cd7298ddadd00d1266f13aedf1bd76f3508175b61289792c8fc2a8bab49573b6

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 10:33

Target
2026-04-27_c9131b71d73c9af0bcf1ee2ea8555dfd_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc.exe
Size 683KB
Sample260427-mlvftabz2j
SHA256 cd7298ddadd00d1266f13aedf1bd76f3508175b61289792c8fc2a8bab49573b6
MD5 c9131b71d73c9af0bcf1ee2ea8555dfd
SHA1 1e28f496a014c3f88bf5826bce47a6818b4c3645
SHA512 1d56ba1cef38d34b9ef76f650bf72aa7d371051d0b0ca8ab39b0fd9492e714aaf5e646ad08f9d83eaee4311a47990d04e4c74ecae4213ca80bfdb655fec21a71
SSDEEP 12288:1k3DAQ9GZ8UwYouvHQxV+6GeaaiPku+4toDASntV8:1kTV9GZ8UwYzWV+6Gaz4tcNnD8
TLSH
T1B9E48E69EB5800FDD0B79079CA964912FBB27856036096EF03E14A971F1F6E05F3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 3964	1220	2026-04-27_c9131b71d73c9af0bcf1ee2ea8555dfd_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-04-27_c9131b71d73c9af0bcf1ee2ea8555dfd_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-27_c9131b71d73c9af0bcf1ee2ea8555dfd_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SYSTEM32\wsl.exe
  wsl -d Ubuntu -u root
  2⤵
  PID:3964