Overview

overview

10

Static

static

10

2026-07-18...xz.exe

windows10-2004-x64

7

2026-07-18...xz.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    152s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/07/2026, 23:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-18_c90ff4fc72a3cb07dafb69a373c7a9cf_cobalt-strike_coinminer_glassworm_icedid_megazord_njrat_ryuk_satacom_stealc_zxxz.exe
  • Size 104.0MB
  • Sample260718-3p67saft7l
  • SHA256 a5123d02c460403ca9b020aab22ece2e3701b3baeed68af74ff77d96973f3f7b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionspywarestealer

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Executes a command shell one-liner 1 TTPs 17 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 6 IoCs
    defense_evasion
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-18_c90ff4fc72a3cb07dafb69a373c7a9cf_cobalt-strike_coinminer_glassworm_icedid_megazord_njrat_ryuk_satacom_stealc_zxxz.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-18_c90ff4fc72a3cb07dafb69a373c7a9cf_cobalt-strike_coinminer_glassworm_icedid_megazord_njrat_ryuk_satacom_stealc_zxxz.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5652
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "net session"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4816
      • C:\Windows\system32\net.exe
        net session
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 session
          4⤵
            PID:4824
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c ""C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat" /list"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:6136
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe /nologo /r:"Microsoft.VisualBasic.dll" /win32manifest:"app.manifest" /out:"screenCapture_1.3.2.exe" "C:\Users\Admin\AppData\Local\Temp\SCREEN~1\SCREEN~1.BAT"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5940
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES799B.tmp" "c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCAEC31E144154894A1EC97211C6FC35E.TMP"
            4⤵
              PID:2404
          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
            screenCapture_1.3.2.exe /list
            3⤵
            • Executes dropped EXE
            PID:5024
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1792
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM chrome.exe
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1572
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:424
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM msedge.exe
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1648
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1948
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM opera.exe
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2632
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera_gx.exe"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3480
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM opera_gx.exe
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3548
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5944
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM brave.exe
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1256
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe"
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2152
          • C:\Windows\system32\taskkill.exe
            taskkill /F /IM firefox.exe
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3160
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-CimInstance Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID""
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3520
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell "Get-CimInstance Win32_ComputerSystemProduct | Select-Object -ExpandProperty UUID"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3204
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat C:\Users\Admin\AppData\Local\Temp\2026619-5652-1ueff0p.nv1u.jpg /d \\.\DISPLAY1
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4432
          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
            screenCapture_1.3.2.exe C:\Users\Admin\AppData\Local\Temp\2026619-5652-1ueff0p.nv1u.jpg /d \\.\DISPLAY1
            3⤵
            • Executes dropped EXE
            PID:3436
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat C:\Users\Admin\AppData\Local\Temp\2026619-5652-7x767j.pig04.jpg
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2884
          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
            screenCapture_1.3.2.exe C:\Users\Admin\AppData\Local\Temp\2026619-5652-7x767j.pig04.jpg
            3⤵
            • Executes dropped EXE
            PID:4680
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat C:\Users\Admin\AppData\Local\Temp\2026619-5652-ubakvy.8aw5.jpg
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5868
          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
            screenCapture_1.3.2.exe C:\Users\Admin\AppData\Local\Temp\2026619-5652-ubakvy.8aw5.jpg
            3⤵
            • Executes dropped EXE
            PID:5216
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat C:\Users\Admin\AppData\Local\Temp\2026619-5652-18amml9.tmum.jpg
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1428
          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
            screenCapture_1.3.2.exe C:\Users\Admin\AppData\Local\Temp\2026619-5652-18amml9.tmum.jpg
            3⤵
            • Executes dropped EXE
            PID:1644
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat C:\Users\Admin\AppData\Local\Temp\2026619-5652-vgyps8.2i1m.jpg
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5624
          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
            screenCapture_1.3.2.exe C:\Users\Admin\AppData\Local\Temp\2026619-5652-vgyps8.2i1m.jpg
            3⤵
            • Executes dropped EXE
            PID:5768
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat C:\Users\Admin\AppData\Local\Temp\2026619-5652-fpckh9.msd4.jpg
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2384
          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
            screenCapture_1.3.2.exe C:\Users\Admin\AppData\Local\Temp\2026619-5652-fpckh9.msd4.jpg
            3⤵
            • Executes dropped EXE
            PID:2596
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat C:\Users\Admin\AppData\Local\Temp\2026619-5652-1brk1xo.nilv.jpg
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1388
          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
            screenCapture_1.3.2.exe C:\Users\Admin\AppData\Local\Temp\2026619-5652-1brk1xo.nilv.jpg
            3⤵
            • Executes dropped EXE
            PID:5128
        • C:\Windows\system32\cmd.exe
          cmd.exe /c C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat C:\Users\Admin\AppData\Local\Temp\2026619-5652-1wzous9.71y3.jpg
          2⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5016
          • C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
            screenCapture_1.3.2.exe C:\Users\Admin\AppData\Local\Temp\2026619-5652-1wzous9.71y3.jpg
            3⤵
            • Executes dropped EXE
            PID:5264

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            node-hide-console-window.node
            • Path C:\Users\Admin\.cache\pkg\000b63f4c86f76e3671983c19dbac9b0da4470744434894bd36bdb1e76c16963\node-hide-console-window\build\Release\node-hide-console-window.node
            • Size 107KB
            • SHA256 000b63f4c86f76e3671983c19dbac9b0da4470744434894bd36bdb1e76c16963
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            @primno+dpapi.node
            • Path C:\Users\Admin\.cache\pkg\386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f\@primno\dpapi\prebuilds\win32-x64\@primno+dpapi.node
            • Size 134KB
            • SHA256 386e7a520b143aa7b6fa1a28a0237391a938bbedd0b245733a3da3a215026a3f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            node.napi.node
            • Path C:\Users\Admin\.cache\pkg\837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843\ref-napi\prebuilds\win32-x64\node.napi.node
            • Size 579KB
            • SHA256 837cb201a460a44d025689218d3b0e588ae3edbcd6ab11f415b147b5331cc843
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ffitarget.h
            • Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\mac\ia32\ffitarget.h
            • Size 4KB
            • SHA256 ce9a87677a9b9af9dcc6f8f632b62948214824174b65fe4361d3b662cc72aec0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ffi.h
            • Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\deps\libffi\config\openbsd\x64\ffi.h
            • Size 13KB
            • SHA256 bdd54f5f8517f32767d864921edb878224068a75eff7e0386a55105d61e44466
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            node.napi.uv1.node
            • Path C:\Users\Admin\.cache\pkg\b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3\ffi-napi\prebuilds\win32-x64\node.napi.uv1.node
            • Size 588KB
            • SHA256 b0e0c6ad80fccc92a41f644afe3ad1d7e4ebcac9caa94a9ccf4eaa0dea2247e3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            node.napi.node
            • Path C:\Users\Admin\.cache\pkg\dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3\ref-napi\prebuilds\win32-x64\node.napi.node
            • Size 550KB
            • SHA256 dd3bd6107fb87be3c34985df2a8a0645fa7a89172d23ddb66fec64c3236a1af3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            2026619-5652-1ueff0p.nv1u.jpg
            • Path C:\Users\Admin\AppData\Local\Temp\2026619-5652-1ueff0p.nv1u.jpg
            • Size 134KB
            • SHA256 0b28e1b7f0c4a5d0ac4671bdbf745e6202f2fea2174ec2024eb7fa63ad8a5f45
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            2026619-5652-fpckh9.msd4.jpg
            • Path C:\Users\Admin\AppData\Local\Temp\2026619-5652-fpckh9.msd4.jpg
            • Size 133KB
            • SHA256 b4b3364dc73d88800dadd5ab975240a1947b8af091426a24866b03e21ca25fb0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            RES799B.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\RES799B.tmp
            • Size 1KB
            • SHA256 90a23980801ca60ff1d2621a22aca2f0170bdf816317090d7ba5a7678f75c374
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            screenCapture_1.3.2.bat
            • Path C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.bat
            • Size 13KB
            • SHA256 818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            screenCapture_1.3.2.exe
            • Path C:\Users\Admin\AppData\Local\Temp\screenCapture\screenCapture_1.3.2.exe
            • Size 12KB
            • SHA256 a42d3690b3a1ce8dcad2c33192e033ab8d75d488a49f7028b6718b757574b66d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            CSCAEC31E144154894A1EC97211C6FC35E.TMP
            • Path \??\c:\Users\Admin\AppData\Local\Temp\screenCapture\CSCAEC31E144154894A1EC97211C6FC35E.TMP
            • Size 1KB
            • SHA256 ab96911d094b6070cbfb48e07407371ddb41b86e36628b6a10cdb11478192344
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            app.manifest
            • Path \??\c:\Users\Admin\AppData\Local\Temp\screenCapture\app.manifest
            • Size 350B
            • SHA256 8814db9e125d0c2b7489f8c7c3e95adf41f992d4397ed718bda8573cb8fb0e83
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/3204-803-0x00000213FF600000-0x00000213FF6B2000-memory.dmp
            Download

            memory/3204-812-0x00000213FFB60000-0x00000213FFB8A000-memory.dmp
            Download

            memory/3204-815-0x00000213FFB60000-0x00000213FFB84000-memory.dmp
            Download

            memory/3204-807-0x00000213FF6C0000-0x00000213FF6CA000-memory.dmp
            Download

            memory/3204-802-0x00000213FF5E0000-0x00000213FF5FE000-memory.dmp
            Download

            memory/3204-799-0x00000213FF540000-0x00000213FF562000-memory.dmp
            Download

            memory/5024-817-0x0000000000900000-0x000000000090A000-memory.dmp
            Download