Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 06:04
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-10_7cd44f06fef816b4f0b96c7716cd904f_agent-tesla_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target 2026-07-10_7cd44f06fef816b4f0b96c7716cd904f_agent-tesla_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc.exe
- Size 5.6MB
- Sample260710-gs5bpsdz6r
- SHA256 c09e13a04f548595edf0f71f2d8d0f3a6538251557c54bdc75efc145ceb95b9e
- MD5 7cd44f06fef816b4f0b96c7716cd904f
- SHA1 4ae3eb639ac79d5d02b7100b498f1f484b656fc5
- SHA512 6341f98af298eb6484425c3b7ea3f0b8b8102af7335fc335456bf1fefe9fd3f9ac8e015b8e7138b65e1030d15fffff660700dc32901c3bf208517473a168fa5b
- SSDEEP 49152:zRZb90wMwgGIj5oq6jZWpcvqC2Sud21qCmM1NgsmQ29W5U3PKP3JLKIBDXNtQnzv:dZ/6FgqbpCm39WJknHxor4F0d
- TLSH T18556BF46B3A840DCD072D1BC865BA603D372385507206BEB33D09A6A2F77AD45FBE791
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables (downlaoders) containing URLs to raw contents of a paste 3 IoCs
resource yara_rule behavioral2/memory/5752-1-0x0000000000250000-0x00000000007FA000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawPaste_URL behavioral2/files/0x000d00000001c612-8.dat INDICATOR_SUSPICIOUS_EXE_RawPaste_URL behavioral2/memory/1104-12-0x000001BC34250000-0x000001BC342E0000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawPaste_URL - Detects executables containing commands for clearing Windows Event Logs 2 IoCs
resource yara_rule behavioral2/memory/5752-1-0x0000000000250000-0x00000000007FA000-memory.dmp INDICATOR_SUSPICIOUS_ClearWinLogs behavioral2/files/0x000d00000001c615-18.dat INDICATOR_SUSPICIOUS_ClearWinLogs - Detects executables referencing many IR and analysis tools 2 IoCs
resource yara_rule behavioral2/memory/5752-1-0x0000000000250000-0x00000000007FA000-memory.dmp INDICATOR_SUSPICIOUS_References_SecTools behavioral2/files/0x000d00000001c615-18.dat INDICATOR_SUSPICIOUS_References_SecTools - Executes dropped EXE 2 IoCs
pid Process 1104 w0u3villkabphwcm.exe 3300 AstralClient.exe - Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini explorer.exe File opened for modification C:\Users\Public\desktop.ini explorer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini explorer.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 2 api.ipify.org - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe - Modifies registry class 24 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\NotificationData explorer.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f481cffcda87848be43b5fdf8091c1c60d0260001002600efbe11000000c8fffea8ad0fdd01f0a78e00bc0fdd01e9b14605bc0fdd0114000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1796 explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe 3300 AstralClient.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3300 AstralClient.exe 1796 explorer.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1104 w0u3villkabphwcm.exe Token: SeIncBasePriorityPrivilege 1104 w0u3villkabphwcm.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1796 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3300 AstralClient.exe 3300 AstralClient.exe 1796 explorer.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5752 wrote to memory of 1104 5752 2026-07-10_7cd44f06fef816b4f0b96c7716cd904f_agent-tesla_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc.exe 85 PID 5752 wrote to memory of 3300 5752 2026-07-10_7cd44f06fef816b4f0b96c7716cd904f_agent-tesla_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc.exe 87 PID 3300 wrote to memory of 3328 3300 AstralClient.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_7cd44f06fef816b4f0b96c7716cd904f_agent-tesla_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_7cd44f06fef816b4f0b96c7716cd904f_agent-tesla_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5752 -
C:\Users\Admin\AppData\Local\Temp\bnd_55ad0c09\w0u3villkabphwcm.exe"C:\Users\Admin\AppData\Local\Temp\bnd_55ad0c09\w0u3villkabphwcm.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1104
-
-
C:\Users\Admin\AppData\Local\Temp\bnd_55ad0c09\AstralClient.exe"C:\Users\Admin\AppData\Local\Temp\bnd_55ad0c09\AstralClient.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe" shell:AppsFolder\Microsoft.MinecraftUWP_8wekyb3d8bbwe!App3⤵
- Modifies registry class
PID:3328
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1796
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2936
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:6736
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
- Size 28KB
- SHA256 4b96712cdc3dde04ce0cb3adb9db65b2153d263f2acd32dddcff84a97cd5248c
- MD5 c83c0be729438796483e6d2000038a1a
- SHA1 c189946b7ec2d1f5f73fac385c34f8dacae29835
- SHA512 d5fee92cafffa76d5e106ec73ea61056b036580e2f2428ea2dceb07321e81fed78b3ac3998e9a8f4260beabbc0f833a02c36a725f7f36afa066b7f7b2446c316
- SSDEEP 96:jY7JxKf+PyUScK91ZuvGQbucJTNqQqtGKAFed8PQJAVt8jVKaA:s7Jgf+JK9vuOCJmAm84qVt8jV1A
- TLSH T11AD28756F404EA12DD0A2C36EFEADAEC23313E21CD9A031379D6B77F49B71C18968149
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bnd_55ad0c09\AstralClient.exe
- Size 5.1MB
- SHA256 d899a71f4208503df2cc146cb32828b49770bf0b2733ad77d73ab774e20a9a55
- MD5 ad97977a0e22d86d346ec916718a85e3
- SHA1 4bfd1562706266383b9219814c3e2e85b7da365e
- SHA512 804cba2ace9f2b2781d038225ccda3b651d67477e68490c78ea0be826c397e94fd7842d681aab7c2739374b3d9ae40de649c6965a6d2184ccaf0f776a65ec0b6
- SSDEEP 49152:VMwgGIj5oq6jZWpcvqC2Sud21qCmM1NgsmQ29W5U3PKP3JLKIBDXNtQnzENIoUlr:r6FgqbpCm39WJknHxor4F0d
- TLSH T11336BF5AB2B840ECD077D1BCD657EA07E2713C0507206AEB23D05A5A3F77AD01BBAB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bnd_55ad0c09\w0u3villkabphwcm.exe
- Size 561KB
- SHA256 59cb3021e8f090dd5482a247bb14735b6d503ac2be2df1723656d5c38ffa9d93
- MD5 f240af09aa62752be4a2c48da13c66ab
- SHA1 dd9f0073ac8d6cb52c7f8b4267a939808fdc4f90
- SHA512 1c454c42f26e74eda0f99147ed0dd385791d42882ecc12976df80610643e9fc3990f1b83d75d436ddc144feb34d9db82853b3ca0542c7ceeeb835db83419d527
- SSDEEP 12288:n95cpnXRnZsVlxaghIeS4eFAdk8wvA0crPnnRVpT:eXRnZso9mRlp
- TLSH T19AC44A247F988A09E580193E419E1610D7FA51F22632B343370AEF655D899DEDF2C3EB
- MD5 SHA1 SHA512 SSDEEP TLSH