7d8b3530c3aa83de6d65cebac4ac7dd5fe54b08b8490baa5e1c212c1dfe20d96

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Size 59.9MB
Sample260701-c3eftaew81
SHA256 7d8b3530c3aa83de6d65cebac4ac7dd5fe54b08b8490baa5e1c212c1dfe20d96
MD5 d522fa006d18b5c2218e899c71581bab
SHA1 ff346d7b627673902075c4b3d42b8247eca087ef
SHA512 68cbc6cfe45bc89b6d9f592a34a0b8dad64199037b8dee3c455f9d17bdae99bef8725a3b69ebc6262d5f5a677e49d91d22dbcd27a48442d47570f34a7d20d551
SSDEEP 393216:0lg++eKUYae2OcJs+6LXp6pB65++K0m40jUmkI9mnmSZnwfTrnCFRy+o33irYVIn:0VgCJrhTQRACrYVKAGRjqY
TLSH
T1ADD7494666EA0481FDF7EA3489F65513C673BC166F3185CF220C1B2A1F776E0897A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
416	powershell.exe
1876	powershell.exe
1720	powershell.exe
3928	powershell.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2112	tasklist.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4300	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
416	powershell.exe
416	powershell.exe
1876	powershell.exe
1876	powershell.exe
1720	powershell.exe
1720	powershell.exe
3928	powershell.exe
3928	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	416	powershell.exe
Token: SeIncreaseQuotaPrivilege	416	powershell.exe
Token: SeSecurityPrivilege	416	powershell.exe
Token: SeTakeOwnershipPrivilege	416	powershell.exe
Token: SeLoadDriverPrivilege	416	powershell.exe
Token: SeSystemProfilePrivilege	416	powershell.exe
Token: SeSystemtimePrivilege	416	powershell.exe
Token: SeProfSingleProcessPrivilege	416	powershell.exe
Token: SeIncBasePriorityPrivilege	416	powershell.exe
Token: SeCreatePagefilePrivilege	416	powershell.exe
Token: SeBackupPrivilege	416	powershell.exe
Token: SeRestorePrivilege	416	powershell.exe
Token: SeShutdownPrivilege	416	powershell.exe
Token: SeDebugPrivilege	416	powershell.exe
Token: SeSystemEnvironmentPrivilege	416	powershell.exe
Token: SeRemoteShutdownPrivilege	416	powershell.exe
Token: SeUndockPrivilege	416	powershell.exe
Token: SeManageVolumePrivilege	416	powershell.exe
Token: 33	416	powershell.exe
Token: 34	416	powershell.exe
Token: 35	416	powershell.exe
Token: 36	416	powershell.exe
Token: SeDebugPrivilege	2112	tasklist.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeIncreaseQuotaPrivilege	1876	powershell.exe
Token: SeSecurityPrivilege	1876	powershell.exe
Token: SeTakeOwnershipPrivilege	1876	powershell.exe
Token: SeLoadDriverPrivilege	1876	powershell.exe
Token: SeSystemProfilePrivilege	1876	powershell.exe
Token: SeSystemtimePrivilege	1876	powershell.exe
Token: SeProfSingleProcessPrivilege	1876	powershell.exe
Token: SeIncBasePriorityPrivilege	1876	powershell.exe
Token: SeCreatePagefilePrivilege	1876	powershell.exe
Token: SeBackupPrivilege	1876	powershell.exe
Token: SeRestorePrivilege	1876	powershell.exe
Token: SeShutdownPrivilege	1876	powershell.exe
Token: SeDebugPrivilege	1876	powershell.exe
Token: SeSystemEnvironmentPrivilege	1876	powershell.exe
Token: SeRemoteShutdownPrivilege	1876	powershell.exe
Token: SeUndockPrivilege	1876	powershell.exe
Token: SeManageVolumePrivilege	1876	powershell.exe
Token: 33	1876	powershell.exe
Token: 34	1876	powershell.exe
Token: 35	1876	powershell.exe
Token: 36	1876	powershell.exe
Token: SeDebugPrivilege	4300	taskkill.exe
Token: SeDebugPrivilege	1720	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeIncreaseQuotaPrivilege	3928	powershell.exe
Token: SeSecurityPrivilege	3928	powershell.exe
Token: SeTakeOwnershipPrivilege	3928	powershell.exe
Token: SeLoadDriverPrivilege	3928	powershell.exe
Token: SeSystemProfilePrivilege	3928	powershell.exe
Token: SeSystemtimePrivilege	3928	powershell.exe
Token: SeProfSingleProcessPrivilege	3928	powershell.exe
Token: SeIncBasePriorityPrivilege	3928	powershell.exe
Token: SeCreatePagefilePrivilege	3928	powershell.exe
Token: SeBackupPrivilege	3928	powershell.exe
Token: SeRestorePrivilege	3928	powershell.exe
Token: SeShutdownPrivilege	3928	powershell.exe
Token: SeDebugPrivilege	3928	powershell.exe
Token: SeSystemEnvironmentPrivilege	3928	powershell.exe
Token: SeRemoteShutdownPrivilege	3928	powershell.exe
Token: SeUndockPrivilege	3928	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 2944	540	2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe	88
PID 2944 wrote to memory of 416	2944	cmd.exe	90
PID 540 wrote to memory of 1596	540	2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe	91
PID 1596 wrote to memory of 2112	1596	cmd.exe	93
PID 540 wrote to memory of 3236	540	2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe	94
PID 3236 wrote to memory of 1876	3236	cmd.exe	96
PID 540 wrote to memory of 4340	540	2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe	97
PID 4340 wrote to memory of 4592	4340	cmd.exe	99
PID 4592 wrote to memory of 3724	4592	net.exe	100
PID 540 wrote to memory of 4720	540	2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe	101
PID 4720 wrote to memory of 4300	4720	cmd.exe	103
PID 540 wrote to memory of 1208	540	2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe	104
PID 1208 wrote to memory of 1720	1208	cmd.exe	106
PID 540 wrote to memory of 1612	540	2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe	108
PID 1612 wrote to memory of 3928	1612	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance Win32_DiskDrive | Select-Object -ExpandProperty Model""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_DiskDrive | Select-Object -ExpandProperty Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance Win32_PortConnector).Count""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance Win32_PortConnector).Count"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-Service -Name WinDefend | Select-Object -ExpandProperty Status""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-Service -Name WinDefend | Select-Object -ExpandProperty Status"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
MD5 3bfc414667e1ebc31e9259fa1db290fa
SHA1 9bff989429779efef334e5524a362e7b6ff266cb
SHA512 e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13
TLSH
T1E371BF323375B0D4C9567F072A2819C063BF4396EA98AF4CB25C621ED92751B9B122F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1442fe4bd9b919803a2e16f2481474cce6a44582658ad9e9e9d84200c0d10ccb
MD5 e2bccdd63051de227ad56502512972f1
SHA1 4429d3689a7a52b11d1fca0cc5681b9a2e573fb4
SHA512 b7f95c522846b02bda4f8b109d173a7817d3c8bb721b2a37626a608d62abc8df5498d62f5c764b9e0c781a622234c395ec4d269ab442527b2ba3b2ae7b07b555
TLSH
T15B216527B39CC861CC99153A209DAC1172B683C7809ECF8F6EC0D224A57FA94CB61594
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 34c6696dc87d3f2bd1ff41b7048017c2f2662bbe651f51b18825419fa679dd9b
MD5 8ff2c89bd4c9885c5b0301ccda34a049
SHA1 48ccac1723f1ce63c297e428761408c3de6be2c8
SHA512 e747ca0d0a61bad06b444184d67052f4bb64c88348ce6abf9ce7e1b7c15ed3c160c51463e6f3013c9e4048b4ac98d2e57b455d5e2e0ca344229dad6f7e5a5bdc
TLSH
T170216527B39CC921DC99153A209CAC1172B683CB809ECF8F6EC0D224A17FA84CB61590
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 45068af016d3d1b46dabdb589257fd40af73e04e97d080dbbc2906aec9386c41
MD5 845183dc77c9b6c87e4c0cfb2a928973
SHA1 3694f5fc52195f9bc70b0981ed901ec2250bd532
SHA512 c653e838180db0a2094a781ba1944ea4c21b374eb4ca4026955d6cdcaa7b764b32481d2d645f69fe3ac3ebf594b8437a2b02c404f6164a1821d05cc47cfc939a
TLSH
T1E6218727B3DC89A1CC85123A109D9C1136A383D7809EDFDF6FC0D604A5BF698CB61150
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zbdatypk.5so.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zbdatypk.5so.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/416-15-0x000001EAF5B20000-0x000001EAF5C6E000-memory.dmp

Download

memory/416-2-0x000001EAF31B0000-0x000001EAF31C0000-memory.dmp

Download

memory/416-12-0x000001EAF6000000-0x000001EAF6024000-memory.dmp

Download

memory/416-11-0x000001EAF6000000-0x000001EAF602A000-memory.dmp

Download

memory/416-3-0x000001EAF58B0000-0x000001EAF58D2000-memory.dmp

Download

memory/416-1-0x000001EAF31B0000-0x000001EAF31C0000-memory.dmp

Download

memory/1720-36-0x0000027C6D200000-0x0000027C6D34E000-memory.dmp

Download

memory/1876-26-0x000001F8B8110000-0x000001F8B825E000-memory.dmp

Download

memory/3928-46-0x00000234E5EE0000-0x00000234E602E000-memory.dmp

Download