Overview

overview

7

Static

static

3

Island Spoofer.exe

windows10-ltsc_2021-x64

7

Analysis

  • max time kernel
    59s
  • max time network
    67s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    01/08/2026, 22:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Island Spoofer.exe
  • Size 94.7MB
  • Sample260801-14f8sshf59
  • SHA256 7290003003f7ec387873c51ed2a01edd791555b1e87758560363a4bd1ca42716
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Loads dropped DLL 34 IoCs
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Island Spoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\Island Spoofer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1556
    • C:\Users\Admin\AppData\Local\Temp\Island Spoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\Island Spoofer.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of WriteProcessMemory
      PID:3000
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq AMIDEWINx64.EXE""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5944
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq AMIDEWINx64.EXE"
          4⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:5664

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AMIDEWINx64.EXE
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\AMIDEWINx64.EXE
        • Size 455KB
        • SHA256 13037eedd91f9313ec0d807947db65c639642e5ae6497e87d12fa6d19951f78e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\PySide6\QtCore.pyd
        • Size 3.2MB
        • SHA256 be52341a5df1f76ecca2fb1e94eb429dfa46f0b659ed6536f25119b565b21ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\PySide6\QtGui.pyd
        • Size 3.7MB
        • SHA256 f0549716b10a8b4fbd5c6c041f36af215223809f919f4c4722d44cc199d5c593
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtMultimedia.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\PySide6\QtMultimedia.pyd
        • Size 558KB
        • SHA256 1be5cdd4670b8dfb2ed86ffee7c4bd252677951698e175ac7aa2f61d444f69b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtNetwork.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\PySide6\QtNetwork.pyd
        • Size 983KB
        • SHA256 3953a86c9545ad8fa1cf1dec27085dd357838464cd6e2131c9963caad6234b67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\PySide6\QtWidgets.pyd
        • Size 4.6MB
        • SHA256 85cb6c2181b4b09887a7d8507dd950844d1b8f74a9c4002c7b71169f75bf6fda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VERSION_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\VERSION_1.dll
        • Size 7.7MB
        • SHA256 f8d89dcd83deeb0c7b01748503169192049063d1ec02d29705cad329fbd1c0f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\_bz2.pyd
        • Size 86KB
        • SHA256 ef5277eb670219274e7d1e92190ddf7f4bb94d4922ca1c1a12efadfd2c4c66f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\_ctypes.pyd
        • Size 139KB
        • SHA256 fd4847b99cd504a66bdc4739f15181b562774e6736bb88775880b073276dede1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\_hashlib.pyd
        • Size 67KB
        • SHA256 9bc6ffcd2ab4ac87c4035f18b432e888d0d4a36795c97bf3f28ddf32cc34e40f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\_lzma.pyd
        • Size 157KB
        • SHA256 39e5bc3624a26c9f6ad2e2df412543b0bd697a1d75338b44fe99763358d6d8cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\_uuid.pyd
        • Size 27KB
        • SHA256 635d6c46bbf6b86dd30a802bd1c6e214dabccb44d1452c52f0b557ae5bcc6f68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _zstd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\_zstd.pyd
        • Size 491KB
        • SHA256 54e6acfbc1cb27c9afea0e133cadac68b89869ff1a14eb0c678d40eb9c655347
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        amifldrv64.sys
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\amifldrv64.sys
        • Size 29KB
        • SHA256 65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        islandcleaner.exe
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\islandcleaner.exe
        • Size 22.1MB
        • SHA256 b192037d573e04729a4cf42a060cad837240fb714e17c8fcbe00e40229b6d0a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 8b27ebae75cc99f20075322446af36c9ffcb4e3b400a77d712ef43f007f47f7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyside6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\pyside6.abi3.dll
        • Size 242KB
        • SHA256 d4072be872b31f3748de5e6c28cb2976dafbf063d3ccfa38e5dabda29babcdaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\python3.dll
        • Size 72KB
        • SHA256 f3d0cd260a46a9617a8b1d4d5e8703278478c22a910165bffb4e4ddf6562d93f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python314.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\python314.dll
        • Size 6.5MB
        • SHA256 18310593c50ad109fc5c95db1fd5c92ecec9e1bfc66c976df9fc11dd62616d5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qt6core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\qt6core.dll
        • Size 10.0MB
        • SHA256 65fe6224b6c47a15b058738031d31dce9928c4d7a58e1b8db6434f6f5cddd702
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qt6gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\qt6gui.dll
        • Size 9.1MB
        • SHA256 cd071161ad325ff2de92b0e33d71334ef20712544796949623ce92dfb3957e90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qt6multimedia.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\qt6multimedia.dll
        • Size 1.2MB
        • SHA256 dc32f2cbb90e42d4daa3215f24fb42f5396911379d7f10e89df8cf14a765760a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qt6network.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\qt6network.dll
        • Size 1.7MB
        • SHA256 dfd0dd852274a5fe9b3c7d2dd9fffe7e2117d28c10fc862174d6675d42395177
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qt6widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\qt6widgets.dll
        • Size 6.3MB
        • SHA256 5a9f37dedd3dc5bcc1a4bb8ea919c49fc62df751a1450accc34379eb6710eab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shiboken6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\shiboken6.abi3.dll
        • Size 375KB
        • SHA256 47f4f9b44c95037565dd14f4be04f350f20c53c05483b750e0be867c39a7441e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Shiboken.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\shiboken6\Shiboken.pyd
        • Size 32KB
        • SHA256 0e2c5318c5ac60a016a12230bbb1f6a9d990c45cbf4a7c4af24aefb5ab7dc40a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\shiboken6\msvcp140.dll
        • Size 536KB
        • SHA256 005f2324c7ff79bbe9a44992b0708abb4c871bd24bcc7a34aca5eab4439c1f4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\shiboken6\msvcp140_1.dll
        • Size 26KB
        • SHA256 d878d7cb27187247a3ce1adfdf1f9b7b703e4429bc55f3e95284a43e80c10151
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\shiboken6\msvcp140_2.dll
        • Size 265KB
        • SHA256 c0ab58670a2cebaad8e7ef1f57d8f684a43bdf1c39d20a032088425905802655
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\vcruntime140.dll
        • Size 117KB
        • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1556_533278_E9FW_5M8EGM\vcruntime140_1.dll
        • Size 48KB
        • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3000-110-0x00007FF89FFA0000-0x00007FF8A02D3000-memory.dmp
        Download

        memory/3000-120-0x00007FF890F20000-0x00007FF8913D9000-memory.dmp
        Download

        memory/3000-124-0x00007FF8908D0000-0x00007FF890F1D000-memory.dmp
        Download