1d53e398b794239cfac9cdf291553d566c802f8166b6e809e4fe70fc14fe76eb

Analysis

max time kernel
8s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_840316eeedfb4d0f7a15681c761134ce_cloudeye_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 89.2MB
Sample260809-cj94daybre
SHA256 1d53e398b794239cfac9cdf291553d566c802f8166b6e809e4fe70fc14fe76eb
MD5 840316eeedfb4d0f7a15681c761134ce
SHA1 de4419c083c4100db9df3c650643699327070dad
SHA512 f8dd968fffb9ac008457014de6bb5e427dc36171a53cfefbf4e6fcfea705dd12f586f4c410c522796b70407f3f057eeeeab92273cc147e2cc30787a49d9fb5a4
SSDEEP 1572864:6He4hdV6xffH3ynQ3Y9GF0J2/3M4fvHLTkEY68xsqBJhmH11SZ5KhaoA:6He4DoxfPiI/0A/3/vHLosEeH+Aa5
TLSH
T1AD283327EAA908FDD0E1B67DD17F0595C363384F176640CB32AE42AF7EB65018E36642
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

command_and_control installer

Malware Config

Signatures

Outbound SSH connection to public host 2 TTPs 1 IoCs

SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

command_and_control

Protocol Tunneling

T1572

Network Service Discovery

T1046

description	flow	ioc
SSH destination	10	27.124.34.36:22

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3936-17-0x0000000000780000-0x0000000000867000-memory.dmp	innosetup
behavioral1/memory/3936-67-0x0000000000780000-0x0000000000867000-memory.dmp	innosetup
behavioral1/memory/3936-17-0x0000000000780000-0x0000000000867000-memory.dmp	innosetup
behavioral1/memory/3936-67-0x0000000000780000-0x0000000000867000-memory.dmp	innosetup

C:\Users\Admin\AppData\Local\Temp\2026-08-09_840316eeedfb4d0f7a15681c761134ce_cloudeye_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_840316eeedfb4d0f7a15681c761134ce_cloudeye_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
PID:1668
- C:\AMGjiang\wczt-win-8.8.8-x64\2345程序启动器.exe
  "C:\AMGjiang\wczt-win-8.8.8-x64\2345程序启动器.exe" /AMGjiang/wczt-win-8.8.8-x64/2345程序启动器.exe
  2⤵
  PID:3936
- - C:\Users\Admin\AppData\Local\Temp\is-KG2NP.tmp\2345程序启动器.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-KG2NP.tmp\2345程序启动器.tmp" /SL5="$7026A,16279085,888320,C:\AMGjiang\wczt-win-8.8.8-x64\2345程序启动器.exe" /AMGjiang/wczt-win-8.8.8-x64/2345程序启动器.exe
    3⤵
    PID:4360
  - - C:\msys64\DYdbya\ANZD\cucgYr\3Wuexe\PSBP.exe
      "C:\msys64\DYdbya\ANZD\cucgYr\3Wuexe\PSBP.exe"
      4⤵
      PID:4996
- C:\AMGjiang\wczt-win-8.8.8-x64\2345看图王.exe
  "C:\AMGjiang\wczt-win-8.8.8-x64\2345看图王.exe" /AMGjiang/wczt-win-8.8.8-x64/2345看图王.exe
  2⤵
  PID:2084

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Command and Control

Protocol Tunneling

T1572

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2345程序启动器.exe

Path C:\AMGjiang\wczt-win-8.8.8-x64\2345程序启动器.exe
Size 16.5MB
SHA256 20ecae55e32c2f948014db7f15b2e240311ec37ad49f2fdc698216ccf774f078
MD5 2bb0efff897e9cf6523ef3de7d68d33d
SHA1 c59a8ec5b3670065162ad7dc696aa40248d1a575
SHA512 5751c12eae03112f3cf937f54fccd132a906503912cbc9b4f255c9263bb110a290451e5adb74b6964d20c9ddf3fce6909e070960efa097000bb5a7c1df32c523
SSDEEP 393216:O+guVxdFiYUcj9VfRr5Z7TZhCSHS2HIpBvZfB5o1CWIo+6kNe:TgCxb1JVfRTTPxHS9pB1o14o+6d
TLSH
T14A073313F3CBD13EF45A0B3705B3959444FBBA656622AD1696E0C4ACCE6A0A41E7F703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2345程序启动器.exe

Path C:\AMGjiang\wczt-win-8.8.8-x64\2345程序启动器.exe
Size 1.4MB
SHA256 d2e26a5d04fea2189fd886b29133c19474b0d8c92199dae791d68895e1478b90
MD5 cc53e8519a72527de08ed3fada093bdf
SHA1 d6c25cdef0ea1602cf40dab314385e3a1368965c
SHA512 fc78f7688c2694c335e238bd0082605bb84c819ced1e975cf40515723e9a2b3c65b1dc9923e343b840520a6e4622c85b671bdf674a16967df2afe17d70b5abbf
SSDEEP 24576:saE+hTNrCHtLfTfuM7Djr5QpYrao2rupZdH7Xttd8ualyuDWarfekT5s+L39nZrm:4+MRvH7SNyIfeu5s+pndxOOwyAL
TLSH
T14265BF23B2CBE13EF46E4B370572A16494FB7A61A523AD1696E484ACCF360601D3F747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2345程序启动器.exe

Path C:\AMGjiang\wczt-win-8.8.8-x64\2345程序启动器.exe
Size 1.2MB
SHA256 58372d8e07a639ea891a9c620348f91092fa3aed29a69875bb1c42429cf06762
MD5 480eb3e0ea30ac6a61e29b2cd1c12ed1
SHA1 ff9ae3f576b0f54ec12c0a5dc5b3b38030cc7278
SHA512 1dc85d500f70f497408ae03ed9e0b012861495f5592d156d3741c73fbd14f3616381995a9227f3c7b884e3e1eca6ead9930dc98a38f142391a0240244606f833
SSDEEP 24576:saE+hTNrCHtLfTfuM7Djr5QpYrao2rupZdH7Xttd8ualyuDWarfekT5s+L39nZe:4+MRvH7SNyIfeu5s+pnI
TLSH
T1E3459E23B2CBE13EF46E4B370572A15494FB7A61A523AD1696E484ACCF360601E3F747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2345程序启动器.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-KG2NP.tmp\2345程序启动器.tmp
Size 918KB
SHA256 f4f74252435593fd10efaf52bc475ae031fa0b44857ed4dea3954825f66c5d9f
MD5 a880e655398d8b9d5ec5dcb8c54b93fa
SHA1 a6f37e2bb3f9f78de74e3f67d075d42960641d12
SHA512 343214ffeb84920a674c142bfd20bf4c53314b36b020f9b0653c49fd70db17073805d42d733e25f8aa97139812e8e4faa876f9a041ce5717b0b736fd795842ac
SSDEEP 12288:tHAFi1u19Ur/PrGZIlsk+HS64a4InvItUqGSK:tgFi1u1+r/vN+HS6T4InvISvD
TLSH
T102153A27B74EB53EF15E0A329973D010987B66A1A9078C67D7F4094CCF661812E3FA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2345程序启动器.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-KG2NP.tmp\2345程序启动器.tmp
Size 3.4MB
SHA256 cc67ae1681effe4857fd2a3a58db5de09a5dd5df32a6b29076b5c87182401743
MD5 7424f67052bc79358198a84850deadb7
SHA1 654b098793d0ca744735fc6e8b49442f4d899695
SHA512 187c7243edcde94393c0ad4b6b88cd07cd19501ca374ebb754652f6b056d580fc76737b93f65eb894a226bd88491351c83610ab8fe0d3d3f6d23a31af8de131f
SSDEEP 49152:HuAKxvISKIJhNRQSJ3MhjxIXhEzAWig8l1sXyKFz0ool5+UKL8333Oxp:HuAK6XMXhKAWwLsXah333O/
TLSH
T148F55C23F34D603EF06A1A399D379658583B7A606916CC5797FC3A8C8F361402E3A75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StdUtils.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm61E3.tmp\StdUtils.dll
Size 100KB
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
TLSH
T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm61E3.tmp\System.dll
Size 12KB
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
TLSH
T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm61E3.tmp\UAC.dll
Size 14KB
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
TLSH
T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsm61E3.tmp\nsDialogs.dll
Size 9KB
SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
TLSH
T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSBP.exe

Path C:\msys64\DYdbya\ANZD\cucgYr\3Wuexe\PSBP.exe
Size 672KB
SHA256 76efc8447f072fbb8507d55ca6ed73ebb64cf6069c437c13fe1741fa4b874b24
MD5 8bad2643c428132e93112abbe794a75e
SHA1 ea9aeaebc98954f8fffaeb344e85aaf8dd4f66a1
SHA512 f08419f1edc04c69df3ecb38b850c6add088f3b574b46bdfe8e9d309830facdbb6d001d3ad3c8e355f6270fbd8e486d6fe74e3b658989142debb76fed23e577a
SSDEEP 12288:PfM6NRgrZu6Z1kjdiSXSLAVZDNO4TRWzxeUC6WCD5aNTS2PBclGvKRNMQaNXi:Yg6rWXlnpO4tWzID6WHmCBcxBaNS
TLSH
T1E1E43383626D4EA2D4D496B8DB6FFA53982441B347C2EC2E1F267F784087D4F2673291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSBP.exe

Path C:\msys64\DYdbya\ANZD\cucgYr\3Wuexe\PSBP.exe
Size 1.2MB
SHA256 6b7b231a3abd906d50e85d1c8d6555928d6cefd9b973534afc8b5431f4dc5eea
MD5 8f6be6c49b85fd35f1abb4788e3fd999
SHA1 7c78a84c2fd83bdafa3cf5903a3fa875e316109d
SHA512 5a97d0dc80dc64812db2f1dd45499ec138a94eb865fe467e02bc1918763e2aa1f81cdb0621788411147980b6c5452a50bf6eeab20622d7930bdf25b808e2a040
SSDEEP 24576:Yg6rWXlnpO4tWzID6WHmCBcxBaNttpDzHVFyETbW:Yg6rWXlnpRtWWHmCOctp3VIETC
TLSH
T1F35501017F047FE1D482817055735FC929D5AF1227918A37BABCFB093E2B60A4E79BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

W.8

Path C:\msys64\DYdbya\ANZD\cucgYr\3Wuexe\W.8
Size 4.2MB
SHA256 1a6030be62167e3e7860b9381af2907ba23cb1f1aac7c61ee711007683f8d45c
MD5 28222b4cca07f8d43a2cdb1d2f062e05
SHA1 fb9f527801735db3d7a0590488d311b94c10c34a
SHA512 73154f4974692204d0c2db00635ce7ce35fd213b6d3035a9050026750850501e3e03c203b28090a457a77ef734a0652de5a96485bcd57230b3fff20f4e6473ee
SSDEEP 98304:lfZ9jd/WYyc/uf2AevhS6RW5T6k5yLfbDRqTNDQvJIUlbDKGca:f9jM9c/826T6k0FI8KGc
TLSH
T1A016DF5AD877CDBDE13F31B8C8A10756A052EB7545FA0D3686A4513CF72AB40BCB8329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mEsarb.QT

Path C:\msys64\DYdbya\ANZD\cucgYr\3Wuexe\mEsarb.QT
Size 10.1MB
SHA256 140a6a68738defcb7657c3c28d05356cda64d7bcfdad884eb97748c88d4725ce
MD5 b75b79650cb44d109eacdb4221b23b54
SHA1 25a3ec7e445106d4aa2cf133d1d656dabd0f53d4
SHA512 99b25ebed2caa7e1612df21adb76578b05d55642873e1b06b679d4df7b124027c9e1638219bc6ec0a29f7c81e6d8314c2ba940fa8a9bdf5e9494e6db1e3d6097
SSDEEP 196608:puKj8rRXU2ow4Sh/6MHaU64Vuv8u9DmbqUo1Vk1uGraaclG2W2JV9L:puO8rREb3MH7VkTFyqU47GrvCcGV9
TLSH
T112B63309C3F882B2DFA39C7136F745D405E1BAEA1FB1909C9510C59A05AEEFC93D2B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3936-17-0x0000000000780000-0x0000000000867000-memory.dmp

Download

memory/3936-67-0x0000000000780000-0x0000000000867000-memory.dmp

Download

memory/3936-67-0x0000000000780000-0x0000000000867000-memory.dmp

Download

memory/3936-17-0x0000000000780000-0x0000000000867000-memory.dmp

Download

memory/3936-16-0x0000000000835000-0x0000000000836000-memory.dmp

Download

memory/3936-16-0x0000000000835000-0x0000000000836000-memory.dmp

Download

memory/4204-79-0x000001F5B8C70000-0x000001F5BB171000-memory.dmp

Download

memory/4204-79-0x000001F5B8C70000-0x000001F5BB171000-memory.dmp

Download

memory/4204-81-0x000001F5B8C70000-0x000001F5BB171000-memory.dmp

Download

memory/4204-81-0x000001F5B8C70000-0x000001F5BB171000-memory.dmp

Download

memory/4204-85-0x000001F5B8C70000-0x000001F5BB171000-memory.dmp

Download

memory/4204-85-0x000001F5B8C70000-0x000001F5BB171000-memory.dmp

Download

memory/4360-66-0x00000000001C0000-0x000000000052F000-memory.dmp

Download

memory/4360-66-0x00000000001C0000-0x000000000052F000-memory.dmp

Download

memory/4996-76-0x0000020B9A2C0000-0x0000020B9C7C1000-memory.dmp

Download

memory/4996-77-0x0000020B9A2C0000-0x0000020B9C7C1000-memory.dmp

Download

memory/4996-78-0x0000020B9A2C0000-0x0000020B9C7C1000-memory.dmp

Download

memory/4996-69-0x0000020B9A2C0000-0x0000020B9C7C1000-memory.dmp

Download

memory/4996-71-0x0000020B9A2C0000-0x0000020B9C7C1000-memory.dmp

Download

memory/4996-75-0x0000020B9A2C0000-0x0000020B9C7C1000-memory.dmp

Download

memory/4996-76-0x0000020B9A2C0000-0x0000020B9C7C1000-memory.dmp

Download

memory/4996-78-0x0000020B9A2C0000-0x0000020B9C7C1000-memory.dmp

Download

memory/4996-77-0x0000020B9A2C0000-0x0000020B9C7C1000-memory.dmp

Download

memory/4996-75-0x0000020B9A2C0000-0x0000020B9C7C1000-memory.dmp

Download

memory/4996-71-0x0000020B9A2C0000-0x0000020B9C7C1000-memory.dmp

Download

memory/4996-69-0x0000020B9A2C0000-0x0000020B9C7C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads