Overview

overview

10

Static

static

10

2026-08-21..._p.exe

windows10-2004-x64

7

2026-08-21..._p.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 11:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_30fde5ef1df0330de87e9e4ab5f3bdde_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
  • Size 102.9MB
  • Sample260821-nemytsdk4v
  • SHA256 bfa45660b0d351045783da391146a59e4819d80284bf540d0e09a34718a06ccd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Discovers running processes 1 TTPs 4 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Executes a command shell one-liner 1 TTPs 6 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks processor information in registry 2 TTPs 24 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_30fde5ef1df0330de87e9e4ab5f3bdde_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_30fde5ef1df0330de87e9e4ab5f3bdde_avaddon_cobalt-strike_coinminer_glassworm_icedid_njrat_p.exe"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:236
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "chcp"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:808
      • C:\Windows\system32\chcp.com
        chcp
        3⤵
          PID:5516
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4256
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:5376
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5576
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:4196
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4448
        • C:\Windows\system32\tasklist.exe
          tasklist
          3⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:4788
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "type .\client.ps1 | powershell.exe -noprofile -"
        2⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4592
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /S /D /c" type .\client.ps1 "
          3⤵
            PID:3272
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -noprofile -
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:6120
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x2ok005z\x2ok005z.cmdline"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:6044
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9522.tmp" "c:\Users\Admin\AppData\Local\Temp\x2ok005z\CSC556AA99724B74D4AA928FDBEB1762E85.TMP"
                5⤵
                  PID:3284
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "tasklist"
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5680
            • C:\Windows\system32\tasklist.exe
              tasklist
              3⤵
              • Discovers running processes
              • Suspicious use of AdjustPrivilegeToken
              PID:3928

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              RES9522.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\RES9522.tmp
              • Size 1KB
              • SHA256 3f4a2ab397447a95966a581532ea3bb72fac5aad307be58c575f09900cde5c29
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              client.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\client.ps1
              • Size 427B
              • SHA256 8c5a6fff7fd414a4020a4b30e35709016b2e4fcb2a8278483eb616b6856466fc
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              node_sqlite3.node
              • Path C:\Users\Admin\AppData\Local\Temp\pkg\152ddddf0ebc8fd9fdd0143778b6765e49678532a2b1e33e66adc235fa88b7a7\sqlite3\lib\binding\napi-v6-win32-unknown-x64\node_sqlite3.node
              • Size 1.6MB
              • SHA256 152ddddf0ebc8fd9fdd0143778b6765e49678532a2b1e33e66adc235fa88b7a7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              node-dpapi.node
              • Path C:\Users\Admin\AppData\Local\Temp\pkg\be9136c785fffef1181e15f6866e0c2f985904b6e96ab815387164b2f07d02ce\win-dpapi\build\Release\node-dpapi.node
              • Size 141KB
              • SHA256 be9136c785fffef1181e15f6866e0c2f985904b6e96ab815387164b2f07d02ce
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              x2ok005z.dll
              • Path C:\Users\Admin\AppData\Local\Temp\x2ok005z\x2ok005z.dll
              • Size 3KB
              • SHA256 cec6880902f289cb95f73f32f335f9f67631b6cdbe1777fb2c4c8c5cd9c63cd8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              CSC556AA99724B74D4AA928FDBEB1762E85.TMP
              • Path \??\c:\Users\Admin\AppData\Local\Temp\x2ok005z\CSC556AA99724B74D4AA928FDBEB1762E85.TMP
              • Size 652B
              • SHA256 2598fee4bfae4562c906f9888230f3d2df15d64a4242543bc9019a372987a165
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              x2ok005z.0.cs
              • Path \??\c:\Users\Admin\AppData\Local\Temp\x2ok005z\x2ok005z.0.cs
              • Size 331B
              • SHA256 26d220f0926af717fb195e1ec05f2ecccee3fbd37fa92148774bb5604557c9c9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              x2ok005z.cmdline
              • Path \??\c:\Users\Admin\AppData\Local\Temp\x2ok005z\x2ok005z.cmdline
              • Size 369B
              • SHA256 c2c99d8d10207a05d9215053a0552ad5e3fd339d3687ef8b8f3048bd871c808e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/6120-327-0x0000017254980000-0x00000172549A2000-memory.dmp
              Download

              memory/6120-328-0x0000017254A60000-0x0000017254AA8000-memory.dmp
              Download

              memory/6120-341-0x0000017254A40000-0x0000017254A48000-memory.dmp
              Download