Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 20:30
General
- Target 2026-10-30_a4a8b274b627657f719f9da2ab193482_cobalt-strike_coinminer_icedid_stealc_vidar.exe
- Size 30.5MB
- Sample261030-zagf2aez21
- SHA256 32e095ee0c04de5100a2794b0bd125901804368ebfd73157c09984847aa70e64
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Drops file in System32 directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 5 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-30_a4a8b274b627657f719f9da2ab193482_cobalt-strike_coinminer_icedid_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-30_a4a8b274b627657f719f9da2ab193482_cobalt-strike_coinminer_icedid_stealc_vidar.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Public\uox3F4\3oZa6Q.exe"C:\Users\Public\uox3F4\3oZa6Q.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
3oZa6Q.exe
UxEnhance64.dll
adoresd.dat
msadox.tb
memory/1144-536-0x0000012A37320000-0x0000012A37BF7000-memory.dmp
memory/1144-560-0x0000012A36810000-0x0000012A3689A000-memory.dmp
memory/1144-564-0x0000012A37320000-0x0000012A37BF7000-memory.dmp
memory/1144-559-0x0000012A36810000-0x0000012A3689A000-memory.dmp
memory/1144-530-0x00007FF89C0D0000-0x00007FF89C0D2000-memory.dmp
memory/1144-531-0x00007FF879650000-0x00007FF879B6E000-memory.dmp
memory/1144-556-0x0000012A37320000-0x0000012A37BF7000-memory.dmp
memory/1144-558-0x0000012A366F0000-0x0000012A3673E000-memory.dmp
memory/1144-561-0x0000012A36810000-0x0000012A3689A000-memory.dmp
memory/1144-538-0x00007FF89C0E0000-0x00007FF89C0E2000-memory.dmp
memory/1144-543-0x0000012A37320000-0x0000012A37BF7000-memory.dmp
memory/1144-539-0x0000012A37320000-0x0000012A37BF7000-memory.dmp
memory/1144-545-0x0000012A37320000-0x0000012A37BF7000-memory.dmp
memory/1144-546-0x0000012A37320000-0x0000012A37BF7000-memory.dmp
memory/1144-544-0x0000012A37320000-0x0000012A37BF7000-memory.dmp
memory/1144-550-0x0000012A37320000-0x0000012A37BF7000-memory.dmp
memory/1144-562-0x0000012A36810000-0x0000012A3689A000-memory.dmp
memory/4080-525-0x00007FF893760000-0x00007FF893772000-memory.dmp
memory/4080-0-0x00000000004D0000-0x00000000004DE000-memory.dmp
memory/4080-1-0x00000000004D0000-0x00000000004DE000-memory.dmp
memory/4080-2-0x00000000004E0000-0x00000000004EC000-memory.dmp
memory/4080-504-0x00007FF893760000-0x00007FF893772000-memory.dmp
memory/4080-524-0x00000000004D0000-0x00000000004DE000-memory.dmp