03c905483c0136e6786d4c2e7d3ae18535887583b939294d06dfb0ba028d3bdb

Analysis

max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_4cf0715f304cd4b14300cfa9bf64af3c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 5.1MB
Sample260717-spl7haet5p
SHA256 03c905483c0136e6786d4c2e7d3ae18535887583b939294d06dfb0ba028d3bdb
MD5 4cf0715f304cd4b14300cfa9bf64af3c
SHA1 3fc78381be816755476dffa0560695dd71d93516
SHA512 9dca95632e38afd5487e524ab14f03dbf23c204d01ccee305a34d8153e9bdf944610d67655fdee3f900bb68462b5702e3a1079649f0b29e22ba820a8a0350bc3
SSDEEP 98304:geSvki8Be0b7cb15v5vRmFc9FwNH3600GQhMtzzEsNaCdhI4h:geSci8Be0b7cb1DJmb93nQW1aj
TLSH
T1C446C0A767F12ADDC266D0F8C112B53FE763B4282729B1E782D526A0DB13DD46738B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 8 IoCs

resource	yara_rule
behavioral2/memory/2572-0-0x00007FF740B50000-0x00007FF7410B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2572-8-0x000002676B770000-0x000002676BCD4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2572-9-0x000002676B770000-0x000002676BCD4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2572-10-0x000002676B770000-0x000002676BCD4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2572-1-0x000002676B770000-0x000002676BCD4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2572-11-0x000002676B770000-0x000002676BCD4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2572-13-0x00007FF740B50000-0x00007FF7410B4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/2572-14-0x000002676B770000-0x000002676BCD4000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1704	timeout.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 5108	2572	2026-07-17_4cf0715f304cd4b14300cfa9bf64af3c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	88
PID 5108 wrote to memory of 1940	5108	cmd.exe	90
PID 5108 wrote to memory of 2856	5108	cmd.exe	91
PID 5108 wrote to memory of 5860	5108	cmd.exe	92
PID 2572 wrote to memory of 616	2572	2026-07-17_4cf0715f304cd4b14300cfa9bf64af3c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	94
PID 616 wrote to memory of 5016	616	cmd.exe	96
PID 5016 wrote to memory of 1704	5016	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-07-17_4cf0715f304cd4b14300cfa9bf64af3c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_4cf0715f304cd4b14300cfa9bf64af3c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\2026-07-17_4cf0715f304cd4b14300cfa9bf64af3c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\2026-07-17_4cf0715f304cd4b14300cfa9bf64af3c_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe" MD5
    3⤵
    PID:1940
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2856
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:5860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo CURL Error: Timeout was reached && timeout /t 5"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo CURL Error: Timeout was reached && timeout /t 5"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:1704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2572-0-0x00007FF740B50000-0x00007FF7410B4000-memory.dmp

Download

memory/2572-8-0x000002676B770000-0x000002676BCD4000-memory.dmp

Download

memory/2572-9-0x000002676B770000-0x000002676BCD4000-memory.dmp

Download

memory/2572-10-0x000002676B770000-0x000002676BCD4000-memory.dmp

Download

memory/2572-1-0x000002676B770000-0x000002676BCD4000-memory.dmp

Download

memory/2572-11-0x000002676B770000-0x000002676BCD4000-memory.dmp

Download

memory/2572-13-0x00007FF740B50000-0x00007FF7410B4000-memory.dmp

Download

memory/2572-14-0x000002676B770000-0x000002676BCD4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads