Overview

overview

10

Static

static

3

2026-09-07...ar.exe

windows10-2004-x64

10

2026-09-07...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    144s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/09/2026, 05:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-07_d13a94473cda23fdddd58296473cfeba_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
  • Size 25.4MB
  • Sample260908-fxfcpssbre
  • SHA256 ba0de77d5290113f7abc57eca76a9ff2d7a2936f58fee28a6cfa6430b3875ab2
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Drops file in System32 directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-07_d13a94473cda23fdddd58296473cfeba_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-07_d13a94473cda23fdddd58296473cfeba_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:6116
  • C:\Users\Public\sCp853\k2UcUM.exe
    "C:\Users\Public\sCp853\k2UcUM.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:4648
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:3932
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\sCp853\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
      2⤵
      • Indicator Removal: Clear Persistence
      PID:5800
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\sCp853\" /t REG_DWORD /d 0 /f"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4124
      • C:\Windows\system32\schtasks.exe
        SCHTASKS /Run /TN "Task1"
        3⤵
          PID:4544
        • C:\Windows\system32\schtasks.exe
          SCHTASKS /Delete /TN "Task1" /F
          3⤵
            PID:5276
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
          2⤵
          • Indicator Removal: Clear Persistence
          PID:248
          • C:\Windows\system32\schtasks.exe
            SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3192
          • C:\Windows\system32\schtasks.exe
            SCHTASKS /Run /TN "Task1"
            3⤵
              PID:6540
            • C:\Windows\system32\schtasks.exe
              SCHTASKS /Delete /TN "Task1" /F
              3⤵
                PID:1612
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
              2⤵
              • Indicator Removal: Clear Persistence
              PID:4696
              • C:\Windows\system32\schtasks.exe
                SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:1244
              • C:\Windows\system32\schtasks.exe
                SCHTASKS /Run /TN "Task1"
                3⤵
                  PID:6744
                • C:\Windows\system32\schtasks.exe
                  SCHTASKS /Delete /TN "Task1" /F
                  3⤵
                    PID:4968
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
                  2⤵
                  • Indicator Removal: Clear Persistence
                  PID:5208
                  • C:\Windows\system32\schtasks.exe
                    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:5136
                  • C:\Windows\system32\schtasks.exe
                    SCHTASKS /Run /TN "Task1"
                    3⤵
                      PID:6904
                    • C:\Windows\system32\schtasks.exe
                      SCHTASKS /Delete /TN "Task1" /F
                      3⤵
                        PID:6836
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
                      2⤵
                      • Indicator Removal: Clear Persistence
                      PID:6956
                      • C:\Windows\system32\schtasks.exe
                        SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
                        3⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:6136
                      • C:\Windows\system32\schtasks.exe
                        SCHTASKS /Run /TN "Task1"
                        3⤵
                          PID:768
                        • C:\Windows\system32\schtasks.exe
                          SCHTASKS /Delete /TN "Task1" /F
                          3⤵
                            PID:2524
                      • C:\Users\Public\sCp853\k2UcUM.exe
                        "C:\Users\Public\sCp853\k2UcUM.exe"
                        1⤵
                          PID:4588
                        • C:\Windows\system32\cmd.exe
                          "cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\sCp853" /t REG_DWORD /d 0 /f
                          1⤵
                          • Executes a command shell one-liner
                          PID:6160
                        • C:\Windows\system32\cmd.exe
                          cmd.exe
                          1⤵
                            PID:4632
                          • C:\Windows\system32\cmd.exe
                            "cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
                            1⤵
                            • Executes a command shell one-liner
                            PID:4576
                          • C:\Windows\system32\cmd.exe
                            "cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
                            1⤵
                            • Executes a command shell one-liner
                            PID:3352

                          Network

                                MITRE ATT&CK Enterprise v16

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                1BA79029EC3FFD076F5DAC2F70A18685
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685
                                • Size 1KB
                                • SHA256 6f7bfa4789bd506ccf81640feec036bac7c0354084ca472f55a79ce53b9c3ade
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                1BA79029EC3FFD076F5DAC2F70A18685
                                • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685
                                • Size 186B
                                • SHA256 f886a4562325d5ea588050188dd3f40b7cbf53132f829a4683ee283f46e03ed6
                                • MD5 SHA1 SHA512 TLSH
                                Submit Download

                                UxEnhance64.dll
                                • Path C:\Users\Public\sCp853\UxEnhance64.dll
                                • Size 3.1MB
                                • SHA256 b3bbbc4d51fbcad61f71a4ed39fbde904bfed9e065aa5974e4dfd7634c94cb5c
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                adoresd.dat
                                • Path C:\Users\Public\sCp853\adoresd.dat
                                • Size 4.7MB
                                • SHA256 a8bda2225ebc8993990a0b4f58e1ec03a93d6b05d3cf912d722a71183b1a4b73
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                k2UcUM.exe
                                • Path C:\Users\Public\sCp853\k2UcUM.exe
                                • Size 135KB
                                • SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                msadox.tb
                                • Path C:\Users\Public\sCp853\msadox.tb
                                • Size 8KB
                                • SHA256 e3b0704047736c0a26d31f0f49e09f8c9edebc855a4771a6f71404eb31ce7d48
                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                Submit Download

                                memory/3932-601-0x000002114CEF0000-0x000002114CF12000-memory.dmp
                                Download

                                memory/4588-580-0x00007FFE58500000-0x00007FFE58502000-memory.dmp
                                Download

                                memory/4588-574-0x00007FFE35890000-0x00007FFE35DAE000-memory.dmp
                                Download

                                memory/4588-585-0x0000024CA8AA0000-0x0000024CA9327000-memory.dmp
                                Download

                                memory/4588-586-0x0000024CA8AA0000-0x0000024CA9327000-memory.dmp
                                Download

                                memory/4588-588-0x0000024CA8AA0000-0x0000024CA9327000-memory.dmp
                                Download

                                memory/4588-587-0x0000024CA8AA0000-0x0000024CA9327000-memory.dmp
                                Download

                                memory/4588-589-0x00007FFE584F0000-0x00007FFE584F2000-memory.dmp
                                Download

                                memory/4588-581-0x0000024CA8AA0000-0x0000024CA9327000-memory.dmp
                                Download

                                memory/4588-578-0x0000024CA8AA0000-0x0000024CA9327000-memory.dmp
                                Download

                                memory/4648-546-0x0000018BB60C0000-0x0000018BB6947000-memory.dmp
                                Download

                                memory/4648-567-0x0000018BB60C0000-0x0000018BB6947000-memory.dmp
                                Download

                                memory/4648-548-0x0000018BB60C0000-0x0000018BB6947000-memory.dmp
                                Download

                                memory/4648-552-0x0000018BB60C0000-0x0000018BB6947000-memory.dmp
                                Download

                                memory/4648-558-0x0000018BB6990000-0x0000018BB69DE000-memory.dmp
                                Download

                                memory/4648-560-0x0000018BB6A70000-0x0000018BB6AFA000-memory.dmp
                                Download

                                memory/4648-563-0x0000018BB6A70000-0x0000018BB6AFA000-memory.dmp
                                Download

                                memory/4648-562-0x0000018BB6A70000-0x0000018BB6AFA000-memory.dmp
                                Download

                                memory/4648-561-0x0000018BB6A70000-0x0000018BB6AFA000-memory.dmp
                                Download

                                memory/4648-565-0x0000018BB60C0000-0x0000018BB6947000-memory.dmp
                                Download

                                memory/4648-568-0x0000018BB60C0000-0x0000018BB6947000-memory.dmp
                                Download

                                memory/4648-547-0x0000018BB60C0000-0x0000018BB6947000-memory.dmp
                                Download

                                memory/4648-532-0x00007FFE584F0000-0x00007FFE584F2000-memory.dmp
                                Download

                                memory/4648-545-0x0000018BB60C0000-0x0000018BB6947000-memory.dmp
                                Download

                                memory/4648-533-0x00007FFE35890000-0x00007FFE35DAE000-memory.dmp
                                Download

                                memory/4648-541-0x0000018BB60C0000-0x0000018BB6947000-memory.dmp
                                Download

                                memory/4648-540-0x00007FFE58500000-0x00007FFE58502000-memory.dmp
                                Download

                                memory/4648-538-0x0000018BB60C0000-0x0000018BB6947000-memory.dmp
                                Download

                                memory/6116-526-0x00000000005A0000-0x00000000005AE000-memory.dmp
                                Download

                                memory/6116-527-0x00007FFE4FE00000-0x00007FFE4FE12000-memory.dmp
                                Download

                                memory/6116-0-0x00000000005A0000-0x00000000005AE000-memory.dmp
                                Download

                                memory/6116-504-0x00007FFE4FE00000-0x00007FFE4FE12000-memory.dmp
                                Download

                                memory/6116-2-0x00000000005B0000-0x00000000005BC000-memory.dmp
                                Download

                                memory/6116-1-0x00000000005A0000-0x00000000005AE000-memory.dmp
                                Download