Analysis
- max time kernel
149s - max time network
126s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/06/2026, 20:47
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
- Size 2.5MB
- Sample260603-zkz15aev21
- SHA256 51c3ff9621bf59218ea738e08ecb719d9a56188f898ff5d47a6cda4fe12f42e1
- MD5 088e7bee956b8aa0f68b12739e623bc6
- SHA1 996d21d9309050c06d9dc2f2a1d491f53ed1d146
- SHA512 1b9c6efb771a8a50cd2f16d7084182e51c2c51b475665687a1e3a01f7d183d46afbceafa08afe7ebd458f48339da5d727ed390335822fe982417f5eb6c4de4d5
- SSDEEP 49152:G3VXFYfqy+f2KIAurEak8rs3pdKJRZx4TnBBlfGC+O93+xQelt6moYlkEkIuJAr1:GFVnIAurEak8rs3pdlzrurt6JjEkor
- TLSH T1B1C5BE4BA7B600F4C1BBD03C9146721BFAB2345943349BEB57D05B5B1B62BE0AA7E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 api.ipify.org 3 api.ipify.org - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5136 wmic.exe Token: SeSecurityPrivilege 5136 wmic.exe Token: SeTakeOwnershipPrivilege 5136 wmic.exe Token: SeLoadDriverPrivilege 5136 wmic.exe Token: SeSystemProfilePrivilege 5136 wmic.exe Token: SeSystemtimePrivilege 5136 wmic.exe Token: SeProfSingleProcessPrivilege 5136 wmic.exe Token: SeIncBasePriorityPrivilege 5136 wmic.exe Token: SeCreatePagefilePrivilege 5136 wmic.exe Token: SeBackupPrivilege 5136 wmic.exe Token: SeRestorePrivilege 5136 wmic.exe Token: SeShutdownPrivilege 5136 wmic.exe Token: SeDebugPrivilege 5136 wmic.exe Token: SeSystemEnvironmentPrivilege 5136 wmic.exe Token: SeRemoteShutdownPrivilege 5136 wmic.exe Token: SeUndockPrivilege 5136 wmic.exe Token: SeManageVolumePrivilege 5136 wmic.exe Token: 33 5136 wmic.exe Token: 34 5136 wmic.exe Token: 35 5136 wmic.exe Token: 36 5136 wmic.exe Token: SeIncreaseQuotaPrivilege 5136 wmic.exe Token: SeSecurityPrivilege 5136 wmic.exe Token: SeTakeOwnershipPrivilege 5136 wmic.exe Token: SeLoadDriverPrivilege 5136 wmic.exe Token: SeSystemProfilePrivilege 5136 wmic.exe Token: SeSystemtimePrivilege 5136 wmic.exe Token: SeProfSingleProcessPrivilege 5136 wmic.exe Token: SeIncBasePriorityPrivilege 5136 wmic.exe Token: SeCreatePagefilePrivilege 5136 wmic.exe Token: SeBackupPrivilege 5136 wmic.exe Token: SeRestorePrivilege 5136 wmic.exe Token: SeShutdownPrivilege 5136 wmic.exe Token: SeDebugPrivilege 5136 wmic.exe Token: SeSystemEnvironmentPrivilege 5136 wmic.exe Token: SeRemoteShutdownPrivilege 5136 wmic.exe Token: SeUndockPrivilege 5136 wmic.exe Token: SeManageVolumePrivilege 5136 wmic.exe Token: 33 5136 wmic.exe Token: 34 5136 wmic.exe Token: 35 5136 wmic.exe Token: 36 5136 wmic.exe Token: SeIncreaseQuotaPrivilege 3684 wmic.exe Token: SeSecurityPrivilege 3684 wmic.exe Token: SeTakeOwnershipPrivilege 3684 wmic.exe Token: SeLoadDriverPrivilege 3684 wmic.exe Token: SeSystemProfilePrivilege 3684 wmic.exe Token: SeSystemtimePrivilege 3684 wmic.exe Token: SeProfSingleProcessPrivilege 3684 wmic.exe Token: SeIncBasePriorityPrivilege 3684 wmic.exe Token: SeCreatePagefilePrivilege 3684 wmic.exe Token: SeBackupPrivilege 3684 wmic.exe Token: SeRestorePrivilege 3684 wmic.exe Token: SeShutdownPrivilege 3684 wmic.exe Token: SeDebugPrivilege 3684 wmic.exe Token: SeSystemEnvironmentPrivilege 3684 wmic.exe Token: SeRemoteShutdownPrivilege 3684 wmic.exe Token: SeUndockPrivilege 3684 wmic.exe Token: SeManageVolumePrivilege 3684 wmic.exe Token: 33 3684 wmic.exe Token: 34 3684 wmic.exe Token: 35 3684 wmic.exe Token: 36 3684 wmic.exe Token: SeIncreaseQuotaPrivilege 3684 wmic.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5312 wrote to memory of 5136 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 80 PID 5312 wrote to memory of 3684 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 83 PID 5312 wrote to memory of 668 5312 2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 85 PID 668 wrote to memory of 2092 668 cmd.exe 87 PID 668 wrote to memory of 2148 668 cmd.exe 88 PID 668 wrote to memory of 892 668 cmd.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5136
-
-
C:\Windows\System32\Wbem\wmic.exewmic PATH Win32_VideoController GET PNPDeviceID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3684
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\2026-06-03_088e7bee956b8aa0f68b12739e623bc6_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe" MD53⤵PID:2092
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:2148
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:892
-
-