Overview

overview

10

Static

static

10

2026-08-04...xz.exe

windows10-2004-x64

7

2026-08-04...xz.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 16:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
  • Size 95.0MB
  • Sample260804-thp59athkf
  • SHA256 e26e3191735b4def623a6e720a232abf195b71f0644e6be5ebb0a1eaa6285cad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to get system information.

    execution
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Executes a command shell one-liner 1 TTPs 5 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_40ad7664a00d63db4247ce564a8b9e26_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:560
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "getmac"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3776
      • C:\Windows\system32\getmac.exe
        getmac
        3⤵
          PID:4084
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4172
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Manufacturer"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3084
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Version""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4940
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_BIOS | Select-Object -ExpandProperty Version"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:336
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model""
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3812
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -ClassName Win32_DiskDrive | Select-Object -ExpandProperty Model"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:368
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3636
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Discovers running processes
          PID:2556

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 3KB
          • SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 8e43bf6dd0a1dd424f4d2345ac6369d53513a3e028c107e59f313e97147bc740
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 188a2933fa48fb3041209cfe8f1f131539b261702907b532dc9c2c7a05dd6547
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          api-ms-win-core-_primn.node
          • Path C:\Users\Admin\AppData\Local\Temp\MS_Core_560\api-ms-win-core-_primn.node
          • Size 134KB
          • SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          api-ms-win-core-ffi_na.node
          • Path C:\Users\Admin\AppData\Local\Temp\MS_Core_560\api-ms-win-core-ffi_na.node
          • Size 588KB
          • SHA256 b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          api-ms-win-core-koffi_.node
          • Path C:\Users\Admin\AppData\Local\Temp\MS_Core_560\api-ms-win-core-koffi_.node
          • Size 2.3MB
          • SHA256 a6caa84c1f8c459215a783318b818d3fa1b260d2d821c22c22864cd2af216490
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          api-ms-win-core-ref_na.node
          • Path C:\Users\Admin\AppData\Local\Temp\MS_Core_560\api-ms-win-core-ref_na.node
          • Size 579KB
          • SHA256 837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          api-ms-win-core-sqlite.node
          • Path C:\Users\Admin\AppData\Local\Temp\MS_Core_560\api-ms-win-core-sqlite.node
          • Size 1.8MB
          • SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          __PSScriptPolicyTest_32l42jvk.5kp.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_32l42jvk.5kp.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          memory/3084-33-0x00000242CF740000-0x00000242CF762000-memory.dmp
          Download

          memory/3084-38-0x00000242E7E00000-0x00000242E801C000-memory.dmp
          Download

          memory/3084-35-0x00000242E7C90000-0x00000242E7CB4000-memory.dmp
          Download

          memory/3084-34-0x00000242E7C90000-0x00000242E7CBA000-memory.dmp
          Download