e8f5e54392e3bf1bdf68fdf10385496d998e4b0a60d5f295bc11295168a011c6

Analysis

max time kernel
7s
max time network
10s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-07-17_13729bdf60f31315ffd0da781e5cd405_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 12.9MB
Sample260718-ffepvabz8v
SHA256 e8f5e54392e3bf1bdf68fdf10385496d998e4b0a60d5f295bc11295168a011c6
MD5 13729bdf60f31315ffd0da781e5cd405
SHA1 7409eae0143196a1433ab9860c398cca76428dbd
SHA512 8adaa4798aae929f64839874284aabcce3d9342f615f1e1bd491acf076b0d5511007d74aae94888e337de81bd61ef817f120ca85dab9e83cbe93b89d72be2e37
SSDEEP 98304:0b2YcgRTx1OZXYU5vQOI0b7QxyqmTkm3wHxFjrFktjLocmUCicG2nrVFIwPQlv:2tc2TPdEQh0b7QSTBg7yt3Qkcjr0wPuv
TLSH
T197D6E0F3AD4750E4CF3999B34753DE842F33BCA34A828F8EE65A195C495A75B2C4821C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	2026-07-17_13729bdf60f31315ffd0da781e5cd405_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4452	cmd.exe
3232	cmd.exe
1440	cmd.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
732	reg.exe
3656	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4704	shutdown.exe
Token: SeRemoteShutdownPrivilege	4704	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3468	PickerHost.exe
4664	LogonUI.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 4452	3200	2026-07-17_13729bdf60f31315ffd0da781e5cd405_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	90
PID 4452 wrote to memory of 732	4452	cmd.exe	91
PID 3200 wrote to memory of 3232	3200	2026-07-17_13729bdf60f31315ffd0da781e5cd405_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	92
PID 3232 wrote to memory of 3656	3232	cmd.exe	93
PID 3200 wrote to memory of 1440	3200	2026-07-17_13729bdf60f31315ffd0da781e5cd405_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	94
PID 1440 wrote to memory of 4704	1440	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-17_13729bdf60f31315ffd0da781e5cd405_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_13729bdf60f31315ffd0da781e5cd405_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Modify Registry: Disable Windows Driver Blocklist
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\CI\Config /v "VulnerableDriverBlocklistEnable" /t REG_DWORD /d 0 /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4452
- - C:\Windows\system32\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\CI\Config /v "VulnerableDriverBlocklistEnable" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v "Enabled" /t REG_DWORD /d 0 /f >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\system32\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v "Enabled" /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:3656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c shutdown -s -t 3
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\system32\shutdown.exe
    shutdown -s -t 3
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4704

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3468

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a28855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:6064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3200-0-0x00007FF678240000-0x00007FF6791B5000-memory.dmp

Download

memory/3200-1-0x00007FF678240000-0x00007FF6791B5000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads