35274addfc3c6f698222621028a75be70476373429813b5494c5104ac44a45fb

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 2.6MB
Sample260426-ppaa6aa18y
SHA256 35274addfc3c6f698222621028a75be70476373429813b5494c5104ac44a45fb
MD5 52d5523ab55f52b7364a56ff4a19de35
SHA1 e4671bef3835b923625b68d4401a726aa981b3cc
SHA512 c069a495759d5ac969c907e2510bd0de48d809e1de59bc52d0fb1e1c38051ad05febbc68da6d1b962ee4a67b06bd85ea69321f6080c7de552580ee5f1835927e
SSDEEP 49152:zGZn2HpYAlK+7BV43Xm1OldI/Yq45ck4Evu:on2uqzpSn7u
TLSH
T118C59E07A36901EDD0A7C2B9CE565603F7B178461730BBDB06E086562FA3BE55E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

persistence privilege_escalation

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b468-2.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b468-2.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b468-2.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Executes dropped EXE 2 IoCs

pid	Process
3660	vi-agent.exe
3784	vi-agent.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\VisualIllusion Agent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\VisualIllusion Agent = "C:\\Users\\Admin\\AppData\\Roaming\\VisualIllusion\\vi-agent.exe"	vi-agent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\VisualIllusion Agent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\VisualIllusion Agent = "C:\\Users\\Admin\\AppData\\Roaming\\VisualIllusion\\vi-agent.exe"	vi-agent.exe

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	ifconfig.me
14	icanhazip.com
22	api.ipify.org
27	icanhazip.com
28	icanhazip.com
14	api.ipify.org

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vi-agent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	vi-agent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vi-agent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	vi-agent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vi-agent.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vi-agent.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3168	WMIC.exe
Token: SeSecurityPrivilege	3168	WMIC.exe
Token: SeTakeOwnershipPrivilege	3168	WMIC.exe
Token: SeLoadDriverPrivilege	3168	WMIC.exe
Token: SeSystemProfilePrivilege	3168	WMIC.exe
Token: SeSystemtimePrivilege	3168	WMIC.exe
Token: SeProfSingleProcessPrivilege	3168	WMIC.exe
Token: SeIncBasePriorityPrivilege	3168	WMIC.exe
Token: SeCreatePagefilePrivilege	3168	WMIC.exe
Token: SeBackupPrivilege	3168	WMIC.exe
Token: SeRestorePrivilege	3168	WMIC.exe
Token: SeShutdownPrivilege	3168	WMIC.exe
Token: SeDebugPrivilege	3168	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3168	WMIC.exe
Token: SeRemoteShutdownPrivilege	3168	WMIC.exe
Token: SeUndockPrivilege	3168	WMIC.exe
Token: SeManageVolumePrivilege	3168	WMIC.exe
Token: 33	3168	WMIC.exe
Token: 34	3168	WMIC.exe
Token: 35	3168	WMIC.exe
Token: 36	3168	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3168	WMIC.exe
Token: SeSecurityPrivilege	3168	WMIC.exe
Token: SeTakeOwnershipPrivilege	3168	WMIC.exe
Token: SeLoadDriverPrivilege	3168	WMIC.exe
Token: SeSystemProfilePrivilege	3168	WMIC.exe
Token: SeSystemtimePrivilege	3168	WMIC.exe
Token: SeProfSingleProcessPrivilege	3168	WMIC.exe
Token: SeIncBasePriorityPrivilege	3168	WMIC.exe
Token: SeCreatePagefilePrivilege	3168	WMIC.exe
Token: SeBackupPrivilege	3168	WMIC.exe
Token: SeRestorePrivilege	3168	WMIC.exe
Token: SeShutdownPrivilege	3168	WMIC.exe
Token: SeDebugPrivilege	3168	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3168	WMIC.exe
Token: SeRemoteShutdownPrivilege	3168	WMIC.exe
Token: SeUndockPrivilege	3168	WMIC.exe
Token: SeManageVolumePrivilege	3168	WMIC.exe
Token: 33	3168	WMIC.exe
Token: 34	3168	WMIC.exe
Token: 35	3168	WMIC.exe
Token: 36	3168	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4036	WMIC.exe
Token: SeSecurityPrivilege	4036	WMIC.exe
Token: SeTakeOwnershipPrivilege	4036	WMIC.exe
Token: SeLoadDriverPrivilege	4036	WMIC.exe
Token: SeSystemProfilePrivilege	4036	WMIC.exe
Token: SeSystemtimePrivilege	4036	WMIC.exe
Token: SeProfSingleProcessPrivilege	4036	WMIC.exe
Token: SeIncBasePriorityPrivilege	4036	WMIC.exe
Token: SeCreatePagefilePrivilege	4036	WMIC.exe
Token: SeBackupPrivilege	4036	WMIC.exe
Token: SeRestorePrivilege	4036	WMIC.exe
Token: SeShutdownPrivilege	4036	WMIC.exe
Token: SeDebugPrivilege	4036	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4036	WMIC.exe
Token: SeRemoteShutdownPrivilege	4036	WMIC.exe
Token: SeUndockPrivilege	4036	WMIC.exe
Token: SeManageVolumePrivilege	4036	WMIC.exe
Token: 33	4036	WMIC.exe
Token: 34	4036	WMIC.exe
Token: 35	4036	WMIC.exe
Token: 36	4036	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4036	WMIC.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 2972	3088	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	80
PID 2972 wrote to memory of 3168	2972	cmd.exe	82
PID 3088 wrote to memory of 904	3088	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	84
PID 904 wrote to memory of 4036	904	cmd.exe	86
PID 3088 wrote to memory of 4900	3088	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	87
PID 4900 wrote to memory of 1496	4900	cmd.exe	89
PID 3088 wrote to memory of 3964	3088	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	90
PID 3964 wrote to memory of 2264	3964	cmd.exe	92
PID 3088 wrote to memory of 3660	3088	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	93
PID 3660 wrote to memory of 4696	3660	vi-agent.exe	94
PID 4696 wrote to memory of 2932	4696	cmd.exe	96
PID 3660 wrote to memory of 4500	3660	vi-agent.exe	97
PID 4500 wrote to memory of 4208	4500	cmd.exe	99
PID 3660 wrote to memory of 5004	3660	vi-agent.exe	100
PID 5004 wrote to memory of 4004	5004	cmd.exe	102
PID 3208 wrote to memory of 744	3208	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	105
PID 744 wrote to memory of 3688	744	cmd.exe	107
PID 3660 wrote to memory of 1416	3660	vi-agent.exe	108
PID 1416 wrote to memory of 3152	1416	cmd.exe	110
PID 3208 wrote to memory of 2428	3208	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	111
PID 2428 wrote to memory of 400	2428	cmd.exe	113
PID 3208 wrote to memory of 2280	3208	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	114
PID 2280 wrote to memory of 4680	2280	cmd.exe	116
PID 3208 wrote to memory of 2024	3208	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	117
PID 2024 wrote to memory of 3508	2024	cmd.exe	119
PID 3784 wrote to memory of 2440	3784	vi-agent.exe	122
PID 2440 wrote to memory of 856	2440	cmd.exe	124
PID 3784 wrote to memory of 880	3784	vi-agent.exe	125
PID 880 wrote to memory of 4516	880	cmd.exe	127
PID 3784 wrote to memory of 3528	3784	vi-agent.exe	128
PID 3528 wrote to memory of 1816	3528	cmd.exe	130
PID 3784 wrote to memory of 2832	3784	vi-agent.exe	131
PID 2832 wrote to memory of 4024	2832	cmd.exe	133
PID 3660 wrote to memory of 1492	3660	vi-agent.exe	134
PID 3660 wrote to memory of 3312	3660	vi-agent.exe	136
PID 3208 wrote to memory of 1544	3208	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	138
PID 3784 wrote to memory of 4288	3784	vi-agent.exe	140
PID 3660 wrote to memory of 1664	3660	vi-agent.exe	142
PID 3784 wrote to memory of 1100	3784	vi-agent.exe	144
PID 3208 wrote to memory of 3172	3208	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	146
PID 3784 wrote to memory of 4924	3784	vi-agent.exe	148
PID 3660 wrote to memory of 3152	3660	vi-agent.exe	150
PID 3208 wrote to memory of 1668	3208	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	152
PID 3660 wrote to memory of 1140	3660	vi-agent.exe	154
PID 3784 wrote to memory of 1044	3784	vi-agent.exe	156
PID 3208 wrote to memory of 4600	3208	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	158
PID 3660 wrote to memory of 4568	3660	vi-agent.exe	160
PID 3784 wrote to memory of 396	3784	vi-agent.exe	162
PID 3208 wrote to memory of 4392	3208	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	164
PID 3660 wrote to memory of 5064	3660	vi-agent.exe	166
PID 3784 wrote to memory of 4460	3784	vi-agent.exe	168
PID 3208 wrote to memory of 4112	3208	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	170
PID 3660 wrote to memory of 1864	3660	vi-agent.exe	172
PID 3784 wrote to memory of 1496	3784	vi-agent.exe	174
PID 3208 wrote to memory of 2932	3208	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	176
PID 3660 wrote to memory of 680	3660	vi-agent.exe	178
PID 3784 wrote to memory of 1100	3784	vi-agent.exe	180
PID 3208 wrote to memory of 1308	3208	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	182
PID 3660 wrote to memory of 4332	3660	vi-agent.exe	184
PID 3784 wrote to memory of 2208	3784	vi-agent.exe	186
PID 3208 wrote to memory of 4868	3208	2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	188

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C wmic diskdrive get serialnumber /value 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3168
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C wmic baseboard get serialnumber /value 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber /value
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4036
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C wmic diskdrive get serialnumber /value 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber /value
    3⤵
    PID:1496
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /C wmic baseboard get serialnumber /value 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber /value
    3⤵
    PID:2264
- C:\Users\Admin\AppData\Roaming\VisualIllusion\vi-agent.exe
  "C:\Users\Admin\AppData\Roaming\VisualIllusion\vi-agent.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C wmic diskdrive get serialnumber /value 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      PID:2932
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C wmic baseboard get serialnumber /value 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      PID:4208
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C wmic diskdrive get serialnumber /value 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      PID:4004
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C wmic baseboard get serialnumber /value 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      PID:3152
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1492
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3312
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1664
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3152
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1140
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4568
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5064
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1864
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:680
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show interfaces
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4332

C:\Users\Admin\AppData\Local\Temp\2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
C:\Users\Admin\AppData\Local\Temp\2026-04-26_52d5523ab55f52b7364a56ff4a19de35_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\system32\cmd.exe
  cmd.exe /C wmic diskdrive get serialnumber /value 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber /value
    3⤵
    PID:3688
- C:\Windows\system32\cmd.exe
  cmd.exe /C wmic baseboard get serialnumber /value 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber /value
    3⤵
    PID:400
- C:\Windows\system32\cmd.exe
  cmd.exe /C wmic diskdrive get serialnumber /value 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber /value
    3⤵
    PID:4680
- C:\Windows\system32\cmd.exe
  cmd.exe /C wmic baseboard get serialnumber /value 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber /value
    3⤵
    PID:3508
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1544
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3172
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1668
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4600
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4392
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4112
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2932
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1308
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4868

C:\Users\Admin\AppData\Roaming\VisualIllusion\vi-agent.exe
C:\Users\Admin\AppData\Roaming\VisualIllusion\vi-agent.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\system32\cmd.exe
  cmd.exe /C wmic diskdrive get serialnumber /value 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber /value
    3⤵
    PID:856
- C:\Windows\system32\cmd.exe
  cmd.exe /C wmic baseboard get serialnumber /value 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber /value
    3⤵
    PID:4516
- C:\Windows\system32\cmd.exe
  cmd.exe /C wmic diskdrive get serialnumber /value 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic diskdrive get serialnumber /value
    3⤵
    PID:1816
- C:\Windows\system32\cmd.exe
  cmd.exe /C wmic baseboard get serialnumber /value 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber /value
    3⤵
    PID:4024
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4288
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1100
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4924
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1044
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:396
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4460
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1496
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:1100
- C:\Windows\system32\netsh.exe
  netsh wlan show interfaces
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

vi-agent.exe

Path C:\Users\Admin\AppData\Roaming\VisualIllusion\vi-agent.exe
Size 2.6MB
SHA256 35274addfc3c6f698222621028a75be70476373429813b5494c5104ac44a45fb
MD5 52d5523ab55f52b7364a56ff4a19de35
SHA1 e4671bef3835b923625b68d4401a726aa981b3cc
SHA512 c069a495759d5ac969c907e2510bd0de48d809e1de59bc52d0fb1e1c38051ad05febbc68da6d1b962ee4a67b06bd85ea69321f6080c7de552580ee5f1835927e
SSDEEP 49152:zGZn2HpYAlK+7BV43Xm1OldI/Yq45ck4Evu:on2uqzpSn7u
TLSH
T118C59E07A36901EDD0A7C2B9CE565603F7B178461730BBDB06E086562FA3BE55E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3088-3-0x00000196959D0000-0x0000019695A7F000-memory.dmp

Download

memory/3208-7-0x000001FE9A560000-0x000001FE9A60F000-memory.dmp

Download

memory/3208-28-0x000001FE9A610000-0x000001FE9A622000-memory.dmp

Download

memory/3660-6-0x00000259FEC40000-0x00000259FECEF000-memory.dmp

Download

memory/3660-26-0x00000259FF0F0000-0x00000259FF102000-memory.dmp

Download

memory/3784-8-0x00000164FA560000-0x00000164FA60F000-memory.dmp

Download

memory/3784-24-0x00000164F8A20000-0x00000164F8A32000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads