Overview

overview

8

Static

static

5

2026-05-04...ar.exe

windows10-2004-x64

6

2026-05-04...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/05/2026, 18:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-04_7451e5235ddbce9a3396c69469bf09cd_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe
  • Size 4.4MB
  • Sample260504-wt45nahw7v
  • SHA256 835b56fc1f5b471ae8271e0762558a09e0bce20f69dcd882e54a06a02075cd14
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistenceupx

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 6 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-04_7451e5235ddbce9a3396c69469bf09cd_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-04_7451e5235ddbce9a3396c69469bf09cd_cobalt-strike_elex_glassworm_icedid_luca-stealer_njrat_vidar.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:5876
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 8812
      2⤵
      • Program crash
      PID:824
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 8840
      2⤵
      • Program crash
      PID:5664
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5876 -ip 5876
    1⤵
      PID:1420
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5876 -ip 5876
      1⤵
        PID:2008

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            wkw4D2.tmp
            • Path C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
            • Size 4.7MB
            • SHA256 06b5661a6b4e41c20609bd7a3a168fe4e435a4b45c396d78e9bd41e9005f76da
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/5876-297-0x0000000000400000-0x0000000000478000-memory.dmp
            Download

            memory/5876-1-0x0000000000460000-0x0000000000461000-memory.dmp
            Download

            memory/5876-0-0x0000000000400000-0x0000000000478000-memory.dmp
            Download

            memory/5876-2-0x0000000000400000-0x0000000000478000-memory.dmp
            Download

            memory/5876-298-0x000000000A460000-0x000000000A4F6000-memory.dmp
            Download

            memory/5876-4-0x0000000000400000-0x0000000000478000-memory.dmp
            Download

            memory/5876-519-0x0000000000400000-0x0000000000478000-memory.dmp
            Download

            memory/5876-538-0x0000000000400000-0x0000000000478000-memory.dmp
            Download

            memory/5876-536-0x0000000000400000-0x0000000000478000-memory.dmp
            Download

            memory/5876-739-0x0000000000400000-0x0000000000478000-memory.dmp
            Download

            memory/5876-997-0x0000000000400000-0x0000000000478000-memory.dmp
            Download

            memory/5876-1143-0x0000000000400000-0x0000000000478000-memory.dmp
            Download