Overview

overview

10

Static

static

10

2026-08-04...sw.exe

windows10-2004-x64

10

2026-08-04...sw.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 21:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_163c17e6be81606819ee06148a92d92d_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
  • Size 13.2MB
  • Sample260804-zzy3dazgqb
  • SHA256 5de300978d345fce68fb7db954aee9ad1cf4f563bb5e759c7b58e6c09752b4b4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionmimikatzinstallerpersistenceprivilege_escalationupx

Malware Config

Signatures

  • Family: Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz
  • mimikatz is an open source tool to dump credentials on Windows 4 IoCs
  • UPX dump on OEP (original entry point) 8 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 44 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    defense_evasion
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 11 IoCs
  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    remove IFEO.

    defense_evasion
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Creates a Windows Service
    persistence
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 13 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 55 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • NSIS installer 1 IoCs
    installer
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 14 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_163c17e6be81606819ee06148a92d92d_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_163c17e6be81606819ee06148a92d92d_amadey_cloudeye_coinminer_dragonforce_elex_emotet_glassw.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5448
    • C:\Users\Admin\AppData\Local\Temp\hentai.exe
      C:\Users\Admin\AppData\Local\Temp\hentai.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4248
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\qnuegnzs\cacbyhl.exe
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:5232
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 5
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:2040
      • C:\Windows\qnuegnzs\cacbyhl.exe
        C:\Windows\qnuegnzs\cacbyhl.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2244
        • C:\Users\Admin\AppData\Local\Temp\hentai.exe
          C:\Users\Admin\AppData\Local\Temp\hentai.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2728
  • C:\Windows\SysWOW64\ogmqgi.exe
    C:\Windows\SysWOW64\ogmqgi.exe
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5752
  • C:\Windows\qnuegnzs\cacbyhl.exe
    C:\Windows\qnuegnzs\cacbyhl.exe
    1⤵
    • Drops file in Drivers directory
    • Event Triggered Execution: Image File Execution Options Injection
    • Executes dropped EXE
    • Indicator Removal: Clear Persistence
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5932
    • C:\Windows\TEMP\hentai.exe
      C:\Windows\TEMP\hentai.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2884
    • C:\Windows\qnuegnzs\dslbascnldgyjal3265.exe
      C:\Windows\qnuegnzs\dslbascnldgyjal3265.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:52
    • C:\Windows\SysWOW64\netsh.exe
      netsh ipsec static delete all
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:3892
    • C:\Windows\SysWOW64\netsh.exe
      netsh ipsec static add policy name=Bastards description=FuckingBastards
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:2688
    • C:\Windows\SysWOW64\netsh.exe
      netsh ipsec static add filteraction name=BastardsList action=block
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:2664
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "nesebtsdb" /ru system /tr "cmd /c C:\Windows\Fonts\cacbyhl.exe"
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5352
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "nesebtsdb" /ru system /tr "cmd /c C:\Windows\Fonts\cacbyhl.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:5004
    • C:\Windows\SysWOW64\netsh.exe
      netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:1996
    • C:\Windows\SysWOW64\netsh.exe
      netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:5496
    • C:\Windows\SysWOW64\netsh.exe
      netsh ipsec static add rule name=FuckingBastards policy=Bastards filterlist=BastardsList filteraction=BastardsList
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:5636
    • C:\Windows\SysWOW64\netsh.exe
      netsh ipsec static set policy name=Bastards assign=y
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:3936
    • C:\Windows\SysWOW64\netsh.exe
      netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:2624
    • C:\Windows\SysWOW64\netsh.exe
      netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:5632
    • C:\Windows\SysWOW64\netsh.exe
      netsh ipsec static add rule name=FuckingBastards policy=Bastards filterlist=BastardsList filteraction=BastardsList
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:4640
    • C:\Windows\SysWOW64\netsh.exe
      netsh ipsec static set policy name=Bastards assign=y
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:1084
    • C:\Windows\SysWOW64\netsh.exe
      netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:1216
    • C:\Windows\SysWOW64\netsh.exe
      netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:6096
    • C:\Windows\SysWOW64\netsh.exe
      netsh ipsec static add rule name=FuckingBastards policy=Bastards filterlist=BastardsList filteraction=BastardsList
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:2716
    • C:\Windows\SysWOW64\netsh.exe
      netsh ipsec static set policy name=Bastards assign=y
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:3144
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop SharedAccess
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Windows\SysWOW64\net.exe
        net stop SharedAccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5836
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop SharedAccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1380
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c netsh firewall set opmode mode=disable
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4124
      • C:\Windows\SysWOW64\netsh.exe
        netsh firewall set opmode mode=disable
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4484
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c netsh Advfirewall set allprofiles state off
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3604
      • C:\Windows\SysWOW64\netsh.exe
        netsh Advfirewall set allprofiles state off
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:1912
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop MpsSvc
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4112
      • C:\Windows\SysWOW64\net.exe
        net stop MpsSvc
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4772
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop MpsSvc
          4⤵
          • System Location Discovery: System Language Discovery
          PID:692
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop WinDefend
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4992
      • C:\Windows\SysWOW64\net.exe
        net stop WinDefend
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2340
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop WinDefend
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2332
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c net stop wuauserv
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1332
      • C:\Windows\SysWOW64\net.exe
        net stop wuauserv
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5692
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop wuauserv
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3452
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c sc config MpsSvc start= disabled
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5596
      • C:\Windows\SysWOW64\sc.exe
        sc config MpsSvc start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:4340
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c sc config SharedAccess start= disabled
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4232
      • C:\Windows\SysWOW64\sc.exe
        sc config SharedAccess start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:5588
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c sc config WinDefend start= disabled
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4476
      • C:\Windows\SysWOW64\sc.exe
        sc config WinDefend start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2608
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c sc config wuauserv start= disabled
      2⤵
      • Executes a command shell one-liner
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5832
      • C:\Windows\SysWOW64\sc.exe
        sc config wuauserv start= disabled
        3⤵
        • Launches sc.exe
        • System Location Discovery: System Language Discovery
        PID:2120
  • C:\Windows\system32\cmd.exe
    cmd
    1⤵
      PID:1880
    • C:\Windows\system32\cmd.EXE
      "C:\Windows\system32\cmd.EXE" /c C:\Windows\Fonts\cacbyhl.exe
      1⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:520
      • C:\Windows\Fonts\cacbyhl.exe
        C:\Windows\Fonts\cacbyhl.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3684
        • C:\Windows\TEMP\hentai.exe
          C:\Windows\TEMP\hentai.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3844
    • C:\Windows\system32\cmd.EXE
      "C:\Windows\system32\cmd.EXE" /c C:\Windows\Fonts\cacbyhl.exe
      1⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1496
      • C:\Windows\Fonts\cacbyhl.exe
        C:\Windows\Fonts\cacbyhl.exe
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4084
        • C:\Windows\TEMP\hentai.exe
          C:\Windows\TEMP\hentai.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1844

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          Windows Command Shell

          1
          T1059.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Persistence

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Event Triggered Execution

          2
          T1546

          Image File Execution Options Injection

          1
          T1546.012

          Netsh Helper DLL

          1
          T1546.007

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Event Triggered Execution

          2
          T1546

          Image File Execution Options Injection

          1
          T1546.012

          Netsh Helper DLL

          1
          T1546.007

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Impair Defenses

          1
          T1562

          Disable or Modify System Firewall

          1
          T1562.004

          Indicator Removal

          1
          T1070

          Clear Persistence

          1
          T1070.009

          Credential Access

          Discovery

          Network Share Discovery

          1
          T1135

          Remote System Discovery

          1
          T1018

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Service Stop

          1
          T1489

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          hentai.exe
          • Path C:\Users\Admin\AppData\Local\Temp\hentai.exe
          • Size 64KB
          • SHA256 7776bb0e5a62e12498d89cf7f34ef2d1fad3ccef52cbb9d5c62ef492f4e3873d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cacbyhl.exe
          • Path C:\Windows\qnuegnzs\cacbyhl.exe
          • Size 13.2MB
          • SHA256 8d7162aa09adbee498d2f14658c19be109e682916c24d575398c5516f0574449
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dslbascnldgyjal3265.exe
          • Path C:\Windows\qnuegnzs\dslbascnldgyjal3265.exe
          • Size 69KB
          • SHA256 3d06ca12e9d6e3effe5fcbb87ebd16d4e978b9657374e3d0fb3c81725d415a98
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/52-38-0x0000000000400000-0x0000000000469000-memory.dmp
          Download

          memory/52-44-0x0000000000400000-0x0000000000469000-memory.dmp
          Download

          memory/2244-18-0x0000000000400000-0x0000000000D0F000-memory.dmp
          Download

          memory/4248-8-0x0000000010000000-0x0000000010008000-memory.dmp
          Download

          memory/4248-15-0x0000000000400000-0x0000000000410000-memory.dmp
          Download

          memory/5448-0-0x0000000000400000-0x0000000000D0F000-memory.dmp
          Download

          memory/5448-7-0x0000000000400000-0x0000000000D0F000-memory.dmp
          Download

          memory/5932-36-0x0000000010000000-0x000000001000B000-memory.dmp
          Download