Analysis
- max time kernel
149s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 23:15
General
- Target 2026-08-04_2797340c2e321fd4c258bc692d6c8720_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe
- Size 55.2MB
- Sample260804-28p7yazzbw
- SHA256 052a321ffdf7be9f12d53fec10cbb422e739b478aacfd03c238640d6a8d1cd6c
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_2797340c2e321fd4c258bc692d6c8720_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_2797340c2e321fd4c258bc692d6c8720_cobalt-strike_coinminer_dosia_glassworm_icedid_njrat_quasar-rat_vidar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Public\9D4bwb\nFHa0E.exe"C:\Users\Public\9D4bwb\nFHa0E.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
UxEnhance64.dll
adoresd.dat
msadox.tb
nFHa0E.exe
memory/3792-539-0x00007FFB3BFE0000-0x00007FFB3BFE2000-memory.dmp
memory/3792-531-0x00007FFB3BFD0000-0x00007FFB3BFD2000-memory.dmp
memory/3792-532-0x00007FFB196D0000-0x00007FFB19BEE000-memory.dmp
memory/3792-537-0x0000028F89710000-0x0000028F89FA1000-memory.dmp
memory/3792-544-0x0000028F89710000-0x0000028F89FA1000-memory.dmp
memory/3792-540-0x0000028F89710000-0x0000028F89FA1000-memory.dmp
memory/3792-545-0x0000028F89710000-0x0000028F89FA1000-memory.dmp
memory/3792-547-0x0000028F89710000-0x0000028F89FA1000-memory.dmp
memory/4316-526-0x00007FFB2BF00000-0x00007FFB2BF12000-memory.dmp
memory/4316-525-0x00000000004D0000-0x00000000004DD000-memory.dmp
memory/4316-503-0x00007FFB2BF00000-0x00007FFB2BF12000-memory.dmp
memory/4316-1-0x00000000004E0000-0x00000000004EB000-memory.dmp
memory/4316-0-0x00000000004D0000-0x00000000004DD000-memory.dmp