Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 03:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-02_d9bca37697633bc9cc38716f081cb306_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_d9bca37697633bc9cc38716f081cb306_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target 2026-06-02_d9bca37697633bc9cc38716f081cb306_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
- Size 4.4MB
- Sample260602-d2dcsses7k
- SHA256 07831ab5d3bd72e59d339b85b66b5183c0ab2527d2a59e1fb65dc1a4d03ca609
- MD5 d9bca37697633bc9cc38716f081cb306
- SHA1 2c4a84e6d2e45327dd7c947beacfab58c51ab127
- SHA512 21f18638ec1be42b124b5cd6ad31b3d80ea4a4cf8d6abd286e5bb022dc20d919f658808578ffd42f580c43c58f9ab6d8f88e9fc2b36b83ea85891a471317e917
- SSDEEP 98304:bCeZT1hg8uW3O/W5hthewtOmRualUJNl:WoT1hg8uW3O/ahthNOmwalUx
- TLSH T1A826CF16E3A6C6A9C913D679C912A553E9F4B8061735D6CB33C94C1ABF27AF08DBC700
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5156 set thread context of 5400 5156 2026-06-02_d9bca37697633bc9cc38716f081cb306_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 82 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe 5400 msinfo32.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 5156 wrote to memory of 5400 5156 2026-06-02_d9bca37697633bc9cc38716f081cb306_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 82 PID 5156 wrote to memory of 5400 5156 2026-06-02_d9bca37697633bc9cc38716f081cb306_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 82 PID 5156 wrote to memory of 5400 5156 2026-06-02_d9bca37697633bc9cc38716f081cb306_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 82 PID 5156 wrote to memory of 5400 5156 2026-06-02_d9bca37697633bc9cc38716f081cb306_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 82 PID 5156 wrote to memory of 5400 5156 2026-06-02_d9bca37697633bc9cc38716f081cb306_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 82 PID 5156 wrote to memory of 5400 5156 2026-06-02_d9bca37697633bc9cc38716f081cb306_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 82 PID 5156 wrote to memory of 5400 5156 2026-06-02_d9bca37697633bc9cc38716f081cb306_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 82 PID 5156 wrote to memory of 5400 5156 2026-06-02_d9bca37697633bc9cc38716f081cb306_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_d9bca37697633bc9cc38716f081cb306_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_d9bca37697633bc9cc38716f081cb306_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5156 -
C:\Windows\System32\msinfo32.exe"C:\Windows\System32\msinfo32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5400
-