Overview

overview

7

Static

static

3

2026-07-12...xz.exe

windows10-2004-x64

2026-07-12...xz.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    4s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 08:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    2026-07-12_d502506a83b5d292ee4267e146f3db29_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
  • Size 33.0MB
  • Sample260712-j79wvaew6k
  • SHA256 6322298f0c8c9b7a04b02a63b1beb05d8794bdebf46a9d29505b496fbcb9239a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_d502506a83b5d292ee4267e146f3db29_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_d502506a83b5d292ee4267e146f3db29_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar_zxxz.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5856
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5732
      • C:\Windows\system32\reg.exe
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable
        3⤵
          PID:4192
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "net session"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4324
        • C:\Windows\system32\net.exe
          net session
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5096
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            4⤵
              PID:3352
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "tasklist"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3228
          • C:\Windows\system32\tasklist.exe
            tasklist
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:4636
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -Command -
          2⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4228
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gq3nxiz2\gq3nxiz2.cmdline"
            3⤵
              PID:4988
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES616F.tmp" "c:\Users\Admin\AppData\Local\Temp\gq3nxiz2\CSC182D87206D364C24B5DA351D9D415938.TMP"
                4⤵
                  PID:2460
            • C:\Windows\system32\wscript.exe
              wscript.exe //nologo C:\Users\Admin\AppData\Local\Temp\c7wiZ2yU.vbs
              2⤵
                PID:1412
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im svchost.exe"
                2⤵
                  PID:5320
                  • C:\Windows\system32\taskkill.exe
                    taskkill /f /im svchost.exe
                    3⤵
                    • Kills process with taskkill
                    PID:4256

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    RES616F.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\RES616F.tmp
                    • Size 1KB
                    • SHA256 cfb64de6a3f5677ccfe813264d3f9065cb7c7d7c1ad4e379bc024ee74eb1e137
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    c7wiZ2yU.vbs
                    • Path C:\Users\Admin\AppData\Local\Temp\c7wiZ2yU.vbs
                    • Size 145B
                    • SHA256 d9a972fab01777ceaad7cd6ea39db1acdc6e362f9dbd567ea0abc03911a9d137
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    gq3nxiz2.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\gq3nxiz2\gq3nxiz2.dll
                    • Size 3KB
                    • SHA256 c8ec142b7272e2edd32b76d6ab26f24a7e468a4ededea074225b3feafcb07acb
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    CSC182D87206D364C24B5DA351D9D415938.TMP
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\gq3nxiz2\CSC182D87206D364C24B5DA351D9D415938.TMP
                    • Size 652B
                    • SHA256 12c66f4f2081abe4e015928561660bc934fd7238b194c32772daa78f83ab65c2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    gq3nxiz2.0.cs
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\gq3nxiz2\gq3nxiz2.0.cs
                    • Size 420B
                    • SHA256 53cb9811b76702330a10ba42de7799eac897ffa610ec709442af108b4deadbb2
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    gq3nxiz2.cmdline
                    • Path \??\c:\Users\Admin\AppData\Local\Temp\gq3nxiz2\gq3nxiz2.cmdline
                    • Size 369B
                    • SHA256 845019fee7d62c1e0c066a644840ca34600ab2e9d6991742bea4249a0c394de7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    memory/4228-3-0x0000013A76B00000-0x0000013A76B22000-memory.dmp
                    Download

                    memory/4228-4-0x0000013A76F70000-0x0000013A76FB8000-memory.dmp
                    Download

                    memory/4228-17-0x0000013A76BB0000-0x0000013A76BB8000-memory.dmp
                    Download