Analysis
- max time kernel
13s - max time network
16s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 23:36
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
- Size 2.2MB
- Sample260714-3llrnsfv6m
- SHA256 b8fb90b050aa3228c501490470a04fadc65ff910c24aeac689f98dc231f97407
- MD5 1d204bc4efc7eb02ed34433f8fa5d7ca
- SHA1 7b5554d7de9f6f00d7ba37b32706f51ab28df4f2
- SHA512 b37614ebb8de900ff0553489ee23efc92b0978e2c3a3e8ed314921213ad1dd75e59079d767c2fd6877883db6ab56578bccd773dc3977ff523d28173c178daeb0
- SSDEEP 49152:+ow3BdFbOP7vPhgvSblBi20OZtRZx45nemHpelt6moYlkEkIuJArB+O93+x:Lv7vPhgvSblBi20NIt6JjEkorBru
- TLSH T15CB5BF5B677811E4C1B7C13DC142561BFAB2346903709BEB23D09A6B1F637E4AA3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs
Disable Windows Driver Blocklist via Registry.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0" reg.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 2 api.ipify.org - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win11.ini 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe - Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe - Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 5764 wmic.exe 5764 wmic.exe 5764 wmic.exe 5764 wmic.exe 1392 wmic.exe 1392 wmic.exe 1392 wmic.exe 1392 wmic.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5764 wmic.exe Token: SeSecurityPrivilege 5764 wmic.exe Token: SeTakeOwnershipPrivilege 5764 wmic.exe Token: SeLoadDriverPrivilege 5764 wmic.exe Token: SeSystemProfilePrivilege 5764 wmic.exe Token: SeSystemtimePrivilege 5764 wmic.exe Token: SeProfSingleProcessPrivilege 5764 wmic.exe Token: SeIncBasePriorityPrivilege 5764 wmic.exe Token: SeCreatePagefilePrivilege 5764 wmic.exe Token: SeBackupPrivilege 5764 wmic.exe Token: SeRestorePrivilege 5764 wmic.exe Token: SeShutdownPrivilege 5764 wmic.exe Token: SeDebugPrivilege 5764 wmic.exe Token: SeSystemEnvironmentPrivilege 5764 wmic.exe Token: SeRemoteShutdownPrivilege 5764 wmic.exe Token: SeUndockPrivilege 5764 wmic.exe Token: SeManageVolumePrivilege 5764 wmic.exe Token: 33 5764 wmic.exe Token: 34 5764 wmic.exe Token: 35 5764 wmic.exe Token: 36 5764 wmic.exe Token: SeIncreaseQuotaPrivilege 5764 wmic.exe Token: SeSecurityPrivilege 5764 wmic.exe Token: SeTakeOwnershipPrivilege 5764 wmic.exe Token: SeLoadDriverPrivilege 5764 wmic.exe Token: SeSystemProfilePrivilege 5764 wmic.exe Token: SeSystemtimePrivilege 5764 wmic.exe Token: SeProfSingleProcessPrivilege 5764 wmic.exe Token: SeIncBasePriorityPrivilege 5764 wmic.exe Token: SeCreatePagefilePrivilege 5764 wmic.exe Token: SeBackupPrivilege 5764 wmic.exe Token: SeRestorePrivilege 5764 wmic.exe Token: SeShutdownPrivilege 5764 wmic.exe Token: SeDebugPrivilege 5764 wmic.exe Token: SeSystemEnvironmentPrivilege 5764 wmic.exe Token: SeRemoteShutdownPrivilege 5764 wmic.exe Token: SeUndockPrivilege 5764 wmic.exe Token: SeManageVolumePrivilege 5764 wmic.exe Token: 33 5764 wmic.exe Token: 34 5764 wmic.exe Token: 35 5764 wmic.exe Token: 36 5764 wmic.exe Token: SeIncreaseQuotaPrivilege 1392 wmic.exe Token: SeSecurityPrivilege 1392 wmic.exe Token: SeTakeOwnershipPrivilege 1392 wmic.exe Token: SeLoadDriverPrivilege 1392 wmic.exe Token: SeSystemProfilePrivilege 1392 wmic.exe Token: SeSystemtimePrivilege 1392 wmic.exe Token: SeProfSingleProcessPrivilege 1392 wmic.exe Token: SeIncBasePriorityPrivilege 1392 wmic.exe Token: SeCreatePagefilePrivilege 1392 wmic.exe Token: SeBackupPrivilege 1392 wmic.exe Token: SeRestorePrivilege 1392 wmic.exe Token: SeShutdownPrivilege 1392 wmic.exe Token: SeDebugPrivilege 1392 wmic.exe Token: SeSystemEnvironmentPrivilege 1392 wmic.exe Token: SeRemoteShutdownPrivilege 1392 wmic.exe Token: SeUndockPrivilege 1392 wmic.exe Token: SeManageVolumePrivilege 1392 wmic.exe Token: 33 1392 wmic.exe Token: 34 1392 wmic.exe Token: 35 1392 wmic.exe Token: 36 1392 wmic.exe Token: SeIncreaseQuotaPrivilege 1392 wmic.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3240 LogonUI.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4320 wrote to memory of 5764 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 88 PID 4320 wrote to memory of 1392 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 91 PID 4320 wrote to memory of 3680 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 93 PID 3680 wrote to memory of 2872 3680 cmd.exe 94 PID 4320 wrote to memory of 2968 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 95 PID 2968 wrote to memory of 3208 2968 cmd.exe 96 PID 4320 wrote to memory of 4632 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 97 PID 4632 wrote to memory of 5572 4632 cmd.exe 98 PID 4320 wrote to memory of 2516 4320 2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 99 PID 2516 wrote to memory of 5252 2516 cmd.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_1d204bc4efc7eb02ed34433f8fa5d7ca_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5764
-
-
C:\Windows\System32\Wbem\wmic.exewmic PATH Win32_VideoController GET PNPDeviceID2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1392
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy\ /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f2⤵
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Policy\ /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f3⤵PID:2872
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Config\ /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CI\Config\ /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f3⤵
- Modify Registry: Disable Windows Driver Blocklist
PID:3208
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity\ /v Enabled /t REG_DWORD /d 0 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\system32\reg.exereg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity\ /v Enabled /t REG_DWORD /d 0 /f3⤵PID:5572
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c shutdown -r -t 0 -f2⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\system32\shutdown.exeshutdown -r -t 0 -f3⤵PID:5252
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a2a855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3240
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:5804