f185617ab50d04984885932cb29eaa54d8cbb3bf74cc1c6214436e7f6494d179

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 00:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_8c89e32e42f0b75b87552f4075c400bf_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 17.2MB
Sample260724-a7ftbsyves
SHA256 f185617ab50d04984885932cb29eaa54d8cbb3bf74cc1c6214436e7f6494d179
MD5 8c89e32e42f0b75b87552f4075c400bf
SHA1 3850ca383883ab5ce664f01d46d7a85d6a148add
SHA512 2527fffe77e3e8c03f66f3c1d7172cffdf482cb71feb9d2120785c888bec37c0f2e66f7e26b1d613293b1c446924cf018d915b5724cb3e2301ce9a388ac7883c
SSDEEP 98304:xDCibVb7ozbMsdDquUWKpy3o0TksGXQX2isKq8wJX9ulnTrdntWkmzAcelK9411V:xDCUb7ApUo3o0TPGXQXtpl9TQzcQgz
TLSH
T17E074A06B361C465D41A82388DD7C7AAAB717C91CF2283C736E5B36E1E377D12EB6601
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4208	7206eb3d4c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3468	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-24_8c89e32e42f0b75b87552f4075c400bf_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-07-24_8c89e32e42f0b75b87552f4075c400bf_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1340	timeout.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5616	2026-07-24_8c89e32e42f0b75b87552f4075c400bf_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	4208	7206eb3d4c.exe
Token: 33	4208	7206eb3d4c.exe
Token: SeIncBasePriorityPrivilege	4208	7206eb3d4c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5616 wrote to memory of 4208	5616	2026-07-24_8c89e32e42f0b75b87552f4075c400bf_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	90
PID 5616 wrote to memory of 3468	5616	2026-07-24_8c89e32e42f0b75b87552f4075c400bf_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	92
PID 3468 wrote to memory of 1340	3468	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-07-24_8c89e32e42f0b75b87552f4075c400bf_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_8c89e32e42f0b75b87552f4075c400bf_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5616
- C:\Users\Admin\AppData\Local\Temp\7206eb3d4c.exe
  "C:\Users\Admin\AppData\Local\Temp\7206eb3d4c.exe" --morphed
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del_d828de9ea508454a8caaa43414926c78.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7206eb3d4c.exe

Path C:\Users\Admin\AppData\Local\Temp\7206eb3d4c.exe
Size 17.2MB
SHA256 0dc9cd1252242182f63e0c782663d4b439e08183544b6ebcba3b28eed9999d13
MD5 0f6e8c6bf4f786b36984e8f2984915bc
SHA1 67a3a3871a23f0b05fdaf27368bfad0177f0b034
SHA512 c7b6b025976347140ad8664fd9a2ef036890ce1e924d3dc98213fc187fb1283ee76d6e571d23ead7f2b5a84d83e37a20235e0b5829aa61811dce8242ff228c9e
SSDEEP 98304:xDCibVb7ozbMsdDquUWKpy3o0TksGXQX2isKq8wJX9ulnTrdntWkmzAcelK9411Q:xDCUb7ApUo3o0TPGXQXtpl9TQzcQgm
TLSH
T160074A06B361C465D41A82388DD7C7AAAB717C91CF2283C736E5B36E1E377D12EB6601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

del_d828de9ea508454a8caaa43414926c78.bat

Path C:\Users\Admin\AppData\Local\Temp\del_d828de9ea508454a8caaa43414926c78.bat
Size 450B
SHA256 826f266fc46018bc27f4707efaa25a41d9cc10455d2620d22b5d6195b920620b
MD5 cc4c98eaf85cd664b48f1e0a58d1e3fc
SHA1 27c0b4ed11ba3cd27674db91398516fcd5136878
SHA512 573e8f11130b56363a20ce19dd6674b38667145e30c23d4dbd8d4f79601279a696f02f58a8c70785b43a55dd36a5cd4d2bd70247cf6ed1c580cbff908b5cbd4a
TLSH
T1EEF05CC191A7CA410450B0A601B9AE8E8190949D6F48371283E0CA6D22E6C2FADF3BD6
MD5 SHA1 SHA512 TLSH