7d8b3530c3aa83de6d65cebac4ac7dd5fe54b08b8490baa5e1c212c1dfe20d96

Analysis

max time kernel
151s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Size 59.9MB
Sample260701-c3eftaew81
SHA256 7d8b3530c3aa83de6d65cebac4ac7dd5fe54b08b8490baa5e1c212c1dfe20d96
MD5 d522fa006d18b5c2218e899c71581bab
SHA1 ff346d7b627673902075c4b3d42b8247eca087ef
SHA512 68cbc6cfe45bc89b6d9f592a34a0b8dad64199037b8dee3c455f9d17bdae99bef8725a3b69ebc6262d5f5a677e49d91d22dbcd27a48442d47570f34a7d20d551
SSDEEP 393216:0lg++eKUYae2OcJs+6LXp6pB65++K0m40jUmkI9mnmSZnwfTrnCFRy+o33irYVIn:0VgCJrhTQRACrYVKAGRjqY
TLSH
T1ADD7494666EA0481FDF7EA3489F65513C673BC166F3185CF220C1B2A1F776E0897A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5736	powershell.exe
4444	powershell.exe
1404	powershell.exe
2024	powershell.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4780	tasklist.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4240	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5736	powershell.exe
5736	powershell.exe
4444	powershell.exe
4444	powershell.exe
1404	powershell.exe
1404	powershell.exe
2024	powershell.exe
2024	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5736	powershell.exe
Token: SeIncreaseQuotaPrivilege	5736	powershell.exe
Token: SeSecurityPrivilege	5736	powershell.exe
Token: SeTakeOwnershipPrivilege	5736	powershell.exe
Token: SeLoadDriverPrivilege	5736	powershell.exe
Token: SeSystemProfilePrivilege	5736	powershell.exe
Token: SeSystemtimePrivilege	5736	powershell.exe
Token: SeProfSingleProcessPrivilege	5736	powershell.exe
Token: SeIncBasePriorityPrivilege	5736	powershell.exe
Token: SeCreatePagefilePrivilege	5736	powershell.exe
Token: SeBackupPrivilege	5736	powershell.exe
Token: SeRestorePrivilege	5736	powershell.exe
Token: SeShutdownPrivilege	5736	powershell.exe
Token: SeDebugPrivilege	5736	powershell.exe
Token: SeSystemEnvironmentPrivilege	5736	powershell.exe
Token: SeRemoteShutdownPrivilege	5736	powershell.exe
Token: SeUndockPrivilege	5736	powershell.exe
Token: SeManageVolumePrivilege	5736	powershell.exe
Token: 33	5736	powershell.exe
Token: 34	5736	powershell.exe
Token: 35	5736	powershell.exe
Token: 36	5736	powershell.exe
Token: SeDebugPrivilege	4780	tasklist.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeIncreaseQuotaPrivilege	4444	powershell.exe
Token: SeSecurityPrivilege	4444	powershell.exe
Token: SeTakeOwnershipPrivilege	4444	powershell.exe
Token: SeLoadDriverPrivilege	4444	powershell.exe
Token: SeSystemProfilePrivilege	4444	powershell.exe
Token: SeSystemtimePrivilege	4444	powershell.exe
Token: SeProfSingleProcessPrivilege	4444	powershell.exe
Token: SeIncBasePriorityPrivilege	4444	powershell.exe
Token: SeCreatePagefilePrivilege	4444	powershell.exe
Token: SeBackupPrivilege	4444	powershell.exe
Token: SeRestorePrivilege	4444	powershell.exe
Token: SeShutdownPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeSystemEnvironmentPrivilege	4444	powershell.exe
Token: SeRemoteShutdownPrivilege	4444	powershell.exe
Token: SeUndockPrivilege	4444	powershell.exe
Token: SeManageVolumePrivilege	4444	powershell.exe
Token: 33	4444	powershell.exe
Token: 34	4444	powershell.exe
Token: 35	4444	powershell.exe
Token: 36	4444	powershell.exe
Token: SeDebugPrivilege	4240	taskkill.exe
Token: SeDebugPrivilege	1404	powershell.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeIncreaseQuotaPrivilege	2024	powershell.exe
Token: SeSecurityPrivilege	2024	powershell.exe
Token: SeTakeOwnershipPrivilege	2024	powershell.exe
Token: SeLoadDriverPrivilege	2024	powershell.exe
Token: SeSystemProfilePrivilege	2024	powershell.exe
Token: SeSystemtimePrivilege	2024	powershell.exe
Token: SeProfSingleProcessPrivilege	2024	powershell.exe
Token: SeIncBasePriorityPrivilege	2024	powershell.exe
Token: SeCreatePagefilePrivilege	2024	powershell.exe
Token: SeBackupPrivilege	2024	powershell.exe
Token: SeRestorePrivilege	2024	powershell.exe
Token: SeShutdownPrivilege	2024	powershell.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeSystemEnvironmentPrivilege	2024	powershell.exe
Token: SeRemoteShutdownPrivilege	2024	powershell.exe
Token: SeUndockPrivilege	2024	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 5520 wrote to memory of 5952	5520	2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe	88
PID 5952 wrote to memory of 5736	5952	cmd.exe	90
PID 5520 wrote to memory of 4744	5520	2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe	92
PID 4744 wrote to memory of 4780	4744	cmd.exe	94
PID 5520 wrote to memory of 3660	5520	2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe	95
PID 3660 wrote to memory of 4444	3660	cmd.exe	97
PID 5520 wrote to memory of 3404	5520	2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe	98
PID 3404 wrote to memory of 5628	3404	cmd.exe	100
PID 5628 wrote to memory of 2436	5628	net.exe	101
PID 5520 wrote to memory of 2572	5520	2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe	102
PID 2572 wrote to memory of 4240	2572	cmd.exe	104
PID 5520 wrote to memory of 5804	5520	2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe	105
PID 5804 wrote to memory of 1404	5804	cmd.exe	107
PID 5520 wrote to memory of 5576	5520	2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe	108
PID 5576 wrote to memory of 2024	5576	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_d522fa006d18b5c2218e899c71581bab_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance Win32_DiskDrive | Select-Object -ExpandProperty Model""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-CimInstance Win32_DiskDrive | Select-Object -ExpandProperty Model"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance Win32_PortConnector).Count""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "(Get-CimInstance Win32_PortConnector).Count"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5628
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecHealthUI.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4240
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-Service -Name WinDefend | Select-Object -ExpandProperty Status""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-Service -Name WinDefend | Select-Object -ExpandProperty Status"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$r=Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'; $os=Get-CimInstance Win32_OperatingSystem; try { $av=Get-CimInstance -Namespace root\SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName } catch { $av = 'Not available' }; '{0}, Version {1}, OS Build {2}.{3} {4} - Antivirus: {5}' -f ($os.Caption -replace 'Microsoft ','').Trim(), $r.DisplayVersion, $r.CurrentBuild, $r.UBR, $os.OSArchitecture, ($av -join ', ')"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
MD5 dc6571b4e39d13392bb7f996d9a95ef5
SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
TLSH
T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 21da1803b29a60c9b7ba2677b45c4115dfedbf5b2a5605c9fcefab6b401d086a
MD5 9ba5093c81b4e00929feb41913717d35
SHA1 8a264933d92e23ee88aa4e31f843e65eea0faca4
SHA512 ec5cb2aed6b75efa7a0f83751e558883a5036d1acbd8aca920cb050cc748571f02974a95d08f6d72065d052bbf241fba5941c02bf1231f35b5097248ecedb93f
TLSH
T16D219837F3DC8614CCA9003A10DDAD0036B6C7CB40DECF5B6B85E159A42F298CFA0060
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 11dec9469983a3a6aca0bea99f1c714b2f8d86d5e9b58a477453bf67541dcd1f
MD5 7d13b9a14ea619bb261a23d582c0de8f
SHA1 5173f923f2e9555c8d32af576a9bafc9fc771ceb
SHA512 1af4ae31ec56c2dedcb205e712b3f56759ef06bab58ce99357d0c00a4d6237aef8f5ca01a027c0605cf080b685dfd0266a79091084deab76972227d72a52279a
TLSH
T124215733B3CC8724C889413650DEAC0036B6C7DB819EDF5BBB84D545B43F699CE61560
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_02m3rjxz.h0l.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_02m3rjxz.h0l.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2024-39-0x000001AEF6E30000-0x000001AEF6EE2000-memory.dmp

Download

memory/4444-28-0x000001DD4CD90000-0x000001DD4CE42000-memory.dmp

Download

memory/5736-16-0x0000024E26660000-0x0000024E26712000-memory.dmp

Download

memory/5736-21-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp

Download

memory/5736-11-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp

Download

memory/5736-12-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp

Download

memory/5736-1-0x00007FFA77F1F000-0x00007FFA77F20000-memory.dmp

Download

memory/5736-15-0x0000024E25B70000-0x0000024E25B8E000-memory.dmp

Download

memory/5736-17-0x0000024E26720000-0x0000024E2672A000-memory.dmp

Download

memory/5736-19-0x0000024E269D0000-0x0000024E269F4000-memory.dmp

Download

memory/5736-18-0x0000024E269D0000-0x0000024E269FA000-memory.dmp

Download

memory/5736-10-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp

Download

memory/5736-22-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp

Download

memory/5736-9-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp

Download

memory/5736-8-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp

Download

memory/5736-7-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp

Download

memory/5736-5-0x0000024E25AE0000-0x0000024E25B02000-memory.dmp

Download

memory/5736-6-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp

Download

memory/5736-2-0x00007FFA77D90000-0x00007FFA78734000-memory.dmp

Download