Analysis
- max time kernel
149s - max time network
116s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 03:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
- Size 62.6MB
- Sample260522-dk91faf13t
- SHA256 f2cc75d74f4ac146803b12676688fd53a4b29a41de60ab22c0385b1f513711d7
- MD5 7a99675f6a4d670b6b48ce6fa6cc957b
- SHA1 27ea7880aa6d514ff1c02b0bbdcbda68b0b670c0
- SHA512 9ccd83591d4f7c1260f80e4391cde038b17bcb7037523ffc17f4c7b90dddafc69951e3edb9604863e9ef110710aabe037f8b4e64aa77bb3ef05bdc45ea0c669c
- SSDEEP 393216:GsqGxqsktO5GG02US1P+/U7q7K0mAb5ZUjcDUND3usyBvaRRMV+o33irYVI31BLA:G4lmOIUMFCrYVKAGmjvJ
- TLSH T1A7E7494663EA0881FDF7EA348AE65513C633BC166F3185CF610C1B2A1F776E08976762
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1160 tasklist.exe -
pid Process 6136 powershell.exe 4176 powershell.exe - Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 6136 powershell.exe 6136 powershell.exe 4176 powershell.exe 4176 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1160 tasklist.exe Token: SeDebugPrivilege 6136 powershell.exe Token: SeIncreaseQuotaPrivilege 6136 powershell.exe Token: SeSecurityPrivilege 6136 powershell.exe Token: SeTakeOwnershipPrivilege 6136 powershell.exe Token: SeLoadDriverPrivilege 6136 powershell.exe Token: SeSystemProfilePrivilege 6136 powershell.exe Token: SeSystemtimePrivilege 6136 powershell.exe Token: SeProfSingleProcessPrivilege 6136 powershell.exe Token: SeIncBasePriorityPrivilege 6136 powershell.exe Token: SeCreatePagefilePrivilege 6136 powershell.exe Token: SeBackupPrivilege 6136 powershell.exe Token: SeRestorePrivilege 6136 powershell.exe Token: SeShutdownPrivilege 6136 powershell.exe Token: SeDebugPrivilege 6136 powershell.exe Token: SeSystemEnvironmentPrivilege 6136 powershell.exe Token: SeRemoteShutdownPrivilege 6136 powershell.exe Token: SeUndockPrivilege 6136 powershell.exe Token: SeManageVolumePrivilege 6136 powershell.exe Token: 33 6136 powershell.exe Token: 34 6136 powershell.exe Token: 35 6136 powershell.exe Token: 36 6136 powershell.exe Token: SeDebugPrivilege 4176 powershell.exe Token: SeIncreaseQuotaPrivilege 4176 powershell.exe Token: SeSecurityPrivilege 4176 powershell.exe Token: SeTakeOwnershipPrivilege 4176 powershell.exe Token: SeLoadDriverPrivilege 4176 powershell.exe Token: SeSystemProfilePrivilege 4176 powershell.exe Token: SeSystemtimePrivilege 4176 powershell.exe Token: SeProfSingleProcessPrivilege 4176 powershell.exe Token: SeIncBasePriorityPrivilege 4176 powershell.exe Token: SeCreatePagefilePrivilege 4176 powershell.exe Token: SeBackupPrivilege 4176 powershell.exe Token: SeRestorePrivilege 4176 powershell.exe Token: SeShutdownPrivilege 4176 powershell.exe Token: SeDebugPrivilege 4176 powershell.exe Token: SeSystemEnvironmentPrivilege 4176 powershell.exe Token: SeRemoteShutdownPrivilege 4176 powershell.exe Token: SeUndockPrivilege 4176 powershell.exe Token: SeManageVolumePrivilege 4176 powershell.exe Token: 33 4176 powershell.exe Token: 34 4176 powershell.exe Token: 35 4176 powershell.exe Token: 36 4176 powershell.exe Token: SeIncreaseQuotaPrivilege 4176 powershell.exe Token: SeSecurityPrivilege 4176 powershell.exe Token: SeTakeOwnershipPrivilege 4176 powershell.exe Token: SeLoadDriverPrivilege 4176 powershell.exe Token: SeSystemProfilePrivilege 4176 powershell.exe Token: SeSystemtimePrivilege 4176 powershell.exe Token: SeProfSingleProcessPrivilege 4176 powershell.exe Token: SeIncBasePriorityPrivilege 4176 powershell.exe Token: SeCreatePagefilePrivilege 4176 powershell.exe Token: SeBackupPrivilege 4176 powershell.exe Token: SeRestorePrivilege 4176 powershell.exe Token: SeShutdownPrivilege 4176 powershell.exe Token: SeDebugPrivilege 4176 powershell.exe Token: SeSystemEnvironmentPrivilege 4176 powershell.exe Token: SeRemoteShutdownPrivilege 4176 powershell.exe Token: SeUndockPrivilege 4176 powershell.exe Token: SeManageVolumePrivilege 4176 powershell.exe Token: 33 4176 powershell.exe Token: 34 4176 powershell.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5024 wrote to memory of 2452 5024 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe 80 PID 2452 wrote to memory of 1160 2452 cmd.exe 82 PID 5024 wrote to memory of 4772 5024 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe 84 PID 4772 wrote to memory of 6136 4772 cmd.exe 86 PID 5024 wrote to memory of 5260 5024 2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe 87 PID 5260 wrote to memory of 4176 5260 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_7a99675f6a4d670b6b48ce6fa6cc957b_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV"2⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\system32\tasklist.exetasklist /FO CSV3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1160
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Get-CimInstance Win32_DiskDrive | Select-Object -ExpandProperty Model""2⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-CimInstance Win32_DiskDrive | Select-Object -ExpandProperty Model"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6136
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -Command "(Get-CimInstance Win32_PortConnector).Count; (Get-CimInstance Win32_BaseBoard).SerialNumber""2⤵
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(Get-CimInstance Win32_PortConnector).Count; (Get-CimInstance Win32_BaseBoard).SerialNumber"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4176
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 7f8f97ee615f534fb3a3d4ab1d554cd33b788f10c559754714d1e7ce0726b362
- MD5 a71e351e0584693771a3e1ab5ed855ee
- SHA1 5bbadb2db8240a293fce7bf6a965634703e51aa4
- SHA512 95148933c9fc727c3f88c9b5a0bd489f660bc0b24b3cb8b8e6e7ffbec937810d473cf57ff0c8a34075ce7f822f0c007be8893daa409738cd4782ab526bb5a185
- TLSH T18B71EE323375B0D4C9663F07192C1AC463BF4396EA58AF4CB658521ED92710BDB222F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 527583dacd97ac0330fcd30a301b422dc2b9894b292a38188ade6c96df764667
- MD5 7a0e7ce4c6a682fdcfc2d5e11cfd14d8
- SHA1 82fd69f2e9e6e3ba7865da5159a9bb74820585cd
- SHA512 f74c1c0f1ec546836f8d34d98895a028518eefd8eecc4e011448b59c0a61ef1bbc661488675097965a1806b28e272680d6699d0767c777a4280e910c47c27381
- TLSH T1F0218B33B79DC165C8D9117A20CCAD00B275C3C744DECF8B2A84C229A97F5DADB945E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m3jwqtt5.vpf.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH