Analysis
- max time kernel
148s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
06/07/2026, 18:06
General
- Target 2026-07-06_72e27d15e055fd03d5f0159486a5472c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 15.9MB
- Sample260706-wp3e9saz2y
- SHA256 d5600fc2d14635930f8440d43f47ed7a8aa38fa691662677db5a272b317c372d
Malware Config
Signatures
- Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
- Loads dropped DLL 51 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Suspicious behavior: EnumeratesProcesses 61 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_72e27d15e055fd03d5f0159486a5472c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_72e27d15e055fd03d5f0159486a5472c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_72e27d15e055fd03d5f0159486a5472c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_72e27d15e055fd03d5f0159486a5472c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name ProductName3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2> nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2> nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName4⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profile"3⤵
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profile4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exeWMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-PnpDevice -PresentOnly | Where-Object { $_.InstanceId -match '^USB' }"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-PnpDevice -PresentOnly4⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
7lOC4Dtdf2EBScX
G7ifjthHjGLsmHW3jjC
IeHBGVAjBYrBa73PKm
KK5C5rkZR8sl9j
UCdX1OhVMMh3
YgKlyv3hbB9
_raw_cbc.pyd
_raw_ecb.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp310-win_amd64.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
base_library.zip
md.cp310-win_amd64.pyd
md__mypyc.cp310-win_amd64.pyd
libcrypto-1_1.dll
libffi-7.dll
libssl-1_1.dll
_psutil_windows.pyd
pyexpat.pyd
python3.DLL
python310.dll
pywintypes310.dll
select.pyd
sqlite3.dll
unicodedata.pyd
win32api.pyd
win32gui.pyd
win32process.pyd
__PSScriptPolicyTest_cdt0eyo1.3su.ps1
fmCN5z2pQ7FE
memory/2732-329-0x0000018058080000-0x00000180580A2000-memory.dmp
memory/4948-159-0x00007FFFD5F40000-0x00007FFFD5F5E000-memory.dmp
memory/4948-234-0x00007FFFD6050000-0x00007FFFD6107000-memory.dmp
memory/4948-220-0x00007FFFC1460000-0x00007FFFC1489000-memory.dmp
memory/4948-216-0x00007FFFC1490000-0x00007FFFC149C000-memory.dmp
memory/4948-215-0x00007FFFC7D90000-0x00007FFFC7DA2000-memory.dmp
memory/4948-214-0x00007FFFC80C0000-0x00007FFFC80CD000-memory.dmp
memory/4948-213-0x00007FFFC80D0000-0x00007FFFC80DC000-memory.dmp
memory/4948-212-0x00007FFFC80E0000-0x00007FFFC80EC000-memory.dmp
memory/4948-211-0x00007FFFC80F0000-0x00007FFFC80FB000-memory.dmp
memory/4948-210-0x00007FFFC8100000-0x00007FFFC810B000-memory.dmp
memory/4948-209-0x00007FFFCA1E0000-0x00007FFFCA1EC000-memory.dmp
memory/4948-208-0x00007FFFCA1F0000-0x00007FFFCA1FC000-memory.dmp
memory/4948-207-0x00007FFFCA200000-0x00007FFFCA20E000-memory.dmp
memory/4948-206-0x00007FFFCA210000-0x00007FFFCA21D000-memory.dmp
memory/4948-205-0x00007FFFCA220000-0x00007FFFCA22C000-memory.dmp
memory/4948-204-0x00007FFFCA230000-0x00007FFFCA23B000-memory.dmp
memory/4948-203-0x00007FFFCB2A0000-0x00007FFFCB2AC000-memory.dmp
memory/4948-202-0x00007FFFCC460000-0x00007FFFCC46B000-memory.dmp
memory/4948-201-0x00007FFFD07A0000-0x00007FFFD07AC000-memory.dmp
memory/4948-200-0x00007FFFD07B0000-0x00007FFFD07BB000-memory.dmp
memory/4948-199-0x00007FFFD15D0000-0x00007FFFD15DB000-memory.dmp
memory/4948-198-0x00007FFFCA240000-0x00007FFFCA278000-memory.dmp
memory/4948-197-0x00007FFFCB2B0000-0x00007FFFCB2EE000-memory.dmp
memory/4948-196-0x00007FFFD1360000-0x00007FFFD137C000-memory.dmp
memory/4948-195-0x00007FFFBE9D0000-0x00007FFFBEAE8000-memory.dmp
memory/4948-194-0x00007FFFD1CD0000-0x00007FFFD1CF5000-memory.dmp
memory/4948-193-0x00007FFFBEAF0000-0x00007FFFBEE67000-memory.dmp
memory/4948-219-0x00007FFFD2B40000-0x00007FFFD2B4B000-memory.dmp
memory/4948-217-0x00007FFFBE770000-0x00007FFFBE9C2000-memory.dmp
memory/4948-177-0x00007FFFD6050000-0x00007FFFD6107000-memory.dmp
memory/4948-176-0x00007FFFD5F20000-0x00007FFFD5F36000-memory.dmp
memory/4948-175-0x00007FFFD22B0000-0x00007FFFD22DE000-memory.dmp
memory/4948-123-0x00007FFFD6160000-0x00007FFFD618C000-memory.dmp
memory/4948-172-0x00007FFFD6110000-0x00007FFFD613E000-memory.dmp
memory/4948-178-0x00007FFFD2290000-0x00007FFFD22A5000-memory.dmp
memory/4948-161-0x00007FFFCA280000-0x00007FFFCA3F1000-memory.dmp
memory/4948-165-0x00007FFFD22E0000-0x00007FFFD230B000-memory.dmp
memory/4948-121-0x00007FFFD6190000-0x00007FFFD61A8000-memory.dmp
memory/4948-127-0x00007FFFD6140000-0x00007FFFD6159000-memory.dmp
memory/4948-564-0x00007FFFD6190000-0x00007FFFD61A8000-memory.dmp
memory/4948-154-0x00007FFFD5FE0000-0x00007FFFD6015000-memory.dmp
memory/4948-152-0x00007FFFD6020000-0x00007FFFD6030000-memory.dmp
memory/4948-148-0x00007FFFD6030000-0x00007FFFD6044000-memory.dmp
memory/4948-146-0x00007FFFD78A0000-0x00007FFFD78C4000-memory.dmp
memory/4948-145-0x00000282C7B10000-0x00000282C7E87000-memory.dmp
memory/4948-221-0x00007FFFD6030000-0x00007FFFD6044000-memory.dmp
memory/4948-222-0x00007FFFD5F40000-0x00007FFFD5F5E000-memory.dmp
memory/4948-223-0x00007FFFCA280000-0x00007FFFCA3F1000-memory.dmp
memory/4948-224-0x00007FFFD22E0000-0x00007FFFD230B000-memory.dmp
memory/4948-225-0x00007FFFBEE70000-0x00007FFFBF2D4000-memory.dmp
memory/4948-230-0x00007FFFD6140000-0x00007FFFD6159000-memory.dmp
memory/4948-235-0x00007FFFBEAF0000-0x00007FFFBEE67000-memory.dmp
memory/4948-250-0x00007FFFBE770000-0x00007FFFBE9C2000-memory.dmp
memory/4948-218-0x00000282C7B10000-0x00000282C7E87000-memory.dmp
memory/4948-233-0x00007FFFD6110000-0x00007FFFD613E000-memory.dmp
memory/4948-226-0x00007FFFD78A0000-0x00007FFFD78C4000-memory.dmp
memory/4948-276-0x00007FFFBEE70000-0x00007FFFBF2D4000-memory.dmp
memory/4948-143-0x00007FFFBEAF0000-0x00007FFFBEE67000-memory.dmp
memory/4948-342-0x00007FFFD6110000-0x00007FFFD613E000-memory.dmp
memory/4948-334-0x00007FFFBEE70000-0x00007FFFBF2D4000-memory.dmp
memory/4948-385-0x00007FFFD78A0000-0x00007FFFD78C4000-memory.dmp
memory/4948-384-0x00007FFFBEE70000-0x00007FFFBF2D4000-memory.dmp
memory/4948-395-0x00007FFFD6030000-0x00007FFFD6044000-memory.dmp
memory/4948-115-0x00007FFFD78A0000-0x00007FFFD78C4000-memory.dmp
memory/4948-142-0x00007FFFBEE70000-0x00007FFFBF2D4000-memory.dmp
memory/4948-139-0x00007FFFD6050000-0x00007FFFD6107000-memory.dmp
memory/4948-136-0x00007FFFD6110000-0x00007FFFD613E000-memory.dmp
memory/4948-132-0x00007FFFD7040000-0x00007FFFD704D000-memory.dmp
memory/4948-129-0x00007FFFD7880000-0x00007FFFD788D000-memory.dmp
memory/4948-107-0x00007FFFBEE70000-0x00007FFFBF2D4000-memory.dmp
memory/4948-117-0x00007FFFD7890000-0x00007FFFD789F000-memory.dmp
memory/4948-491-0x00007FFFD5F40000-0x00007FFFD5F5E000-memory.dmp
memory/4948-477-0x00007FFFBEE70000-0x00007FFFBF2D4000-memory.dmp
memory/4948-492-0x00007FFFCA280000-0x00007FFFCA3F1000-memory.dmp
memory/4948-511-0x00007FFFBEE70000-0x00007FFFBF2D4000-memory.dmp
memory/4948-534-0x00007FFFD1360000-0x00007FFFD137C000-memory.dmp
memory/4948-562-0x00007FFFD78A0000-0x00007FFFD78C4000-memory.dmp
memory/4948-563-0x00007FFFD7890000-0x00007FFFD789F000-memory.dmp
memory/4948-565-0x00007FFFD6160000-0x00007FFFD618C000-memory.dmp
memory/4948-566-0x00007FFFD6140000-0x00007FFFD6159000-memory.dmp
memory/4948-570-0x00007FFFD6050000-0x00007FFFD6107000-memory.dmp
memory/4948-569-0x00007FFFD6110000-0x00007FFFD613E000-memory.dmp
memory/4948-571-0x00007FFFBEAF0000-0x00007FFFBEE67000-memory.dmp
memory/4948-577-0x00007FFFD22E0000-0x00007FFFD230B000-memory.dmp
memory/4948-585-0x00007FFFCB2B0000-0x00007FFFCB2EE000-memory.dmp
memory/4948-584-0x00007FFFD1360000-0x00007FFFD137C000-memory.dmp
memory/4948-586-0x00007FFFBEE70000-0x00007FFFBF2D4000-memory.dmp
memory/4948-588-0x00007FFFCA240000-0x00007FFFCA278000-memory.dmp
memory/4948-590-0x00007FFFC1460000-0x00007FFFC1489000-memory.dmp
memory/4948-589-0x00007FFFBE770000-0x00007FFFBE9C2000-memory.dmp
memory/4948-587-0x00000282C7B10000-0x00000282C7E87000-memory.dmp
memory/4948-583-0x00007FFFBE9D0000-0x00007FFFBEAE8000-memory.dmp
memory/4948-582-0x00007FFFD1CD0000-0x00007FFFD1CF5000-memory.dmp
memory/4948-581-0x00007FFFD2B40000-0x00007FFFD2B4B000-memory.dmp
memory/4948-580-0x00007FFFD2290000-0x00007FFFD22A5000-memory.dmp
memory/4948-579-0x00007FFFD5F20000-0x00007FFFD5F36000-memory.dmp
memory/4948-578-0x00007FFFD22B0000-0x00007FFFD22DE000-memory.dmp
memory/4948-576-0x00007FFFCA280000-0x00007FFFCA3F1000-memory.dmp
memory/4948-575-0x00007FFFD5F40000-0x00007FFFD5F5E000-memory.dmp
memory/4948-574-0x00007FFFD5FE0000-0x00007FFFD6015000-memory.dmp
memory/4948-573-0x00007FFFD6020000-0x00007FFFD6030000-memory.dmp
memory/4948-572-0x00007FFFD6030000-0x00007FFFD6044000-memory.dmp
memory/4948-568-0x00007FFFD7040000-0x00007FFFD704D000-memory.dmp
memory/4948-567-0x00007FFFD7880000-0x00007FFFD788D000-memory.dmp
memory/4948-158-0x00007FFFD6140000-0x00007FFFD6159000-memory.dmp