Analysis
- max time kernel
148s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 01:46
General
- Target 2026-07-09_e72bea7b6589b394d2ece8e16af4a724_anydesk_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc.exe
- Size 551KB
- Sample260709-b7beaabv4l
- SHA256 ee87bac2340f4d1ff529e43a75d497a0a6f0a3945c82f21a367de203c94275e3
Score
10/10
Malware Config
Signatures
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
- Windows security bypass 2 TTPs 1 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Windows security modification 2 TTPs 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_e72bea7b6589b394d2ece8e16af4a724_anydesk_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_e72bea7b6589b394d2ece8e16af4a724_anydesk_cobalt-strike_glassworm_icedid_luca-stealer_njrat_stealc.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Windows security modification
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2596-1-0x0000017403EA0000-0x0000017403EA1000-memory.dmp
memory/2596-0-0x0000017403E90000-0x0000017403E91000-memory.dmp
memory/2596-8-0x0000017403EB0000-0x0000017403EB1000-memory.dmp
memory/2596-2-0x0000017403E90000-0x0000017403E91000-memory.dmp
memory/2596-17-0x00007FFCD4E58000-0x00007FFCD4E59000-memory.dmp
memory/2596-18-0x00007FF70B440000-0x00007FF70B4CE000-memory.dmp