Overview

overview

7

Static

static

3

2026-07-12...ar.exe

windows10-2004-x64

7

2026-07-12...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    12/07/2026, 21:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-12_989fcbcf06c0547a1fa35f2242483ba4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 22.9MB
  • Sample260712-1mb8hsbs8x
  • SHA256 d92fa55a209777765db755054a7bbe1d37a6968630274a347cbb5f8ef7c76c19
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
pyinstaller

Malware Config

Signatures

  • Loads dropped DLL 11 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_989fcbcf06c0547a1fa35f2242483ba4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_989fcbcf06c0547a1fa35f2242483ba4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2804
    • C:\Users\Admin\AppData\Local\Temp\2026-07-12_989fcbcf06c0547a1fa35f2242483ba4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-12_989fcbcf06c0547a1fa35f2242483ba4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      PID:2544
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x404 0x3f8
    1⤵
      PID:1420

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          Loop.xml
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\Loop.xml
          • Size 3KB
          • SHA256 c2df2a0fd4f57e9c10229848a345518f4b30e09b7ee7492eb75291fdf01a62e6
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\VCRUNTIME140.dll
          • Size 117KB
          • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\_bz2.pyd
          • Size 84KB
          • SHA256 178c6eeb30843e656cc407aaf53ae6d0f170966e4e0bdd2ee1bede73962275cd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\_ctypes.pyd
          • Size 124KB
          • SHA256 9ffdedd0f1f09f21870bd75c08d05c32994a1193be3955e367f260690a36cbd0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\_decimal.pyd
          • Size 251KB
          • SHA256 847e2b2c69ca623e0f96bbda0f421ca978fbb5925beec4cc5e4c5d9c966c4bbc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\_hashlib.pyd
          • Size 65KB
          • SHA256 823717926adce6b36f9c13b6555eaeaf5714c4756828f11cffc1ce0bef970a7e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\_lzma.pyd
          • Size 156KB
          • SHA256 f6e0c786395ccc7b22f4c435b19f7073eb5974eb29e09f4c91060cab10450e6a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\_socket.pyd
          • Size 83KB
          • SHA256 0e2c1089974a2757426dac3295201a33c990c36f3c09593f8a2b6e07fd36b99c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cp1252.enc
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\_tcl_data\encoding\cp1252.enc
          • Size 1KB
          • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\_tkinter.pyd
          • Size 66KB
          • SHA256 96d318146ce3f329209799e4d547c28c0d4b5ab5040da19221ef815540b5f78e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\base_library.zip
          • Size 1.3MB
          • SHA256 13e24b36c20b3da9914c67b61614b262f3fc1ca7b2ee205ded41acc57865bfef
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\libcrypto-3.dll
          • Size 5.0MB
          • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          loop.exe
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\loop.exe
          • Size 13.1MB
          • SHA256 b3a338fc290a5b3c950c57a064a5dc0f6505d98b512f17dc04216a150072511f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python312.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\python312.dll
          • Size 6.6MB
          • SHA256 3b56fa10d3797c231468cee42caeaaaff40dbede7bc0d142ec4878493f48e07d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\select.pyd
          • Size 32KB
          • SHA256 fcac4646ff709ac07aee532c4612a19b7070f2dd6ef67ba09c743644e92f7376
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tcl86t.dll
          • Size 1.8MB
          • SHA256 808960f1810e03cfd153be3d9ee9bf01717904c8a23bdcf22d98ff766e33ab96
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\tk86t.dll
          • Size 1.5MB
          • SHA256 aaa0f414484211caf42a0807a3afd70c53b172f59d05dfd9f1fc55244c26dc3b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\unicodedata.pyd
          • Size 1.1MB
          • SHA256 e7fe7ae7342b1dec8dfe52a95d768039a46189209b9f42a21c4d2473faaa1753
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          wallpaper.png
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\wallpaper.png
          • Size 199KB
          • SHA256 9ecb554f9f5fa82d1057219c95c455cb54515743d8f17d329fbac8c9a1b97869
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          winsound.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\winsound.pyd
          • Size 31KB
          • SHA256 5bca86870468ecac2da9234c7157007e59bf5697b1ab86c5d0f4d85ffc2f0ab8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          zlib1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28042\zlib1.dll
          • Size 144KB
          • SHA256 fc431c484e7d6f004d056ac215d6b7e3deb9c41a597065fc840b311e81adf1b8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2544-980-0x00007FFE3E630000-0x00007FFE3E659000-memory.dmp
          Download

          memory/2544-986-0x00007FFE3E630000-0x00007FFE3E659000-memory.dmp
          Download