Overview

overview

7

Static

static

3

Island Spo...1).exe

windows10-2004-x64

7

Island Spo...1).exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/10/2026, 16:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Island Spoofer (1).exe
  • Size 93.3MB
  • Sample261006-t9xdmsff36
  • SHA256 10e2108e2096294915bc6a4eaef2e6ecaa37517f9ee9ebb052aaf934526d3f0b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Loads dropped DLL 33 IoCs
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Island Spoofer (1).exe
    "C:\Users\Admin\AppData\Local\Temp\Island Spoofer (1).exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Users\Admin\AppData\Local\Temp\Island Spoofer (1).exe
      "C:\Users\Admin\AppData\Local\Temp\Island Spoofer (1).exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of WriteProcessMemory
      PID:3260
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "tasklist /FI "IMAGENAME eq AMIDEWINx64.EXE""
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Windows\system32\tasklist.exe
          tasklist /FI "IMAGENAME eq AMIDEWINx64.EXE"
          4⤵
          • Discovers running processes
          • Suspicious use of AdjustPrivilegeToken
          PID:1504

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AMIDEWINx64.EXE
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\AMIDEWINx64.EXE
        • Size 455KB
        • SHA256 13037eedd91f9313ec0d807947db65c639642e5ae6497e87d12fa6d19951f78e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\PySide6\QtCore.pyd
        • Size 3.2MB
        • SHA256 74f96322c5e9cea73aefd2ed5870e5275336b31f552fcd32f12fc81d23f1bc6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\PySide6\QtGui.pyd
        • Size 3.7MB
        • SHA256 7bef20046045199c037b7cbfedaa1c5464730fa948b2c9ec8afbf718e63774d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtMultimedia.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\PySide6\QtMultimedia.pyd
        • Size 559KB
        • SHA256 646fc4ace4829c18eedf95deac00258d827d4a704b694027bd1f22162cd17fae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtNetwork.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\PySide6\QtNetwork.pyd
        • Size 985KB
        • SHA256 c5038bb71fc9d57330fa2d8eeec65aab69fcf02687cc8f54dbfb5995cfec6a71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\PySide6\QtWidgets.pyd
        • Size 4.6MB
        • SHA256 f12f4ca641998e5706d5f7b0023147d573f0f2d2361e26dadf31bdbf05fbfd1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\Qt6Core.dll
        • Size 9.9MB
        • SHA256 d6a3c37c5263c5d418fc0e80b722bc9fca7c0859e6f635f9624a2fde00bdc653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\Qt6Gui.dll
        • Size 9.1MB
        • SHA256 ae29b005f51b6850bf57fa06fced0dc8c7039fd6fafc3bfbcfe76e38adc7abf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Multimedia.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\Qt6Multimedia.dll
        • Size 1.2MB
        • SHA256 8974c64e7056179f81c9ce6d918b1956fe39e2dcf027b22e15ec0ab35ae883ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Network.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\Qt6Network.dll
        • Size 1.7MB
        • SHA256 dd3512d1c5ed062d30c98426cd0a850f13e0cf31437afb5b0b474132b9c52922
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VERSION_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\VERSION_1.dll
        • Size 7.5MB
        • SHA256 670ec3ddc4b9ab1ed449d7cded9db3d071dfaea18d2cdfac74f27ec4c7ace640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\_bz2.pyd
        • Size 82KB
        • SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\_ctypes.pyd
        • Size 121KB
        • SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\_hashlib.pyd
        • Size 63KB
        • SHA256 87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\_lzma.pyd
        • Size 155KB
        • SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\_uuid.pyd
        • Size 24KB
        • SHA256 e6aa7f1637e211251c9d6f467203b2b6d85e5bc2d901699f2a55af637fa89250
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        amifldrv64.sys
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\amifldrv64.sys
        • Size 29KB
        • SHA256 65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        amigendrv64.sys
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\amigendrv64.sys
        • Size 35KB
        • SHA256 b9e8de155fb9aabb4760034a65855130eb85aadc88963e40e2be87b049c025bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        islandcleaner.exe
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\islandcleaner.exe
        • Size 22.1MB
        • SHA256 b192037d573e04729a4cf42a060cad837240fb714e17c8fcbe00e40229b6d0a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        logo.png
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\logo.png
        • Size 1.2MB
        • SHA256 1be0392911b27c9d84402a347bc7caab3b8d860f416175135ad757cbe8cdd7ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyside6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\pyside6.abi3.dll
        • Size 249KB
        • SHA256 d0b5c701fb3a8ea839e72b602058f3960935156ebeca084893c54c99e54dd707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\python3.dll
        • Size 65KB
        • SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\python311.dll
        • Size 5.5MB
        • SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qt6widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\qt6widgets.dll
        • Size 6.2MB
        • SHA256 ff0df9e2e6827e035f0731a4cedfc6333f4602bca00775e56346f27032406b74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shiboken6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\shiboken6.abi3.dll
        • Size 384KB
        • SHA256 de3c6b2ed5f75c9ac0de4a6844b653b3b9d09263ce68c2b5fc25a96c5c3e8469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\shiboken6\MSVCP140.dll
        • Size 536KB
        • SHA256 fd4a8c046fa3fea9ca6132f50cf8a56cf1e783b2d3093ba5c85fa063bc6b3845
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\shiboken6\MSVCP140_2.dll
        • Size 265KB
        • SHA256 720091576d0e2669d16e8ad203a1f81a7c0811a6906452964d6e5fcb28a8de4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Shiboken.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\shiboken6\Shiboken.pyd
        • Size 32KB
        • SHA256 2f6f3a694f675b1dafdae26903191613c02866ab48e02591ae34ca1a3b1284f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msvcp140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\shiboken6\msvcp140_1.dll
        • Size 26KB
        • SHA256 7f556f0a0b944df7b64b916b344a070b7e6f6cf342194475594447ca88c07659
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\vcruntime140.dll
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_2288_134357788375285642\vcruntime140_1.dll
        • Size 48KB
        • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2288-118-0x00007FF73CB20000-0x00007FF742895000-memory.dmp
        Download

        memory/3260-107-0x00007FFAECF70000-0x00007FFAED2A7000-memory.dmp
        Download

        memory/3260-122-0x00007FFAEAD90000-0x00007FFAEB14C000-memory.dmp
        Download

        memory/3260-114-0x00007FFAEBA80000-0x00007FFAEC0B4000-memory.dmp
        Download

        memory/3260-119-0x00007FFAEC0C0000-0x00007FFAEC57A000-memory.dmp
        Download

        memory/3260-137-0x00007FFAEDD90000-0x00007FFAEE51F000-memory.dmp
        Download

        memory/3260-136-0x00007FF73CB20000-0x00007FF742895000-memory.dmp
        Download