Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 15:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-04_6364d0e9c890ad91fcc5425d87532f48_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_6364d0e9c890ad91fcc5425d87532f48_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Resource
win11ltsc2024-20260709-en
1 signatures
150 seconds
General
- Target 2026-08-04_6364d0e9c890ad91fcc5425d87532f48_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
- Size 95.1MB
- Sample260804-s1x35stdjf
- SHA256 0c0faf79ccf98c37f1c8a49ce0126f7d325b569f65aec1fb1c92d0ae31cb0b81
- MD5 6364d0e9c890ad91fcc5425d87532f48
- SHA1 9c003e36faea91cdfdc79b0a4cfb22237fefa0cf
- SHA512 6608f4a3a3768b2c7d92f8db09eeb5248b8e0899c0cd4598409268d10e089175ac28d9c903c92000fda68b794ffd21ff5bb8a953c9f99c46324b94f67eb86da5
- SSDEEP 393216:e3pr0gjHmFbXCDG/E+3xYeVQNCdejDj2JbIqkuQsFoHpeiKARQlt2zMpzZmPXmtB:eSAFTJrgY+trNPulBQqRJ27
- TLSH T11B286B4267EA0585F9F7DA358AF64617C673BC466B3086CF214C0B2A1F736E08D76B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 3520 2026-08-04_6364d0e9c890ad91fcc5425d87532f48_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe 3520 2026-08-04_6364d0e9c890ad91fcc5425d87532f48_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe 3520 2026-08-04_6364d0e9c890ad91fcc5425d87532f48_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe 3520 2026-08-04_6364d0e9c890ad91fcc5425d87532f48_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe 3520 2026-08-04_6364d0e9c890ad91fcc5425d87532f48_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_6364d0e9c890ad91fcc5425d87532f48_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_6364d0e9c890ad91fcc5425d87532f48_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe"1⤵
- Loads dropped DLL
PID:3520
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MS_Core_3520\api-ms-win-core-_primn.node
- Size 134KB
- SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
- MD5 5dc8861862329b3b4122314922be3ed9
- SHA1 ee8599e12c97574ccd6520d86a4734e579b21d50
- SHA512 13c1b757078d7ce6169b2ccbaf7bcbb71447141d7e8c05238f8bade0b12ea69c922b78ed6e539e156bb2c36171d181238fc5a5fe1061d0f49746462521b64d65
- SSDEEP 3072:mje5LsMWK9BLP5oOB92Kmnf/DDN3yFQ+7j65nu:mjeFbWK7j5VBKnfrDwjInu
- TLSH T12AD34B4BB7A500BBE077C27984A74A01E772B85557619BDF03A0436A2F237D1DD3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MS_Core_3520\api-ms-win-core-ffi_na.node
- Size 588KB
- SHA256 b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3
- MD5 d1f6e50334a50a3f1f8e35e02d788ad9
- SHA1 1eab95b23d8ef82bb3171ed751eb14e178cb88d2
- SHA512 9f40996f4a8a5c6fe17687162306a02a5292ffb82bf62a0a7afa4af8f4f52f6d44bff34b8e14cf936ea9c51780603cfaa0a9ce84935a7b509892e51be18b2c03
- SSDEEP 12288:SIAsJ4jRp/N37hbzMqG7WtBNRjaDepQCKKO:UsJ4jRtN37hbzMqG7Wp4DepQA
- TLSH T1F4D46C6637A412A6D17BD23DCA934B29EA723811473196CF029453AF1F13BE85B3F721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MS_Core_3520\api-ms-win-core-koffi_.node
- Size 2.3MB
- SHA256 a6caa84c1f8c459215a783318b818d3fa1b260d2d821c22c22864cd2af216490
- MD5 ebe3666be392b02383d411e846317b76
- SHA1 69a87af1f3e7175ef6f681f419d0d18f35038195
- SHA512 b473fd70c1b874a8b400283110de077dde62cd3bc5dc7a50334f1b62b3c1d5e07e8a3aee63db14b12aa5f7c3ff495cf21411ff61c6433462698eec743c9a1ff4
- SSDEEP 24576:QIURRJEkuyU3d7pJP2JJ4Gvop6geUTnefOE:QIURJETyUN7ph2JKwFJ
- TLSH T125B5DE064758C8E9D83EB072B4176776E56A221B083D62DF04F48D61082ABFD5DAFFC9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MS_Core_3520\api-ms-win-core-ref_na.node
- Size 579KB
- SHA256 837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843
- MD5 153a5d422243f7f95721f6c2c5de8c9d
- SHA1 b0f73501859500acd1eccbff3d790abb610511ef
- SHA512 d078e20939b7bb1f77b003200359aaad2c1405a9193a1df56786cc2f9ae58cd7fec2b0825740c3b107003f797bcb86784e12704fd4625ca11637a41955ed40cf
- SSDEEP 12288:+TpqaSnbD8MFDqKKPirxk8nkg6LZ/eZGi48rVk:USnbD8MBqKKPirxk8nkg6LZAGi48rW
- TLSH T1A0C47C6A37A811A6D17BD13DCA874B19D97234119731A6CF029453AF0F23BF86B3B721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MS_Core_3520\api-ms-win-core-sqlite.node
- Size 1.8MB
- SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
- MD5 66a65322c9d362a23cf3d3f7735d5430
- SHA1 ed59f3e4b0b16b759b866ef7293d26a1512b952e
- SHA512 0a44d12852fc4c74658a49f886c4bc7c715c48a7cb5a3dcf40c9f1d305ca991dd2c2cb3d0b5fd070b307a8f331938c5213188cbb2d27d47737cc1c4f34a1ea21
- SSDEEP 49152:lVtIA1xRrGLYLn9M+BMPPivsICK9rzoNEqt:7tH4X3inMZt
- TLSH T12B958D4BA2B400FDC1ABC179891B5A0BE7B27405177497DF15E08A696F23FE356BE320
- MD5 SHA1 SHA512 SSDEEP TLSH