Analysis
- max time kernel
150s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 03:36
General
- Target 2026-06-30_9e13f6fafe5cb4d0905ef840c59699c0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 32.8MB
- Sample260701-d57e2sfv7w
- SHA256 559e7830be56c27f803bd60968b3fba923c8ea2a18c938c760d3ea2e8e15d741
Malware Config
Signatures
- Drops startup file 2 IoCs
- Loads dropped DLL 64 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 43 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_9e13f6fafe5cb4d0905ef840c59699c0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_9e13f6fafe5cb4d0905ef840c59699c0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_9e13f6fafe5cb4d0905ef840c59699c0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_9e13f6fafe5cb4d0905ef840c59699c0_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_raw_cbc.pyd
_raw_cfb.pyd
_raw_ctr.pyd
_raw_ecb.pyd
_raw_ofb.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp311-win_amd64.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
base_library.zip
libcrypto-1_1.dll
libffi-8.dll
libssl-1_1.dll
_version.cp311-win_amd64.pyd
_block.cp311-win_amd64.pyd
pyexpat.pyd
python3.DLL
python311.dll
pythoncom311.dll
pywintypes311.dll
select.pyd
sqlite3.dll
win32api.pyd
memory/5088-300-0x00007FFA8A8A0000-0x00007FFA8A8B4000-memory.dmp
memory/5088-305-0x00007FFA8A7D0000-0x00007FFA8A7E2000-memory.dmp
memory/5088-227-0x00007FFA90560000-0x00007FFA9056F000-memory.dmp
memory/5088-231-0x00007FFA8A9D0000-0x00007FFA8AA88000-memory.dmp
memory/5088-234-0x00007FFA8F0E0000-0x00007FFA8F10D000-memory.dmp
memory/5088-237-0x00007FFA8F0C0000-0x00007FFA8F0D9000-memory.dmp
memory/5088-236-0x00000200DAE50000-0x00000200DB1C9000-memory.dmp
memory/5088-235-0x00007FFA77DD0000-0x00007FFA78149000-memory.dmp
memory/5088-222-0x00007FFA905B0000-0x00007FFA905D3000-memory.dmp
memory/5088-240-0x00007FFA8EEF0000-0x00007FFA8EF05000-memory.dmp
memory/5088-223-0x00007FFA8EF40000-0x00007FFA8EF6B000-memory.dmp
memory/5088-243-0x00007FFA8EED0000-0x00007FFA8EEE2000-memory.dmp
memory/5088-219-0x00007FFA8EF70000-0x00007FFA8F02C000-memory.dmp
memory/5088-218-0x00007FFA78150000-0x00007FFA78739000-memory.dmp
memory/5088-248-0x00007FFA8EEA0000-0x00007FFA8EEC3000-memory.dmp
memory/5088-250-0x00007FFA8F040000-0x00007FFA8F06E000-memory.dmp
memory/5088-251-0x00007FFA830D0000-0x00007FFA83240000-memory.dmp
memory/5088-214-0x00007FFA8F040000-0x00007FFA8F06E000-memory.dmp
memory/5088-211-0x00007FFA8F070000-0x00007FFA8F07D000-memory.dmp
memory/5088-256-0x00007FFA8D3D0000-0x00007FFA8D3E4000-memory.dmp
memory/5088-208-0x00007FFA8F080000-0x00007FFA8F0B5000-memory.dmp
memory/5088-255-0x00007FFA8EF70000-0x00007FFA8F02C000-memory.dmp
memory/5088-262-0x00007FFA8EF10000-0x00007FFA8EF3E000-memory.dmp
memory/5088-205-0x00007FFA90550000-0x00007FFA9055D000-memory.dmp
memory/5088-263-0x00007FFA8B5D0000-0x00007FFA8B5EC000-memory.dmp
memory/5088-260-0x00007FFA8EE20000-0x00007FFA8EE2B000-memory.dmp
memory/5088-267-0x00007FFA8A990000-0x00007FFA8A9C8000-memory.dmp
memory/5088-266-0x00000200DAE50000-0x00000200DB1C9000-memory.dmp
memory/5088-265-0x00007FFA8A9D0000-0x00007FFA8AA88000-memory.dmp
memory/5088-201-0x00007FFA8F0C0000-0x00007FFA8F0D9000-memory.dmp
memory/5088-198-0x00007FFA8F0E0000-0x00007FFA8F10D000-memory.dmp
memory/5088-275-0x00007FFA8BCB0000-0x00007FFA8BCBB000-memory.dmp
memory/5088-274-0x00007FFA8D3C0000-0x00007FFA8D3CB000-memory.dmp
memory/5088-273-0x00007FFA77DD0000-0x00007FFA78149000-memory.dmp
memory/5088-196-0x00007FFA8F110000-0x00007FFA8F129000-memory.dmp
memory/5088-279-0x00007FFA8B5C0000-0x00007FFA8B5CC000-memory.dmp
memory/5088-278-0x00007FFA8EEF0000-0x00007FFA8EF05000-memory.dmp
memory/5088-190-0x00007FFA905B0000-0x00007FFA905D3000-memory.dmp
memory/5088-282-0x00007FFA8B550000-0x00007FFA8B55B000-memory.dmp
memory/5088-192-0x00007FFA90560000-0x00007FFA9056F000-memory.dmp
memory/5088-284-0x00007FFA8B230000-0x00007FFA8B23C000-memory.dmp
memory/5088-283-0x00007FFA8EEA0000-0x00007FFA8EEC3000-memory.dmp
memory/5088-182-0x00007FFA78150000-0x00007FFA78739000-memory.dmp
memory/5088-299-0x00007FFA8A8C0000-0x00007FFA8A8CC000-memory.dmp
memory/5088-298-0x00007FFA8A8D0000-0x00007FFA8A8E2000-memory.dmp
memory/5088-301-0x00007FFA82FB0000-0x00007FFA830CC000-memory.dmp
memory/5088-297-0x00007FFA8A8F0000-0x00007FFA8A8FD000-memory.dmp
memory/5088-296-0x00007FFA8A900000-0x00007FFA8A90C000-memory.dmp
memory/5088-295-0x00007FFA8A910000-0x00007FFA8A91C000-memory.dmp
memory/5088-294-0x00007FFA8A920000-0x00007FFA8A92B000-memory.dmp
memory/5088-293-0x00007FFA8A930000-0x00007FFA8A93B000-memory.dmp
memory/5088-292-0x00007FFA8A940000-0x00007FFA8A94C000-memory.dmp
memory/5088-291-0x00007FFA8A950000-0x00007FFA8A95C000-memory.dmp
memory/5088-290-0x00007FFA8A990000-0x00007FFA8A9C8000-memory.dmp
memory/5088-289-0x00007FFA8A960000-0x00007FFA8A96E000-memory.dmp
memory/5088-288-0x00007FFA8A970000-0x00007FFA8A97D000-memory.dmp
memory/5088-287-0x00007FFA8A980000-0x00007FFA8A98C000-memory.dmp
memory/5088-286-0x00007FFA8B220000-0x00007FFA8B22B000-memory.dmp
memory/5088-285-0x00007FFA830D0000-0x00007FFA83240000-memory.dmp
memory/5088-228-0x00007FFA8EF10000-0x00007FFA8EF3E000-memory.dmp
memory/5088-304-0x00007FFA83580000-0x00007FFA8363F000-memory.dmp
memory/5088-306-0x00007FFA82F70000-0x00007FFA82FAE000-memory.dmp
memory/5088-303-0x00007FFA8A650000-0x00007FFA8A665000-memory.dmp
memory/5088-307-0x00007FFA8A870000-0x00007FFA8A87E000-memory.dmp
memory/5088-302-0x00007FFA8A880000-0x00007FFA8A89B000-memory.dmp
memory/5088-308-0x00007FFA8A640000-0x00007FFA8A64B000-memory.dmp
memory/5088-309-0x00007FFA79300000-0x00007FFA79324000-memory.dmp
memory/5088-310-0x00007FFA89F70000-0x00007FFA89F86000-memory.dmp
memory/5088-311-0x00007FFA82F50000-0x00007FFA82F6C000-memory.dmp
memory/5088-312-0x00007FFA8A630000-0x00007FFA8A63B000-memory.dmp
memory/5088-314-0x00007FFA83570000-0x00007FFA8357B000-memory.dmp
memory/5088-313-0x00007FFA82FB0000-0x00007FFA830CC000-memory.dmp
memory/5088-315-0x00007FFA8A880000-0x00007FFA8A89B000-memory.dmp
memory/5088-319-0x00007FFA80E50000-0x00007FFA80E5B000-memory.dmp
memory/5088-318-0x00007FFA8A7D0000-0x00007FFA8A7E2000-memory.dmp
memory/5088-317-0x00007FFA82F10000-0x00007FFA82F1C000-memory.dmp
memory/5088-316-0x00007FFA83580000-0x00007FFA8363F000-memory.dmp
memory/5088-321-0x00007FFA7AC20000-0x00007FFA7AC2C000-memory.dmp
memory/5088-320-0x00007FFA82F70000-0x00007FFA82FAE000-memory.dmp
memory/5088-322-0x00007FFA792F0000-0x00007FFA792FB000-memory.dmp
memory/5088-323-0x00007FFA77CD0000-0x00007FFA77CDC000-memory.dmp
memory/5088-324-0x00007FFA77CC0000-0x00007FFA77CCD000-memory.dmp
memory/5088-325-0x00007FFA89F70000-0x00007FFA89F86000-memory.dmp
memory/5088-326-0x00007FFA77CB0000-0x00007FFA77CBE000-memory.dmp
memory/5088-331-0x00007FFA77C80000-0x00007FFA77C8B000-memory.dmp
memory/5088-330-0x00007FFA77C90000-0x00007FFA77C9C000-memory.dmp
memory/5088-329-0x00007FFA8A630000-0x00007FFA8A63B000-memory.dmp
memory/5088-328-0x00007FFA77CA0000-0x00007FFA77CAC000-memory.dmp
memory/5088-327-0x00007FFA82F50000-0x00007FFA82F6C000-memory.dmp
memory/5088-334-0x00007FFA77C50000-0x00007FFA77C5C000-memory.dmp
memory/5088-333-0x00007FFA77C60000-0x00007FFA77C6C000-memory.dmp
memory/5088-332-0x00007FFA77C70000-0x00007FFA77C7B000-memory.dmp
memory/5088-335-0x00007FFA77C40000-0x00007FFA77C4D000-memory.dmp
memory/5088-336-0x00007FFA77C20000-0x00007FFA77C32000-memory.dmp
memory/5088-337-0x00007FFA77C10000-0x00007FFA77C1C000-memory.dmp
memory/5088-338-0x00007FFA77BE0000-0x00007FFA77C09000-memory.dmp
memory/5088-362-0x00007FFA8EE20000-0x00007FFA8EE2B000-memory.dmp
memory/5088-358-0x00007FFA8EED0000-0x00007FFA8EEE2000-memory.dmp
memory/5088-351-0x00007FFA8F040000-0x00007FFA8F06E000-memory.dmp
memory/5088-347-0x00007FFA8F0C0000-0x00007FFA8F0D9000-memory.dmp
memory/5088-364-0x00007FFA8A990000-0x00007FFA8A9C8000-memory.dmp
memory/5088-360-0x00007FFA830D0000-0x00007FFA83240000-memory.dmp
memory/5088-356-0x00007FFA77DD0000-0x00007FFA78149000-memory.dmp
memory/5088-352-0x00007FFA8EF70000-0x00007FFA8F02C000-memory.dmp
memory/5088-363-0x00007FFA8B5D0000-0x00007FFA8B5EC000-memory.dmp
memory/5088-361-0x00007FFA8D3D0000-0x00007FFA8D3E4000-memory.dmp
memory/5088-359-0x00007FFA8EEA0000-0x00007FFA8EEC3000-memory.dmp
memory/5088-357-0x00007FFA8EEF0000-0x00007FFA8EF05000-memory.dmp
memory/5088-355-0x00007FFA8A9D0000-0x00007FFA8AA88000-memory.dmp
memory/5088-354-0x00007FFA8EF10000-0x00007FFA8EF3E000-memory.dmp
memory/5088-353-0x00007FFA8EF40000-0x00007FFA8EF6B000-memory.dmp
memory/5088-350-0x00007FFA8F070000-0x00007FFA8F07D000-memory.dmp
memory/5088-349-0x00007FFA8F080000-0x00007FFA8F0B5000-memory.dmp
memory/5088-348-0x00007FFA90550000-0x00007FFA9055D000-memory.dmp
memory/5088-346-0x00007FFA8F0E0000-0x00007FFA8F10D000-memory.dmp
memory/5088-345-0x00007FFA8F110000-0x00007FFA8F129000-memory.dmp
memory/5088-344-0x00007FFA90560000-0x00007FFA9056F000-memory.dmp
memory/5088-343-0x00007FFA905B0000-0x00007FFA905D3000-memory.dmp