Overview

overview

10

Static

static

10

2026-08-21...di.exe

windows10-2004-x64

7

2026-08-21...di.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 03:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_f4113028f3d1056caf115e73a4c86658_avaddon_byakugan_cobalt-strike_coinminer_glassworm_icedi.exe
  • Size 105.6MB
  • Sample260821-eakhgafr4t
  • SHA256 85a2798f6522f018ee4ca808b51907a6d0086f1b9a156f234658382c16e8aaba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Discovers running processes 1 TTPs 4 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_f4113028f3d1056caf115e73a4c86658_avaddon_byakugan_cobalt-strike_coinminer_glassworm_icedi.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_f4113028f3d1056caf115e73a4c86658_avaddon_byakugan_cobalt-strike_coinminer_glassworm_icedi.exe"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3368
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:900
      • C:\Windows\system32\chcp.com
        chcp
        3⤵
          PID:1760
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2824
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:5668
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5492
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:3752
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4552
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:3872
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "type .\client.ps1 | powershell.exe -noprofile -"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2308
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" type .\client.ps1 "
          3⤵
            PID:2948
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -noprofile -
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2380
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\isw1tt21\isw1tt21.cmdline"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3176
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E33.tmp" "c:\Users\Admin\AppData\Local\Temp\isw1tt21\CSC264053DC3794E419C3E2F5AD0E0FB20.TMP"
                5⤵
                  PID:5440
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "tasklist"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4728
            • C:\Windows\system32\tasklist.exe
              tasklist
              3⤵
              • Discovers running processes
              • Suspicious use of AdjustPrivilegeToken
              PID:4856

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              RES5E33.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\RES5E33.tmp
              • Size 1KB
              • SHA256 5b61be9d585e1dcac348a1492cf9b9effe185f2c8a574a1f8d7104f667f4c87d
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              client.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\client.ps1
              • Size 427B
              • SHA256 8c5a6fff7fd414a4020a4b30e35709016b2e4fcb2a8278483eb616b6856466fc
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              isw1tt21.dll
              • Path C:\Users\Admin\AppData\Local\Temp\isw1tt21\isw1tt21.dll
              • Size 3KB
              • SHA256 fee7ae8acaa6ec1eeae6cbdc85dd9fed465b84921a13e37730363459a7059264
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              node_sqlite3.node
              • Path C:\Users\Admin\AppData\Local\Temp\pkg\152ddddf0ebc8fd9fdd0143778b6765e49678532a2b1e33e66adc235fa88b7a7\sqlite3\lib\binding\napi-v6-win32-unknown-x64\node_sqlite3.node
              • Size 1.6MB
              • SHA256 152ddddf0ebc8fd9fdd0143778b6765e49678532a2b1e33e66adc235fa88b7a7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              node-dpapi.node
              • Path C:\Users\Admin\AppData\Local\Temp\pkg\6086e5ba068f014bae31c6d2a7d914e1d4673e11a2330d311259b55b4b15d2c4\win-dpapi\build\Release\node-dpapi.node
              • Size 141KB
              • SHA256 6086e5ba068f014bae31c6d2a7d914e1d4673e11a2330d311259b55b4b15d2c4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              CSC264053DC3794E419C3E2F5AD0E0FB20.TMP
              • Path \??\c:\Users\Admin\AppData\Local\Temp\isw1tt21\CSC264053DC3794E419C3E2F5AD0E0FB20.TMP
              • Size 652B
              • SHA256 cc29c879fa07044d4cbeee87566a87d76de4ba777c76f50e06fcd3501198604a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              isw1tt21.0.cs
              • Path \??\c:\Users\Admin\AppData\Local\Temp\isw1tt21\isw1tt21.0.cs
              • Size 331B
              • SHA256 26d220f0926af717fb195e1ec05f2ecccee3fbd37fa92148774bb5604557c9c9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              isw1tt21.cmdline
              • Path \??\c:\Users\Admin\AppData\Local\Temp\isw1tt21\isw1tt21.cmdline
              • Size 369B
              • SHA256 0a5904cc6d0d9855f4c75ba874f91826feb72ca5b3b9a4f5ceaddb550515d7a7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/2380-327-0x000001AD31590000-0x000001AD315B2000-memory.dmp
              Download

              memory/2380-330-0x000001AD31B10000-0x000001AD31B58000-memory.dmp
              Download

              memory/2380-344-0x000001AD31600000-0x000001AD31608000-memory.dmp
              Download

              memory/3176-342-0x000001D4FD190000-0x000001D4FDB34000-memory.dmp
              Download