Overview

overview

7

Static

static

3

2026-07-10...xz.exe

windows10-2004-x64

2026-07-10...xz.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    5s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/07/2026, 05:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    2026-07-10_b3446e4d148642a5ee1cf4c248b63294_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
  • Size 32.2MB
  • Sample260710-fr1fpadt3p
  • SHA256 9c8780b9c9bb1b4fccde41a8aafecc65a19ae08162c4108bbd02b69218a24928
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-10_b3446e4d148642a5ee1cf4c248b63294_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-10_b3446e4d148642a5ee1cf4c248b63294_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1556
      • C:\Windows\system32\reg.exe
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable
        3⤵
          PID:6488
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:6296
        • C:\Windows\system32\net.exe
          net session
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:7124
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            4⤵
              PID:3860
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4224
          • C:\Windows\system32\tasklist.exe
            tasklist
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4840
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command -
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2420
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x3sz0yn5\x3sz0yn5.cmdline"
            3⤵
              PID:7148
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB53D.tmp" "c:\Users\Admin\AppData\Local\Temp\x3sz0yn5\CSC6901F5C1AFA343A49A457AC5760023.TMP"
                4⤵
                  PID:4248
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List""
              2⤵
                PID:2552
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -NoProfile -Command "Get-CimInstance Win32_ComputerSystem | Select-Object -Property Model, Manufacturer | Format-List"
                  3⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:1560
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "getmac"
                2⤵
                  PID:3460
                  • C:\Windows\system32\getmac.exe
                    getmac
                    3⤵
                      PID:3696
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                    2⤵
                      PID:3220
                      • C:\Windows\system32\tasklist.exe
                        tasklist
                        3⤵
                        • Enumerates processes with tasklist
                        PID:5404
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name""
                      2⤵
                        PID:3888
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController).Name"
                          3⤵
                          • Command and Scripting Interpreter: PowerShell
                          PID:4676
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im svchost.exe"
                        2⤵
                          PID:2620
                          • C:\Windows\system32\taskkill.exe
                            taskkill /f /im svchost.exe
                            3⤵
                            • Kills process with taskkill
                            PID:2876

                      Network

                            MITRE ATT&CK Enterprise v16

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            StartupProfileData-NonInteractive
                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                            • Size 1KB
                            • SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            RESB53D.tmp
                            • Path C:\Users\Admin\AppData\Local\Temp\RESB53D.tmp
                            • Size 1KB
                            • SHA256 c2e39a30254d84ecec5d3a63e20108f4c2b0a75ff6290055da9f76910eb1b802
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            __PSScriptPolicyTest_jkxj0xlw.f2c.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jkxj0xlw.f2c.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            x3sz0yn5.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\x3sz0yn5\x3sz0yn5.dll
                            • Size 3KB
                            • SHA256 66cf74b0acdd2eee9e3d0943e71f8ba3dcfb4dd9c25b5db8c645524e4ffa3575
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            CSC6901F5C1AFA343A49A457AC5760023.TMP
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\x3sz0yn5\CSC6901F5C1AFA343A49A457AC5760023.TMP
                            • Size 652B
                            • SHA256 7c83dcf61f6a7a38dc976c658b4cfaac2fcaee70d0d5745c604e1e1bb5327954
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            x3sz0yn5.0.cs
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\x3sz0yn5\x3sz0yn5.0.cs
                            • Size 420B
                            • SHA256 53cb9811b76702330a10ba42de7799eac897ffa610ec709442af108b4deadbb2
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            x3sz0yn5.cmdline
                            • Path \??\c:\Users\Admin\AppData\Local\Temp\x3sz0yn5\x3sz0yn5.cmdline
                            • Size 369B
                            • SHA256 cc01d16ff45f881aeb4776777b511d5b86c90d2ad559fa5ae2ca7daa8b22e2d0
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            memory/1560-23-0x000001F827120000-0x000001F82713E000-memory.dmp
                            Download

                            memory/1560-24-0x000001F83F490000-0x000001F83F542000-memory.dmp
                            Download

                            memory/1560-25-0x000001F827110000-0x000001F82711A000-memory.dmp
                            Download

                            memory/1560-27-0x000001F83F7A0000-0x000001F83F7C4000-memory.dmp
                            Download

                            memory/1560-26-0x000001F83F7A0000-0x000001F83F7CA000-memory.dmp
                            Download

                            memory/2420-3-0x00000209CB490000-0x00000209CB4B2000-memory.dmp
                            Download

                            memory/2420-17-0x00000209CB530000-0x00000209CB538000-memory.dmp
                            Download

                            memory/2420-4-0x00000209CB900000-0x00000209CB948000-memory.dmp
                            Download

                            memory/4676-34-0x00000198CBEA0000-0x00000198CBF52000-memory.dmp
                            Download