eee8a0daac29a130937a00c090d67af0497bee10011ab0a5749cb483b73b8fad

Analysis

max time kernel
149s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_04c3bc0e6b81a941cc86e567ec480660_akira_amadey_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 30.9MB
Sample260511-pafvdsct2r
SHA256 eee8a0daac29a130937a00c090d67af0497bee10011ab0a5749cb483b73b8fad
MD5 04c3bc0e6b81a941cc86e567ec480660
SHA1 585424c6d585944d01ccfd086306b638f326d7c4
SHA512 d14f8a0330656b159184b8b50f9ce41a1e3c7a10fd7379f9b932e723993e586cc4eeeed0479ca0962f99e56abdf0ef2455b3761ae46ee984c17c70286ef3b26b
SSDEEP 393216:Vz/Q78SsXhR4yfY6To+mBQ0+A7gJAOP3bTLj7ozxstIC0U/0M:VzYkXVfY6T/mBQI7gJAVzNQ
TLSH
T173679D4A72A500E9D07BD038CA1B9617EBF2741617329BDF42E086666F77AF11B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in System32 directory 16 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_84ea762c0a90c362\mshdc.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_726cea1f0f349cf7\machine.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_702fdf2336d2162d\input.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_5ab7d1c25144fcab\msmouse.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_8207ba80cf22e40a\hdaudbus.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_585900615f764770\usbport.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_cc6edbde0940344f\keyboard.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_cc6edbde0940344f\keyboard.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_8207ba80cf22e40a\hdaudbus.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_84ea762c0a90c362\mshdc.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_726cea1f0f349cf7\machine.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_585900615f764770\usbport.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_702fdf2336d2162d\input.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_5ab7d1c25144fcab\msmouse.PNF	dxdiag.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2620 set thread context of 2476	2620	2026-05-11_04c3bc0e6b81a941cc86e567ec480660_akira_amadey_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	dxdiag.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{C55ED4B8-B712-4503-B611-4DBBB970D8F3}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove\ = "Programmable"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\ = "DxDiagProvider Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\ = "DxDiagProvider Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\System32\\dxdiagn.dll"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer	dxdiag.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{3154A0C5-61F3-49D2-BCF2-3BF6CEF6D7FA}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1\ = "DxDiagClassObject Class"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ = "DxDiagClassObject Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\ProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\VersionIndependentProgID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject.1	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ProgID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\VersionIndependentProgID\ = "DxDiag.DxDiagClassObject"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\ForceRemove	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CLSID\ = "{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\ = "DxDiagClassObject Class"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CLSID	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider\CurVer\ = "DxDiag.DxDiagClassObject.1"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	dxdiag.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2412	dxdiag.exe
2412	dxdiag.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2412	dxdiag.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2476	2620	2026-05-11_04c3bc0e6b81a941cc86e567ec480660_akira_amadey_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	80
PID 2620 wrote to memory of 2476	2620	2026-05-11_04c3bc0e6b81a941cc86e567ec480660_akira_amadey_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	80
PID 2620 wrote to memory of 2476	2620	2026-05-11_04c3bc0e6b81a941cc86e567ec480660_akira_amadey_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	80
PID 2620 wrote to memory of 2476	2620	2026-05-11_04c3bc0e6b81a941cc86e567ec480660_akira_amadey_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	80
PID 2620 wrote to memory of 2476	2620	2026-05-11_04c3bc0e6b81a941cc86e567ec480660_akira_amadey_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	80
PID 2620 wrote to memory of 2476	2620	2026-05-11_04c3bc0e6b81a941cc86e567ec480660_akira_amadey_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	80
PID 2620 wrote to memory of 2476	2620	2026-05-11_04c3bc0e6b81a941cc86e567ec480660_akira_amadey_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	80
PID 2620 wrote to memory of 2476	2620	2026-05-11_04c3bc0e6b81a941cc86e567ec480660_akira_amadey_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	80
PID 2620 wrote to memory of 2476	2620	2026-05-11_04c3bc0e6b81a941cc86e567ec480660_akira_amadey_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	80
PID 2620 wrote to memory of 2476	2620	2026-05-11_04c3bc0e6b81a941cc86e567ec480660_akira_amadey_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	80
PID 2476 wrote to memory of 2412	2476	2026-05-11_04c3bc0e6b81a941cc86e567ec480660_akira_amadey_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-11_04c3bc0e6b81a941cc86e567ec480660_akira_amadey_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_04c3bc0e6b81a941cc86e567ec480660_akira_amadey_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Users\Admin\AppData\Local\Temp\2026-05-11_04c3bc0e6b81a941cc86e567ec480660_akira_amadey_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
  C:\Users\Admin\AppData\Local\Temp\2026-05-11_04c3bc0e6b81a941cc86e567ec480660_akira_amadey_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\System32\dxdiag.exe
    "C:\Windows\System32\dxdiag.exe" /t "C:\Users\Admin\AppData\Local\Temp\dxdiag.txt"
    3⤵
    - Drops file in System32 directory
    - Checks SCSI registry key(s)
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-18-0x000002A924730000-0x000002A924731000-memory.dmp

Download

memory/2412-20-0x000002A924730000-0x000002A924731000-memory.dmp

Download

memory/2412-46-0x000002A920740000-0x000002A92082C000-memory.dmp

Download

memory/2412-15-0x000002A924730000-0x000002A924731000-memory.dmp

Download

memory/2412-16-0x000002A924730000-0x000002A924731000-memory.dmp

Download

memory/2412-7-0x000002A920740000-0x000002A92082C000-memory.dmp

Download

memory/2412-17-0x000002A924730000-0x000002A924731000-memory.dmp

Download

memory/2412-8-0x000002A922080000-0x000002A922092000-memory.dmp

Download

memory/2412-10-0x000002A924730000-0x000002A924731000-memory.dmp

Download

memory/2412-19-0x000002A924730000-0x000002A924731000-memory.dmp

Download

memory/2412-21-0x000002A924730000-0x000002A924731000-memory.dmp

Download

memory/2412-11-0x000002A924730000-0x000002A924731000-memory.dmp

Download

memory/2412-9-0x000002A924730000-0x000002A924731000-memory.dmp

Download

memory/2476-4-0x00007FF65FF70000-0x00007FF662768000-memory.dmp

Download

memory/2476-1-0x00007FF65FF70000-0x00007FF662768000-memory.dmp

Download

memory/2476-0-0x00007FF65FF70000-0x00007FF662768000-memory.dmp

Download

memory/2476-6-0x00007FF65FF70000-0x00007FF662768000-memory.dmp

Download

memory/2476-5-0x00007FF65FF70000-0x00007FF662768000-memory.dmp

Download

memory/2476-3-0x00007FF65FF70000-0x00007FF662768000-memory.dmp

Download

memory/2476-2-0x00007FF65FF70000-0x00007FF662768000-memory.dmp

Download