Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
25/04/2026, 01:35
General
- Target 2026-04-25_534fc2f1ab6d0995880aa58bbf5b2a83_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
- Size 21.2MB
- Sample260425-bzyvlsbs2t
- SHA256 1006bdf49bccacc8f86d98641b84b99bcc3b1b9ded64ab39be678c007374317c
Score
9/10
Malware Config
Signatures
- Detects executables Discord URL observed in first stage droppers 3 IoCs
- Detects executables packed with ConfuserEx Mod 3 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-25_534fc2f1ab6d0995880aa58bbf5b2a83_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-25_534fc2f1ab6d0995880aa58bbf5b2a83_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\q7bd3sax.exe"C:\Users\Admin\AppData\Local\Temp\q7bd3sax.exe" "--cleanup" "C:\Users\Admin\AppData\Local\Temp\2026-04-25_534fc2f1ab6d0995880aa58bbf5b2a83_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
q7bd3sax.exe
memory/4764-12-0x00007FF61F980000-0x00007FF620EB4000-memory.dmp
memory/4764-13-0x00000281023E0000-0x00000281023F0000-memory.dmp
memory/4764-14-0x00000281021A0000-0x00000281021D0000-memory.dmp
memory/4764-15-0x0000028102330000-0x000002810233C000-memory.dmp
memory/4764-16-0x00000281023E0000-0x00000281023F0000-memory.dmp
memory/4956-0-0x00007FF6008E0000-0x00007FF601E14000-memory.dmp
memory/4956-1-0x000002A22EA10000-0x000002A22F45E000-memory.dmp
memory/4956-2-0x000002A22EA00000-0x000002A22EA10000-memory.dmp
memory/4956-3-0x000002A22F630000-0x000002A22F7F2000-memory.dmp
memory/4956-11-0x000002A214880000-0x000002A21488C000-memory.dmp
memory/4956-10-0x000002A214810000-0x000002A214840000-memory.dmp