Overview

overview

7

Static

static

3

2026-05-06...ar.exe

windows10-2004-x64

7

2026-05-06...ar.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    06/05/2026, 17:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-06_a621d63c8f10501e7629dd69e07d3cb8_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 8.3MB
  • Sample260506-vmd48aez41
  • SHA256 f70302e7e3744a9983ddab40d6b3ed4af212dedc5029ae1bce53cb8aed81afa1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 5 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-06_a621d63c8f10501e7629dd69e07d3cb8_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-06_a621d63c8f10501e7629dd69e07d3cb8_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3984
    • C:\Users\Admin\AppData\Local\Temp\2026-05-06_a621d63c8f10501e7629dd69e07d3cb8_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-05-06_a621d63c8f10501e7629dd69e07d3cb8_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      PID:4608

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _imaging.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39842\PIL\_imaging.cp311-win_amd64.pyd
        • Size 2.3MB
        • SHA256 f82bd3cf95e02749ff1adff76725e3645e17c2780954bd724ed63ef6827633f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39842\VCRUNTIME140.dll
        • Size 106KB
        • SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39842\_bz2.pyd
        • Size 82KB
        • SHA256 a4dd883257a7ace84f96bcc6cd59e22d843d0db080606defae32923fc712c75a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39842\_lzma.pyd
        • Size 155KB
        • SHA256 1796038480754a680f33a4e37c8b5673cc86c49281a287dc0c5cae984d0cb4bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39842\base_library.zip
        • Size 1.8MB
        • SHA256 ff6a37c49ee4bb07a763866d4163126165038296c1fb7b730928297c25cfbe6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI39842\python311.dll
        • Size 5.5MB
        • SHA256 a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download