Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 16:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_be13245186d3746fde828dce27880368_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260130-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_be13245186d3746fde828dce27880368_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe
Resource
win11-20260130-en
2 signatures
150 seconds
General
- Target 2026-04-15_be13245186d3746fde828dce27880368_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe
- Size 2.0MB
- Sample260415-tkc9gafv41
- SHA256 d86ce6455130c9bb7948cf478211b092919a7217b6020bc82e89c7f0abd99e58
- MD5 be13245186d3746fde828dce27880368
- SHA1 4e71e08b1cfbcb273c8143353638cbb2606c4fe2
- SHA512 f2c2906ceb1bdb4c6c428c734273a989a58338d68f629524b46951409e651b3a244570fac299c51c13bec670e128f17124a03ddc9e0744c38ed0920005fa1cf2
- SSDEEP 49152:kuAOFg4QmdSqHbw8YnFWA6ivLO1ONkZWwwTfPMAtoUhL01qn7t:O37i14Vn7t
- TLSH T17FA56D22B3F684ABC65782FD85340122EA347C942B184BDB711854ADAF776E07F3E761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 4320 2026-04-15_be13245186d3746fde828dce27880368_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4320 2026-04-15_be13245186d3746fde828dce27880368_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe 4320 2026-04-15_be13245186d3746fde828dce27880368_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe 4320 2026-04-15_be13245186d3746fde828dce27880368_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_be13245186d3746fde828dce27880368_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_be13245186d3746fde828dce27880368_cobalt-strike_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:4320