Overview

overview

8

Static

static

3

2026-07-08...ar.exe

windows10-2004-x64

7

2026-07-08...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    93s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 06:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_ebee82263a65d81c2eb3ed5ece9d6234_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar.exe
  • Size 34.4MB
  • Sample260708-grrdfsbw71
  • SHA256 7f51299db1473aa36261929022744c40a420cbd33c8beee20c5babfee015c29e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarepersistenceransomwarespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 16 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_ebee82263a65d81c2eb3ed5ece9d6234_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_ebee82263a65d81c2eb3ed5ece9d6234_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4332
    • C:\Users\Admin\AppData\Local\Temp\onefile_4332_134279641816452249\WDCloud.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-08_ebee82263a65d81c2eb3ed5ece9d6234_cobalt-strike_coinminer_glassworm_hijackloader_icedid_njrat_pos_satacom_vidar.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:1336
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:972
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:5424
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:5436
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4688

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        prep_Activatable Class_Hermes_perf.cache
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
        • Size 599B
        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        _modexp.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Math\_modexp.pyd
        • Size 46KB
        • SHA256 1326490aef0748df1df5e65bb281bd492a70a1c2da3100c900c58202e3f4eaa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
        • Size 85KB
        • SHA256 c0dd9496b19ba9536a78a43a97704e7d4bef3c901d196ed385e771366682819d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_cffi_backend.pyd
        • Size 179KB
        • SHA256 88451f322707b22c43b36796c3711bace64f50ef7b22c94fbf29a04a2838e533
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd
        • Size 160KB
        • SHA256 6e571d93ce55d09583ec91c607883a43c1da3d4d36794d68c6ecd6bea4ab466a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
        • Size 79KB
        • SHA256 9e97b782b55400e5a914171817714bbbc713c0a396e30496c645fc82835e4b34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _win32sysloader.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_win32sysloader.pyd
        • Size 14KB
        • SHA256 e7c6cc136aeb5bbd7a9f3d942c6c3c2aad475befea420bd57bb33cacf5150253
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pythoncom39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pythoncom39.dll
        • Size 652KB
        • SHA256 86be43773e1b863cc2e87c980ae9fd8291eff3d82dd4136491b8f95b2dbf868f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pywintypes39.dll
        • Size 136KB
        • SHA256 15ff353b873b58c7a8af42d94462aa4cb4ea03c10673a87a0d7f2c42b7ec60c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd
        • Size 29KB
        • SHA256 71ed480da28968a7fd07934e222ae87d943677468936fd419803280d0cad07f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32api.pyd
        • Size 129KB
        • SHA256 0813e92197b04508363d93f3fc2065e962baab44f8a2c18c6297e1fb348cc679
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32gui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32gui.pyd
        • Size 222KB
        • SHA256 03ea618102198c9ef41d00b0b197544cb6998452221f1f66f7bf0ef5874df1e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32process.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32process.pyd
        • Size 51KB
        • SHA256 9e040738216f2d806c7230a57cd1143178bb0c9e13c12779b644e4da98a3cef3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        winxpgui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\winxpgui.pyd
        • Size 619KB
        • SHA256 04ef94edf7344eff69fe145f7de81ade548feb94a0c9927744a1ab5cd852103c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4332_134279641816452249\VCRUNTIME140.dll
        • Size 95KB
        • SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WDCloud.exe
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4332_134279641816452249\WDCloud.exe
        • Size 11.6MB
        • SHA256 c59b49b3aa7c75d9f873f263af723fae482c67da5be7a17b230c22e1a7964e73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4332_134279641816452249\psutil\_psutil_windows.pyd
        • Size 67KB
        • SHA256 1090e69fa90e0f55b90a2ae429aad7843db013eeef42aa8b0f0267f76abbf6be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4332_134279641816452249\python39.dll
        • Size 4.3MB
        • SHA256 324963a39b8fd045ff634bb3271508dab5098b4d99e85e7648d0b47c32dc85c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __init__.py
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4332_134279641816452249\win32com\gen_py\__init__.py
        • Size 176B
        • SHA256 52c72cf96b12ae74d84f6c049775da045fae47c007dc834ca4dac607b6f518ea
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        dicts.dat
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4332_134279641816452249\win32com\gen_py\dicts.dat
        • Size 10B
        • SHA256 83cda9fecc9c008b22c0c8e58cbcbfa577a3ef8ee9b2f983ed4a8659596d5c11
        • MD5 SHA1 SHA512
        Submit Download

        memory/5436-160-0x00000278801E0000-0x00000278802E0000-memory.dmp
        Download

        memory/5436-206-0x00000278942D0000-0x00000278942F0000-memory.dmp
        Download

        memory/5436-175-0x0000027893E30000-0x0000027893F30000-memory.dmp
        Download

        memory/5436-192-0x0000027883B90000-0x0000027883BB0000-memory.dmp
        Download

        memory/5436-173-0x0000027883A30000-0x0000027883A50000-memory.dmp
        Download