Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/04/2026, 12:29
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 2.6MB
- Sample260426-ppaa6aa18y
- SHA256 35274addfc3c6f698222621028a75be70476373429813b5494c5104ac44a45fb
- MD5 52d5523ab55f52b7364a56ff4a19de35
- SHA1 e4671bef3835b923625b68d4401a726aa981b3cc
- SHA512 c069a495759d5ac969c907e2510bd0de48d809e1de59bc52d0fb1e1c38051ad05febbc68da6d1b962ee4a67b06bd85ea69321f6080c7de552580ee5f1835927e
- SSDEEP 49152:zGZn2HpYAlK+7BV43Xm1OldI/Yq45ck4Evu:on2uqzpSn7u
- TLSH T118C59E07A36901EDD0A7C2B9CE565603F7B178461730BBDB06E086562FA3BE55E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
resource yara_rule behavioral1/files/0x0008000000024510-2.dat INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
resource yara_rule behavioral1/files/0x0008000000024510-2.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
resource yara_rule behavioral1/files/0x0008000000024510-2.dat INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - Executes dropped EXE 2 IoCs
pid Process 4216 vi-agent.exe 2920 vi-agent.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VisualIllusion Agent = "C:\\Users\\Admin\\AppData\\Roaming\\VisualIllusion\\vi-agent.exe" vi-agent.exe Set value (str) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VisualIllusion Agent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe" 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VisualIllusion Agent = "C:\\Users\\Admin\\AppData\\Roaming\\VisualIllusion\\vi-agent.exe" vi-agent.exe Set value (str) \REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VisualIllusion Agent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe" 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe - Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 48 api.ipify.org 49 api.ipify.org 59 ifconfig.me 60 ifconfig.me 70 api.ipify.org - Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Checks processor information in registry 2 TTPs 11 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 vi-agent.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString vi-agent.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 vi-agent.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString vi-agent.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz vi-agent.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz vi-agent.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5020 WMIC.exe Token: SeSecurityPrivilege 5020 WMIC.exe Token: SeTakeOwnershipPrivilege 5020 WMIC.exe Token: SeLoadDriverPrivilege 5020 WMIC.exe Token: SeSystemProfilePrivilege 5020 WMIC.exe Token: SeSystemtimePrivilege 5020 WMIC.exe Token: SeProfSingleProcessPrivilege 5020 WMIC.exe Token: SeIncBasePriorityPrivilege 5020 WMIC.exe Token: SeCreatePagefilePrivilege 5020 WMIC.exe Token: SeBackupPrivilege 5020 WMIC.exe Token: SeRestorePrivilege 5020 WMIC.exe Token: SeShutdownPrivilege 5020 WMIC.exe Token: SeDebugPrivilege 5020 WMIC.exe Token: SeSystemEnvironmentPrivilege 5020 WMIC.exe Token: SeRemoteShutdownPrivilege 5020 WMIC.exe Token: SeUndockPrivilege 5020 WMIC.exe Token: SeManageVolumePrivilege 5020 WMIC.exe Token: 33 5020 WMIC.exe Token: 34 5020 WMIC.exe Token: 35 5020 WMIC.exe Token: 36 5020 WMIC.exe Token: SeIncreaseQuotaPrivilege 5020 WMIC.exe Token: SeSecurityPrivilege 5020 WMIC.exe Token: SeTakeOwnershipPrivilege 5020 WMIC.exe Token: SeLoadDriverPrivilege 5020 WMIC.exe Token: SeSystemProfilePrivilege 5020 WMIC.exe Token: SeSystemtimePrivilege 5020 WMIC.exe Token: SeProfSingleProcessPrivilege 5020 WMIC.exe Token: SeIncBasePriorityPrivilege 5020 WMIC.exe Token: SeCreatePagefilePrivilege 5020 WMIC.exe Token: SeBackupPrivilege 5020 WMIC.exe Token: SeRestorePrivilege 5020 WMIC.exe Token: SeShutdownPrivilege 5020 WMIC.exe Token: SeDebugPrivilege 5020 WMIC.exe Token: SeSystemEnvironmentPrivilege 5020 WMIC.exe Token: SeRemoteShutdownPrivilege 5020 WMIC.exe Token: SeUndockPrivilege 5020 WMIC.exe Token: SeManageVolumePrivilege 5020 WMIC.exe Token: 33 5020 WMIC.exe Token: 34 5020 WMIC.exe Token: 35 5020 WMIC.exe Token: 36 5020 WMIC.exe Token: SeIncreaseQuotaPrivilege 4748 WMIC.exe Token: SeSecurityPrivilege 4748 WMIC.exe Token: SeTakeOwnershipPrivilege 4748 WMIC.exe Token: SeLoadDriverPrivilege 4748 WMIC.exe Token: SeSystemProfilePrivilege 4748 WMIC.exe Token: SeSystemtimePrivilege 4748 WMIC.exe Token: SeProfSingleProcessPrivilege 4748 WMIC.exe Token: SeIncBasePriorityPrivilege 4748 WMIC.exe Token: SeCreatePagefilePrivilege 4748 WMIC.exe Token: SeBackupPrivilege 4748 WMIC.exe Token: SeRestorePrivilege 4748 WMIC.exe Token: SeShutdownPrivilege 4748 WMIC.exe Token: SeDebugPrivilege 4748 WMIC.exe Token: SeSystemEnvironmentPrivilege 4748 WMIC.exe Token: SeRemoteShutdownPrivilege 4748 WMIC.exe Token: SeUndockPrivilege 4748 WMIC.exe Token: SeManageVolumePrivilege 4748 WMIC.exe Token: 33 4748 WMIC.exe Token: 34 4748 WMIC.exe Token: 35 4748 WMIC.exe Token: 36 4748 WMIC.exe Token: SeIncreaseQuotaPrivilege 4748 WMIC.exe - Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 1540 wrote to memory of 4740 1540 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 84 PID 4740 wrote to memory of 5020 4740 cmd.exe 86 PID 1540 wrote to memory of 3928 1540 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 88 PID 3928 wrote to memory of 4748 3928 cmd.exe 90 PID 1540 wrote to memory of 4752 1540 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 91 PID 4752 wrote to memory of 4888 4752 cmd.exe 93 PID 1540 wrote to memory of 2156 1540 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 94 PID 2156 wrote to memory of 4284 2156 cmd.exe 96 PID 1540 wrote to memory of 4216 1540 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 97 PID 4216 wrote to memory of 5520 4216 vi-agent.exe 98 PID 5520 wrote to memory of 5656 5520 cmd.exe 100 PID 4216 wrote to memory of 5864 4216 vi-agent.exe 104 PID 5864 wrote to memory of 4772 5864 cmd.exe 106 PID 4988 wrote to memory of 5152 4988 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 108 PID 5152 wrote to memory of 2856 5152 cmd.exe 110 PID 4216 wrote to memory of 4472 4216 vi-agent.exe 111 PID 4472 wrote to memory of 5160 4472 cmd.exe 113 PID 4988 wrote to memory of 5512 4988 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 114 PID 5512 wrote to memory of 5412 5512 cmd.exe 116 PID 4216 wrote to memory of 1120 4216 vi-agent.exe 117 PID 1120 wrote to memory of 6104 1120 cmd.exe 119 PID 4988 wrote to memory of 3160 4988 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 120 PID 3160 wrote to memory of 4324 3160 cmd.exe 122 PID 4988 wrote to memory of 4236 4988 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 123 PID 4236 wrote to memory of 5836 4236 cmd.exe 125 PID 2920 wrote to memory of 5236 2920 vi-agent.exe 130 PID 5236 wrote to memory of 2540 5236 cmd.exe 132 PID 2920 wrote to memory of 656 2920 vi-agent.exe 133 PID 656 wrote to memory of 2820 656 cmd.exe 135 PID 2920 wrote to memory of 5364 2920 vi-agent.exe 136 PID 5364 wrote to memory of 64 5364 cmd.exe 138 PID 2920 wrote to memory of 2468 2920 vi-agent.exe 139 PID 2468 wrote to memory of 5480 2468 cmd.exe 141 PID 4216 wrote to memory of 2100 4216 vi-agent.exe 146 PID 4216 wrote to memory of 2036 4216 vi-agent.exe 148 PID 2920 wrote to memory of 5496 2920 vi-agent.exe 150 PID 4216 wrote to memory of 1928 4216 vi-agent.exe 152 PID 4216 wrote to memory of 5100 4216 vi-agent.exe 154 PID 2920 wrote to memory of 4692 2920 vi-agent.exe 156 PID 2920 wrote to memory of 3932 2920 vi-agent.exe 158 PID 4216 wrote to memory of 4724 4216 vi-agent.exe 160 PID 2920 wrote to memory of 5036 2920 vi-agent.exe 162 PID 4216 wrote to memory of 5448 4216 vi-agent.exe 164 PID 4216 wrote to memory of 2340 4216 vi-agent.exe 166 PID 2920 wrote to memory of 3896 2920 vi-agent.exe 168 PID 4216 wrote to memory of 3780 4216 vi-agent.exe 170 PID 2920 wrote to memory of 2792 2920 vi-agent.exe 171 PID 4216 wrote to memory of 5104 4216 vi-agent.exe 174 PID 2920 wrote to memory of 4776 2920 vi-agent.exe 176 PID 4216 wrote to memory of 2552 4216 vi-agent.exe 178 PID 2920 wrote to memory of 3884 2920 vi-agent.exe 180 PID 4216 wrote to memory of 3300 4216 vi-agent.exe 182 PID 2920 wrote to memory of 5172 2920 vi-agent.exe 184 PID 2920 wrote to memory of 1244 2920 vi-agent.exe 186 PID 4216 wrote to memory of 3668 4216 vi-agent.exe 188 PID 4216 wrote to memory of 2104 4216 vi-agent.exe 190 PID 2920 wrote to memory of 5436 2920 vi-agent.exe 192 PID 2920 wrote to memory of 3980 2920 vi-agent.exe 194 PID 4216 wrote to memory of 5168 4216 vi-agent.exe 196 PID 4988 wrote to memory of 2184 4988 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 198 PID 4988 wrote to memory of 6056 4988 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 200 PID 2920 wrote to memory of 932 2920 vi-agent.exe 202 PID 4988 wrote to memory of 5688 4988 2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 204 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C wmic diskdrive get serialnumber /value 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber /value3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C wmic baseboard get serialnumber /value 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber /value3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4748
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C wmic diskdrive get serialnumber /value 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber /value3⤵PID:4888
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C wmic baseboard get serialnumber /value 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber /value3⤵PID:4284
-
-
-
C:\Users\Admin\AppData\Roaming\VisualIllusion\vi-agent.exe"C:\Users\Admin\AppData\Roaming\VisualIllusion\vi-agent.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\SYSTEM32\cmd.execmd.exe /C wmic diskdrive get serialnumber /value 2>nul3⤵
- Suspicious use of WriteProcessMemory
PID:5520 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber /value4⤵PID:5656
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C wmic baseboard get serialnumber /value 2>nul3⤵
- Suspicious use of WriteProcessMemory
PID:5864 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber /value4⤵PID:4772
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C wmic diskdrive get serialnumber /value 2>nul3⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber /value4⤵PID:5160
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /C wmic baseboard get serialnumber /value 2>nul3⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber /value4⤵PID:6104
-
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show interfaces3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2100
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show interfaces3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2036
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show interfaces3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1928
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show interfaces3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:5100
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show interfaces3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4724
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show interfaces3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:5448
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show interfaces3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2340
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show interfaces3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3780
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show interfaces3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:5104
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show interfaces3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2552
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show interfaces3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3300
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show interfaces3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3668
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show interfaces3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2104
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show interfaces3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:5168
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exeC:\Users\Admin\AppData\Local\Temp\2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\system32\cmd.execmd.exe /C wmic diskdrive get serialnumber /value 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:5152 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber /value3⤵PID:2856
-
-
-
C:\Windows\system32\cmd.execmd.exe /C wmic baseboard get serialnumber /value 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber /value3⤵PID:5412
-
-
-
C:\Windows\system32\cmd.execmd.exe /C wmic diskdrive get serialnumber /value 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber /value3⤵PID:4324
-
-
-
C:\Windows\system32\cmd.execmd.exe /C wmic baseboard get serialnumber /value 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber /value3⤵PID:5836
-
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2184
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:6056
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:5688
-
-
C:\Users\Admin\AppData\Roaming\VisualIllusion\vi-agent.exeC:\Users\Admin\AppData\Roaming\VisualIllusion\vi-agent.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\system32\cmd.execmd.exe /C wmic diskdrive get serialnumber /value 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:5236 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber /value3⤵PID:2540
-
-
-
C:\Windows\system32\cmd.execmd.exe /C wmic baseboard get serialnumber /value 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber /value3⤵PID:2820
-
-
-
C:\Windows\system32\cmd.execmd.exe /C wmic diskdrive get serialnumber /value 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber /value3⤵PID:64
-
-
-
C:\Windows\system32\cmd.execmd.exe /C wmic baseboard get serialnumber /value 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber /value3⤵PID:5480
-
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:5496
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4692
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3932
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:5036
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3896
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:2792
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:4776
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3884
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:5172
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1244
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:5436
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:3980
-
-
C:\Windows\system32\netsh.exenetsh wlan show interfaces2⤵
- Event Triggered Execution: Netsh Helper DLL
PID:932
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\VisualIllusion\vi-agent.exe
- Size 2.6MB
- SHA256 35274addfc3c6f698222621028a75be70476373429813b5494c5104ac44a45fb
- MD5 52d5523ab55f52b7364a56ff4a19de35
- SHA1 e4671bef3835b923625b68d4401a726aa981b3cc
- SHA512 c069a495759d5ac969c907e2510bd0de48d809e1de59bc52d0fb1e1c38051ad05febbc68da6d1b962ee4a67b06bd85ea69321f6080c7de552580ee5f1835927e
- SSDEEP 49152:zGZn2HpYAlK+7BV43Xm1OldI/Yq45ck4Evu:on2uqzpSn7u
- TLSH T118C59E07A36901EDD0A7C2B9CE565603F7B178461730BBDB06E086562FA3BE55E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH