Analysis
- max time kernel
149s - max time network
112s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
25/04/2026, 01:35
General
- Target 2026-04-25_534fc2f1ab6d0995880aa58bbf5b2a83_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe
- Size 21.2MB
- Sample260425-bzyvlsbs2t
- SHA256 1006bdf49bccacc8f86d98641b84b99bcc3b1b9ded64ab39be678c007374317c
Malware Config
Signatures
- Detects executables Discord URL observed in first stage droppers 3 IoCs
- Detects executables packed with ConfuserEx Mod 3 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-25_534fc2f1ab6d0995880aa58bbf5b2a83_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-25_534fc2f1ab6d0995880aa58bbf5b2a83_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\evwdjw30.exe"C:\Users\Admin\AppData\Local\Temp\evwdjw30.exe" "--cleanup" "C:\Users\Admin\AppData\Local\Temp\2026-04-25_534fc2f1ab6d0995880aa58bbf5b2a83_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
evwdjw30.exe
memory/2180-0-0x00007FF6209A0000-0x00007FF621ED4000-memory.dmp
memory/2180-1-0x0000021575260000-0x0000021575CAE000-memory.dmp
memory/2180-2-0x000002155C5C0000-0x000002155C5D0000-memory.dmp
memory/2180-3-0x0000021575E80000-0x0000021576042000-memory.dmp
memory/2180-9-0x0000021574D20000-0x0000021575098000-memory.dmp
memory/2180-10-0x000002155AC80000-0x000002155AC8C000-memory.dmp
memory/3164-14-0x000002A3EEB10000-0x000002A3EEE88000-memory.dmp
memory/3164-13-0x000002A3EEF40000-0x000002A3EEF50000-memory.dmp
memory/3164-16-0x000002A3EEEA0000-0x000002A3EEEB2000-memory.dmp
memory/3164-12-0x00007FF791D70000-0x00007FF7932A4000-memory.dmp
memory/3164-15-0x000002A3D4AB0000-0x000002A3D4ABC000-memory.dmp
memory/3164-17-0x000002A3EEF40000-0x000002A3EEF50000-memory.dmp
memory/3164-21-0x000002A3EEB10000-0x000002A3EEE88000-memory.dmp
memory/3164-27-0x000002A3F03C0000-0x000002A3F08E8000-memory.dmp
memory/3164-28-0x000002A3EEB10000-0x000002A3EEE88000-memory.dmp
memory/3164-34-0x000002A3EEB10000-0x000002A3EEE88000-memory.dmp
memory/3164-37-0x000002A3EEB10000-0x000002A3EEE88000-memory.dmp
memory/3164-43-0x000002A3EEB10000-0x000002A3EEE88000-memory.dmp
memory/3164-52-0x000002A3EEB10000-0x000002A3EEE88000-memory.dmp