Analysis
- max time kernel
150s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 21:43
General
- Target 2026-08-09_be9510495c7cc3357a22f52687ece227_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
- Size 40.7MB
- Sample260809-1k7lmscf34
- SHA256 8ec4df50693c0a9707e126dd2aae0b2fe112a3f1919a9c0debd804893e716d3f
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Indicator Removal: Clear Persistence 1 TTPs 2 IoCs
Clear artifacts associated with previously established persistence like scheduletasks on a host.
- Drops file in System32 directory 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 54 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_be9510495c7cc3357a22f52687ece227_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_be9510495c7cc3357a22f52687ece227_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Public\UFUah9\2DgTMA.exeC:\Users\Public\UFUah9\2DgTMA.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\UFUah9\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
-
C:\Windows\system32\schtasks.exeSCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\UFUah9\" /t REG_DWORD /d 0 /f"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\schtasks.exeSCHTASKS /Run /TN "Task1"3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F2⤵
- Indicator Removal: Clear Persistence
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2DgTMA.exe
UxEnhance64.dll
adoresd.dat
msadox.tb
memory/1656-544-0x0000024B112F0000-0x0000024B11B81000-memory.dmp
memory/1656-541-0x0000024B112F0000-0x0000024B11B81000-memory.dmp
memory/1656-566-0x0000024B112F0000-0x0000024B11B81000-memory.dmp
memory/1656-565-0x0000024B112F0000-0x0000024B11B81000-memory.dmp
memory/1656-556-0x0000024B10900000-0x0000024B1094E000-memory.dmp
memory/1656-531-0x00007FF8EC8D0000-0x00007FF8EC8D2000-memory.dmp
memory/1656-532-0x00007FF8CE810000-0x00007FF8CED2E000-memory.dmp
memory/1656-557-0x0000024B11FF0000-0x0000024B1207A000-memory.dmp
memory/1656-558-0x0000024B11FF0000-0x0000024B1207A000-memory.dmp
memory/1656-537-0x0000024B112F0000-0x0000024B11B81000-memory.dmp
memory/1656-559-0x0000024B11FF0000-0x0000024B1207A000-memory.dmp
memory/1656-560-0x0000024B11FF0000-0x0000024B1207A000-memory.dmp
memory/1656-539-0x00007FF8EC8E0000-0x00007FF8EC8E2000-memory.dmp
memory/1656-546-0x0000024B112F0000-0x0000024B11B81000-memory.dmp
memory/1656-545-0x0000024B112F0000-0x0000024B11B81000-memory.dmp
memory/1656-547-0x0000024B112F0000-0x0000024B11B81000-memory.dmp
memory/1656-551-0x0000024B112F0000-0x0000024B11B81000-memory.dmp
memory/4768-525-0x00000000001E0000-0x00000000001EE000-memory.dmp
memory/4768-0-0x00000000001E0000-0x00000000001EE000-memory.dmp
memory/4768-1-0x00000000001E0000-0x00000000001EE000-memory.dmp
memory/4768-2-0x00000000001F0000-0x00000000001FC000-memory.dmp
memory/4768-504-0x00007FF8DC6D0000-0x00007FF8DC6E0000-memory.dmp
memory/4768-522-0x00007FF8DC6D0000-0x00007FF8DC6E0000-memory.dmp
memory/4768-526-0x00007FF8DC6D0000-0x00007FF8DC6E0000-memory.dmp