acfa3c6f7ffd0c2a05b04246d217c6dedd1faa44e0def35525aa0e843dabc6df

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 22:25

Target
2026-05-11_eda2e0fea6189accba36a18679e94109_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Size 4.9MB
Sample260511-2cbdxabs4y
SHA256 acfa3c6f7ffd0c2a05b04246d217c6dedd1faa44e0def35525aa0e843dabc6df
MD5 eda2e0fea6189accba36a18679e94109
SHA1 b0b6833ed6a1dd98246ab880ccfe4b658e2d69f9
SHA512 45c2bbcb17f44a10763a68839adc3828a37e734096830f8a30dfa12334c7b3b451574008130daca99a1cd8c8e2ff8ef56397c529952317a7cf3694e911e6c19c
SSDEEP 98304:yHJW97BuXwK/lgQ/6SS/lgQ/6SBDxRQL:yHJW97BuXmGvGBDx
TLSH
T18436BE4FE3A345E9C2B2E13CE5817327F5723424933563E76BC50A1A9F967E099B9320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 4292	5732	2026-05-11_eda2e0fea6189accba36a18679e94109_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-11_eda2e0fea6189accba36a18679e94109_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_eda2e0fea6189accba36a18679e94109_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:4292

memory/5732-0-0x000001BDDB940000-0x000001BDDBA6A000-memory.dmp

Download

memory/5732-3-0x000001BDDB940000-0x000001BDDBA6A000-memory.dmp

Download

memory/5732-13-0x000001BDDB940000-0x000001BDDBA6A000-memory.dmp

Download