Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
31/05/2026, 23:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Resource
win11-20260513-en
1 signatures
150 seconds
General
- Target 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
- Size 3.7MB
- Sample260531-3esxeahx61
- SHA256 fa1b29801e02c20de56badb1b9184aea600b2781d821b9477d2610380a7fd71d
- MD5 89fb09e6e9b9c53b75366e2e0021ceb9
- SHA1 d896d5402bd47b4866b2b7bd4ecbe07b47d3d188
- SHA512 38cca1644f4e45a7d5f862bef0674b8c7a8c01dab6c57f6a18b57c803e81e932e34d0b59cdf6d0436df44465f48a12c8c2bb6d4b5693b88f7a2f981d8a0b9097
- SSDEEP 49152:eFc7hSfwbjINrAqLVcWdW8PqX8xoHA6yQpZjQSqd0SanFT8+HE8Qu0fU2dTSOaNW:poNrAqLV9dW8PqiU6UJNl
- TLSH T1F906BE16E3A6CAE9C913D279C922A553DAF5B8055739D6CB33C84C16BF27AE04DBC700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 3044 2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-31_89fb09e6e9b9c53b75366e2e0021ceb9_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3044