73cec50537b0b3014f6fa2b9bc394c7f8375a6ed09f104db1ad71b93581eaf0b

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 23:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_9f80238f09128889b03db52612b0f5bc_cobalt-strike_coinminer_glassworm_icedid_njrat_pos_satacom_stealc_vidar_zxxz.exe
Size 42.9MB
Sample260825-2y1wpabb44
SHA256 73cec50537b0b3014f6fa2b9bc394c7f8375a6ed09f104db1ad71b93581eaf0b
MD5 9f80238f09128889b03db52612b0f5bc
SHA1 dda307d164501d541c7d1467215fc0b6a0f9db0e
SHA512 c7ea8b19d37df58ae6fd26b876f0a7166336c69408d64cb201eaa78d4fd17a03414472631502b2f890abd76838b7b99c0d065fb897ed516aa7c48f3633728f27
SSDEEP 786432:d0LoCOn+2fs4urYDNulLBiusoI6S9LMUuMs0vurKPcI9fk6:dMoCm/fXwB6
TLSH
T126A78C0673E10196E4B7D2388AAB4103E373B4635735CBDB719C03582FABAE45A7B764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4680	2026-08-23_9f80238f09128889b03db52612b0f5bc_cobalt-strike_coinminer_glassworm_icedid_njrat_pos_satacom_stealc_vidar_zxxz.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4440	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4440	4680	2026-08-23_9f80238f09128889b03db52612b0f5bc_cobalt-strike_coinminer_glassworm_icedid_njrat_pos_satacom_stealc_vidar_zxxz.exe	88
PID 4440 wrote to memory of 1188	4440	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-23_9f80238f09128889b03db52612b0f5bc_cobalt-strike_coinminer_glassworm_icedid_njrat_pos_satacom_stealc_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_9f80238f09128889b03db52612b0f5bc_cobalt-strike_coinminer_glassworm_icedid_njrat_pos_satacom_stealc_vidar_zxxz.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "chcp"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\system32\chcp.com
    chcp
    3⤵
    PID:1188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

node-hide-console-window.node

Path C:\Users\Admin\AppData\Local\Temp\pkg\843d7274003f1a7ba97ce9de5fca93cfe77764af8cf76a2e93c829a23000433f\node-hide-console-window\build\Release\node-hide-console-window.node
Size 96KB
SHA256 843d7274003f1a7ba97ce9de5fca93cfe77764af8cf76a2e93c829a23000433f
MD5 fa72122ededa16187ac08eaf43058fa0
SHA1 e69bbb1af655783d6d4bada4b330f33de7b7026a
SHA512 a5d87b2e7b54d9f9fecf47e636f16f951bb8b3a3fa5a513fc2f141bec6792741976b6e5749ef42cf20532d920c72bd038da5dfb3c73204f9da5a00bebb9e6690
SSDEEP 1536:wC2kW4Lu0vU7SyrS8SUqGnmlG5voqGw2zXJl0QsWUgEd09dlG+KcWCcutA:v2kW4C0s2yrBsGmE5vm1zXP0RxM0xcW7
TLSH
T116A35A6BB3E500BBE4724638C4630E12D776F8511A219B6F53A4065E1F633D19E3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download