d2695cccf9b93f92205653b325f30bdfc7870119b70dea980727c30f31cfacd0

Analysis

max time kernel
150s
max time network
23s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_07f38cfe6e1a5ef6a33626a97c99fb05_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 17.1MB
Sample260720-mnhvsshv8x
SHA256 d2695cccf9b93f92205653b325f30bdfc7870119b70dea980727c30f31cfacd0
MD5 07f38cfe6e1a5ef6a33626a97c99fb05
SHA1 cbacb2c903d03ec8f141208c2b58eb217ce8e9a8
SHA512 02a7358bb93af832f00afe9e960792014919dff6b9a176eb859391cc14464ba46ab9c3f5de099a93fa65a0903b8d5ccba9e7893c0565484992288ee987324294
SSDEEP 98304:xDCibVb7ozbMsdDquUWKpy3o0TksGXQX2isKq8wJX9ulnTrdntWkmzAcelK9411f:xDCUb7ApUo3o0TPGXQXtpl9TQzcQgp
TLSH
T114074A06B361C465D41A82388DD7C7AAAB717C91CF2283C736E5B36E1E377D12EB6601
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3952	41a6fec11a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5084	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-20_07f38cfe6e1a5ef6a33626a97c99fb05_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-07-20_07f38cfe6e1a5ef6a33626a97c99fb05_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1568	timeout.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4900	2026-07-20_07f38cfe6e1a5ef6a33626a97c99fb05_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3952	41a6fec11a.exe
Token: 33	3952	41a6fec11a.exe
Token: SeIncBasePriorityPrivilege	3952	41a6fec11a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 3952	4900	2026-07-20_07f38cfe6e1a5ef6a33626a97c99fb05_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	90
PID 4900 wrote to memory of 5084	4900	2026-07-20_07f38cfe6e1a5ef6a33626a97c99fb05_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	91
PID 5084 wrote to memory of 1568	5084	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-20_07f38cfe6e1a5ef6a33626a97c99fb05_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_07f38cfe6e1a5ef6a33626a97c99fb05_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Users\Admin\AppData\Local\Temp\41a6fec11a.exe
  "C:\Users\Admin\AppData\Local\Temp\41a6fec11a.exe" --morphed
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del_cbbd3f923d324ffd88ab37d68262b86e.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

41a6fec11a.exe

Path C:\Users\Admin\AppData\Local\Temp\41a6fec11a.exe
Size 17.1MB
SHA256 518b42e8144472657cc5d6817dc32b674024234678fa321abd171b6e7f81a001
MD5 b2de7e00e69da958dc0d98d3995d105d
SHA1 ae2d635ab54490be7e8bb87d1ebf48fcb7f6515a
SHA512 246769761d2300de272575297f6aea5ddae53b09c838a661a336f60667de92bf73dfe7236a312bcedc212089468639a1b677a07c660fa49daf5b050c8a84bcd4
SSDEEP 98304:xDCibVb7ozbMsdDquUWKpy3o0TksGXQX2isKq8wJX9ulnTrdntWkmzAcelK9411g:xDCUb7ApUo3o0TPGXQXtpl9TQzcQgi
TLSH
T178074A06B361C465D41A82388DD7C7AAAB717C91CF2283C736E5B36E1E377D12EB6601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_cbbd3f923d324ffd88ab37d68262b86e.bat

Path C:\Users\Admin\AppData\Local\Temp\del_cbbd3f923d324ffd88ab37d68262b86e.bat
Size 450B
SHA256 10a5370da95eb903b6c91163d6adaab4460b0cf09e23ae5332c91948759b1952
MD5 570413dce023cae21ac3f5bc7383207a
SHA1 2a7e7de2f5afa37fea1925c815e5c2982e6bd1e1
SHA512 53f7ff890d027b595adca378227d8a73ab86e4afb4c7d375b09120157c8b64a9b8485ee96065615889a30966aac80fc56ef97f2d582c6f41c65dae4f17359314
TLSH
T1F2F05C029193CF450020B0B741B924C9C1D89C4D2F0D3F6293E4CF5E12AB55BE9D2FE2
MD5 SHA1 SHA512 TLSH