d75b0256e248ebdf0fce0170a1ea07966512a268982d445f7be0ae11de9b4d7e

Analysis

max time kernel
150s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/09/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_7d664d9972ff8e2a71efa314d72262c0_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
Size 37.2MB
Sample260923-2v6mrsfd49
SHA256 d75b0256e248ebdf0fce0170a1ea07966512a268982d445f7be0ae11de9b4d7e
MD5 7d664d9972ff8e2a71efa314d72262c0
SHA1 9c7c37a5381d240cd54a67640167e50c7556b918
SHA512 2a09976450d98f4443386a7f40fe75e3a3cb9e81c3ea424faecb0d44d14b086a87b8bddc75d454a55ac52657fe34f74b2967b4e571f288eca2c8ef92b8f36342
SSDEEP 393216:K7DbJCxAf9tnP3MD0WyB3YsKwcEBL81qPHNicqMbbHShuJrqfDZeGy83NeaBObfc:4NfXbB3y08AaBObz8AIz
TLSH
T19C879C0772A50185E5B7D138CAAB4617E773B81687308BCF315D03692FB7AE18E7A760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1676	cmd.exe
5208	cmd.exe
1836	cmd.exe
1116	cmd.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
2832	systeminfo.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2872	2026-09-23_7d664d9972ff8e2a71efa314d72262c0_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
2872	2026-09-23_7d664d9972ff8e2a71efa314d72262c0_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 1836	2872	2026-09-23_7d664d9972ff8e2a71efa314d72262c0_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe	91
PID 2872 wrote to memory of 1116	2872	2026-09-23_7d664d9972ff8e2a71efa314d72262c0_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe	92
PID 2872 wrote to memory of 1676	2872	2026-09-23_7d664d9972ff8e2a71efa314d72262c0_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe	93
PID 1676 wrote to memory of 2832	1676	cmd.exe	94
PID 2872 wrote to memory of 5208	2872	2026-09-23_7d664d9972ff8e2a71efa314d72262c0_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-09-23_7d664d9972ff8e2a71efa314d72262c0_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_7d664d9972ff8e2a71efa314d72262c0_coinminer_glassworm_icedid_njrat_vidar_zxxz.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ipfs swarm addrs --timeout=60s"
  2⤵
  - Executes a command shell one-liner
  PID:1836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "ipfs init --timeout=30s"
  2⤵
  - Executes a command shell one-liner
  PID:1116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "systeminfo"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\system32\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:2832
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "check_vtx.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads