Analysis
- max time kernel
149s - max time network
156s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 16:04
General
- Target 2026-05-11_159312c746da01f08e9e098ef1919888_cobalt-strike_glassworm_njrat_satacom_vidar.exe
- Size 62.9MB
- Sample260511-tjee5sd13x
- SHA256 aa88c1e56ce22a8a1c4312210299da2ff020dadf720d1de5aafd0d58aad3ba5e
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_159312c746da01f08e9e098ef1919888_cobalt-strike_glassworm_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_159312c746da01f08e9e098ef1919888_cobalt-strike_glassworm_njrat_satacom_vidar.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4168-0-0x0000000180000000-0x0000000180A25000-memory.dmp
memory/4168-19-0x0000025702080000-0x0000025702127000-memory.dmp
memory/4168-21-0x0000025702130000-0x00000257021BA000-memory.dmp
memory/4168-15-0x0000025700280000-0x00000257002DC000-memory.dmp
memory/4168-30-0x0000025700240000-0x0000025700253000-memory.dmp
memory/4168-39-0x0000025700300000-0x0000025700316000-memory.dmp
memory/4168-42-0x0000025700180000-0x000002570018D000-memory.dmp
memory/4168-36-0x0000025700190000-0x0000025700197000-memory.dmp
memory/4168-45-0x0000025700350000-0x0000025700368000-memory.dmp
memory/4168-33-0x0000025700260000-0x0000025700268000-memory.dmp
memory/4168-27-0x0000025700220000-0x0000025700232000-memory.dmp
memory/4168-24-0x00000257022A0000-0x0000025702372000-memory.dmp
memory/4168-13-0x00000257001E0000-0x0000025700214000-memory.dmp
memory/4168-57-0x0000025702210000-0x0000025702250000-memory.dmp
memory/4168-55-0x0000025700320000-0x000002570034A000-memory.dmp
memory/4168-51-0x0000025700370000-0x0000025700391000-memory.dmp
memory/4168-60-0x0000025702250000-0x000002570228C000-memory.dmp
memory/4168-48-0x0000025702380000-0x0000025702444000-memory.dmp
memory/4168-63-0x0000025702A20000-0x0000025702A9C000-memory.dmp
memory/4168-9-0x00000257003B0000-0x0000025700568000-memory.dmp
memory/4168-6-0x00000257001A0000-0x00000257001DE000-memory.dmp
memory/4168-66-0x0000025702990000-0x00000257029A9000-memory.dmp
memory/4168-3-0x0000025700130000-0x0000025700142000-memory.dmp
memory/4168-75-0x0000025702A00000-0x0000025702A17000-memory.dmp
memory/4168-72-0x00000257029D0000-0x00000257029F5000-memory.dmp
memory/4168-69-0x00000257029B0000-0x00000257029C9000-memory.dmp
memory/4168-78-0x0000025702B00000-0x0000025702B17000-memory.dmp