9769381c2ea81d31f6f9ffae46cd96f60bab926f049c4f7f707175f9cae65a54

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 6.8MB
Sample260719-qmqe2aev71
SHA256 9769381c2ea81d31f6f9ffae46cd96f60bab926f049c4f7f707175f9cae65a54
MD5 2bac65f4c3713b33318f54aca6776649
SHA1 755861eda19da701f270e117fbce86986fe21858
SHA512 188008a340ed44c85f825508556eb59f99a0402b8473fbf6338e8b1520ff6148d07f3be78275b7d7b80457c2678e5e20d8aa4a36ca9380f86fa88345d1d49539
SSDEEP 98304:5n98uAx9XQsjA1h9eT393YigJhH0yfT+q2M51Y7uRlXgVLRuq97TgiKhOCJj2OB:5n9HU9VjA1HeT39IigbauDXURuATm4A
TLSH
T17F763369637208F4E8B5817EC1B1C26DF2A1B8664765D78F13E00A533F17BE2593AF42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Loads dropped DLL 6 IoCs

pid	Process
2252	2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2252	2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2252	2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2252	2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2252	2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2252	2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
2356	tasklist.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2420	powershell.exe
2800	powershell.exe
2176	powershell.exe
2768	powershell.exe
5840	powershell.exe
1052	powershell.exe
2376	powershell.exe

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3612	cmd.exe
1156	cmd.exe
5796	cmd.exe
1752	cmd.exe
4240	cmd.exe
4796	cmd.exe
1664	cmd.exe
4324	cmd.exe
5412	cmd.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1052	powershell.exe
1052	powershell.exe
2376	powershell.exe
2376	powershell.exe
2376	powershell.exe
2420	powershell.exe
2420	powershell.exe
2800	powershell.exe
2800	powershell.exe
2176	powershell.exe
2176	powershell.exe
2768	powershell.exe
2768	powershell.exe
5840	powershell.exe
5840	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	powershell.exe
Token: SeIncreaseQuotaPrivilege	1052	powershell.exe
Token: SeSecurityPrivilege	1052	powershell.exe
Token: SeTakeOwnershipPrivilege	1052	powershell.exe
Token: SeLoadDriverPrivilege	1052	powershell.exe
Token: SeSystemProfilePrivilege	1052	powershell.exe
Token: SeSystemtimePrivilege	1052	powershell.exe
Token: SeProfSingleProcessPrivilege	1052	powershell.exe
Token: SeIncBasePriorityPrivilege	1052	powershell.exe
Token: SeCreatePagefilePrivilege	1052	powershell.exe
Token: SeBackupPrivilege	1052	powershell.exe
Token: SeRestorePrivilege	1052	powershell.exe
Token: SeShutdownPrivilege	1052	powershell.exe
Token: SeDebugPrivilege	1052	powershell.exe
Token: SeSystemEnvironmentPrivilege	1052	powershell.exe
Token: SeRemoteShutdownPrivilege	1052	powershell.exe
Token: SeUndockPrivilege	1052	powershell.exe
Token: SeManageVolumePrivilege	1052	powershell.exe
Token: 33	1052	powershell.exe
Token: 34	1052	powershell.exe
Token: 35	1052	powershell.exe
Token: 36	1052	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeIncreaseQuotaPrivilege	2376	powershell.exe
Token: SeSecurityPrivilege	2376	powershell.exe
Token: SeTakeOwnershipPrivilege	2376	powershell.exe
Token: SeLoadDriverPrivilege	2376	powershell.exe
Token: SeSystemProfilePrivilege	2376	powershell.exe
Token: SeSystemtimePrivilege	2376	powershell.exe
Token: SeProfSingleProcessPrivilege	2376	powershell.exe
Token: SeIncBasePriorityPrivilege	2376	powershell.exe
Token: SeCreatePagefilePrivilege	2376	powershell.exe
Token: SeBackupPrivilege	2376	powershell.exe
Token: SeRestorePrivilege	2376	powershell.exe
Token: SeShutdownPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeSystemEnvironmentPrivilege	2376	powershell.exe
Token: SeRemoteShutdownPrivilege	2376	powershell.exe
Token: SeUndockPrivilege	2376	powershell.exe
Token: SeManageVolumePrivilege	2376	powershell.exe
Token: 33	2376	powershell.exe
Token: 34	2376	powershell.exe
Token: 35	2376	powershell.exe
Token: 36	2376	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeIncreaseQuotaPrivilege	2420	powershell.exe
Token: SeSecurityPrivilege	2420	powershell.exe
Token: SeTakeOwnershipPrivilege	2420	powershell.exe
Token: SeLoadDriverPrivilege	2420	powershell.exe
Token: SeSystemProfilePrivilege	2420	powershell.exe
Token: SeSystemtimePrivilege	2420	powershell.exe
Token: SeProfSingleProcessPrivilege	2420	powershell.exe
Token: SeIncBasePriorityPrivilege	2420	powershell.exe
Token: SeCreatePagefilePrivilege	2420	powershell.exe
Token: SeBackupPrivilege	2420	powershell.exe
Token: SeRestorePrivilege	2420	powershell.exe
Token: SeShutdownPrivilege	2420	powershell.exe
Token: SeDebugPrivilege	2420	powershell.exe
Token: SeSystemEnvironmentPrivilege	2420	powershell.exe
Token: SeRemoteShutdownPrivilege	2420	powershell.exe
Token: SeUndockPrivilege	2420	powershell.exe
Token: SeManageVolumePrivilege	2420	powershell.exe
Token: 33	2420	powershell.exe
Token: 34	2420	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5212 wrote to memory of 2252	5212	2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 2252 wrote to memory of 1752	2252	2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 2252 wrote to memory of 5412	2252	2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	92
PID 5412 wrote to memory of 1052	5412	cmd.exe	93
PID 2252 wrote to memory of 3612	2252	2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	95
PID 3612 wrote to memory of 2376	3612	cmd.exe	96
PID 2252 wrote to memory of 4240	2252	2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	97
PID 4240 wrote to memory of 2420	4240	cmd.exe	98
PID 2252 wrote to memory of 4796	2252	2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	99
PID 4796 wrote to memory of 2800	4796	cmd.exe	100
PID 2252 wrote to memory of 1664	2252	2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	101
PID 1664 wrote to memory of 2176	1664	cmd.exe	102
PID 2252 wrote to memory of 1156	2252	2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	103
PID 1156 wrote to memory of 2768	1156	cmd.exe	104
PID 2252 wrote to memory of 5796	2252	2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	105
PID 5796 wrote to memory of 5840	5796	cmd.exe	106
PID 2252 wrote to memory of 4324	2252	2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	107
PID 4324 wrote to memory of 2356	4324	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5212
- C:\Users\Admin\AppData\Local\Temp\2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-07-19_2bac65f4c3713b33318f54aca6776649_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:1752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "(Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5412
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3612
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance Win32_BaseBoard).Manufacturer"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "(Get-CimInstance Win32_BaseBoard).Product""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance Win32_BaseBoard).Product"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "(Get-CimInstance Win32_BIOS).SMBIOSBIOSVersion""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance Win32_BIOS).SMBIOSBIOSVersion"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "(Get-CimInstance Win32_VideoController).Name""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance Win32_VideoController).Name"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "(Get-CimInstance Win32_DiskDrive).Model""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance Win32_DiskDrive).Model"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "(Get-CimInstance Win32_NetworkAdapter | Where-Object NetEnabled -eq $true).MACAddress""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "(Get-CimInstance Win32_NetworkAdapter | Where-Object NetEnabled -eq $true).MACAddress"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:2356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Command and Control

Exfiltration

Impact