Analysis
- max time kernel
151s - max time network
157s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 19:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
25 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
- Size 40.7MB
- Sample260809-ydmxjsvbpg
- SHA256 e5b062d9c3b72413957b13b29b1482db9c6e54062320a93a3137196ddd669f24
- MD5 9a2d5ba8ba9696c785bb69cdf4b4181a
- SHA1 35841bdf32d255fde420dd69c8ffbbf43c7616af
- SHA512 e405436a96834f964d4390b9916c3643c7dca81aa25266a628b72a5575248ab69144cf1b9a79f04028b8ccfd5de442dbe826aaa3a7baa48be6df8b912946197b
- SSDEEP 49152:zJXVSCM39nmT5ocV1Nxst3ZbypRxG80FfElQ+XwxhxuhSnY53G3SrXJAdrFejntl:zu/9nmHZLxG80DuKA3XAD8ntZfh6fgCu
- TLSH T183974C02F7054AAFE07A9234489B8F61E335D8B146B1937723F55B2C1EEF34C4EA6964
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 7148 JdyERt.exe - Loads dropped DLL 1 IoCs
pid Process 7148 JdyERt.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 4668 2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_9a2d5ba8ba9696c785bb69cdf4b4181a_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4668
-
C:\Users\Public\tbUDm0\JdyERt.exe"C:\Users\Public\tbUDm0\JdyERt.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7148
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Public\tbUDm0\JdyERt.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
- MD5 9ec587911e501b73b7cf09f05d0ae17d
- SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
- SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
- SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
- TLSH T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\tbUDm0\UxEnhance64.dll
- Size 3.1MB
- SHA256 3c655c0f395b14ad8900a9b5b8eced8f4ee6b71104a5014c51071022b0e58e9e
- MD5 2dcaefea0d57388f2a2c8b709a3e29ae
- SHA1 4b42ac9d118c4e57467e6b4f65da5e899828badb
- SHA512 4d2384579398613581b85bf7465f001b8577f132b440f233a9820ab420f0f27b0dd44bb6d4fd8ff7ff16d818633a3871d154a99fce7721e3e5ab78e89ae06bc2
- SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+4:P9m29xx3Tiqt06ox6+z2rNNrKo4
- TLSH T111E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\tbUDm0\UxEnhance64.dll
- Size 1.2MB
- SHA256 fca604c82a8ea503ce82c254fb79f8ed186a0721ac48cbe867fbaa5a5c1571db
- MD5 ec200baef820fa40c99ca5da29ca212f
- SHA1 0d191ab2606b0e6a5602c0d0236f5745c478c1a4
- SHA512 36e1e361392437358076f3540eb9dbaf6ececbf0416f235fc2fb04a291fd83c91e47660735e34b29fe73fbaf22102747df257d3aacef84b7b94baf0832aaa2bd
- SSDEEP 24576:WTa0QKHReqZIMlcseQCIHfrPqxkglC6BKVu/ayHXBTswHCMJU5bmNlKQ3wI:P9KpI8cBa0kj6BK0x3TiMQclkI
- TLSH T1054523B463A339F3E4766AF5FE7193D21C101E207F17908F5743204A5A6D1F683AA3A9
- MD5 SHA1 SHA512 SSDEEP TLSH