.exe

windows10-2004-x64

2026-07-10...xz.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    7s
  • max time network
    22s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/07/2026, 05:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    2026-07-10_b3446e4d148642a5ee1cf4c248b63294_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
  • Size 32.2MB
  • Sample260710-fr1fpadt3p
  • SHA256 9c8780b9c9bb1b4fccde41a8aafecc65a19ae08162c4108bbd02b69218a24928
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_b3446e4d148642a5ee1cf4c248b63294_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_b3446e4d148642a5ee1cf4c248b63294_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe"
    1⤵
    • Checks computer location settings
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4508
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Windows\system32\reg.exe
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable
        3⤵
          PID:1836
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2108
        • C:\Windows\system32\net.exe
          net session
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4240
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            4⤵
              PID:4944
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1420
          • C:\Windows\system32\tasklist.exe
            tasklist
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1796
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command -
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4740
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bwlv4is2\bwlv4is2.cmdline"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:3864
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6481.tmp" "c:\Users\Admin\AppData\Local\Temp\bwlv4is2\CSCAA01EC65239E4655BC31FAD1CECEE10.TMP"
              4⤵
                PID:1224
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List""
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1724
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4032
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "getmac"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1584
            • C:\Windows\system32\getmac.exe
              getmac
              3⤵
                PID:3268
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "tasklist"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3324
              • C:\Windows\system32\tasklist.exe
                tasklist
                3⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:3588
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name""
              2⤵
                PID:4356
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:860
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im svchost.exe"
                2⤵
                  PID:2508
                  • C:\Windows\system32\taskkill.exe
                    taskkill /f /im svchost.exe
                    3⤵
                    • Kills process with taskkill
                    PID:444

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    powershell.exe.log
                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                    • Size 3KB
                    • SHA256 36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 d77340272e0eba10eb07a236c51c18b604ae97bda829143e532b32db28fa3dd0
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    RES6481.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\RES6481.tmp
                    • Size 1KB
                    • SHA256 6d3a77d6a38e732ca4bce4a57d2ce117b066d14814167f021e489bf665e2916b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    __PSScriptPolicyTest_in0s5tlj.cs3.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_in0s5tlj.cs3.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    bwlv4is2.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\bwlv4is2\bwlv4is2.dll
                    • Size 3KB
                    • SHA256 c8a2f60f9ff4b913807bcdcc509d09af363ac691d422545a8e4eff17230fd768
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    CSCAA01EC65239E4655BC31FAD1CECEE10.TMP
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\bwlv4is2\CSCAA01EC65239E4655BC31FAD1CECEE10.TMP
                    • Size 652B
                    • SHA256 90b63022b3e4f0f34676a7335e2cbe06747c9e66cf7d446c93be600b5d89d9b9
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    bwlv4is2.0.cs
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\bwlv4is2\bwlv4is2.0.cs
                    • Size 420B
                    • SHA256 53cb9811b76702330a10ba42de7799eac897ffa610ec709442af108b4deadbb2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    bwlv4is2.cmdline
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\bwlv4is2\bwlv4is2.cmdline
                    • Size 369B
                    • SHA256 eb372ab52e6f2a3435dbb8c5a4f08d2ed4141204806f40a052fddc395659bd53
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/860-62-0x000001E635AD0000-0x000001E635B85000-memory.dmp
                    Download

                    memory/860-64-0x000001E6356A0000-0x000001E6357EE000-memory.dmp
                    Download

                    memory/4032-41-0x000001A356E70000-0x000001A356E8C000-memory.dmp
                    Download

                    memory/4032-42-0x000001A356E90000-0x000001A356F45000-memory.dmp
                    Download

                    memory/4032-43-0x000001A356F50000-0x000001A356F5A000-memory.dmp
                    Download

                    memory/4032-44-0x000001A356F90000-0x000001A356FBA000-memory.dmp
                    Download

                    memory/4032-45-0x000001A356F90000-0x000001A356FB4000-memory.dmp
                    Download

                    memory/4740-1-0x00000197B2CA0000-0x00000197B2CC2000-memory.dmp
                    Download

                    memory/4740-23-0x00000197B2E20000-0x00000197B2E28000-memory.dmp
                    Download

                    memory/4740-10-0x00000197CC200000-0x00000197CC276000-memory.dmp
                    Download

                    memory/4740-9-0x00000197CBDA0000-0x00000197CBDE4000-memory.dmp
                    Download