e16c5e545943cdb2bd135a7a1d740506e074fec0673c50d40f946259fc684408

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 01:19

Target
2026-07-23_421cbb5fb29279ce9a9c9431c8aad6ee_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 879KB
Sample260724-bpy3mayygs
SHA256 e16c5e545943cdb2bd135a7a1d740506e074fec0673c50d40f946259fc684408
MD5 421cbb5fb29279ce9a9c9431c8aad6ee
SHA1 946a799f3fc4f3ce48a1a5b40f82d0c680c19299
SHA512 33613ce67011a99c0aeed00e03143d7865258e29bc1cdf6bbfce37c6c9f9673eee7658d94e6b415e6898b4730264231c0e996b1545120a69f9bda7e36d186661
SSDEEP 12288:NTdsKDjxeLC76kCzpiZ9t2HEynabst0kooVZubKBY/7EN4+Mjp72vifj5flmDxcN:NKUV76kCkfaaUHZubKBYYm/p72iX
TLSH
T11D156C16A66400BDE0B7C6B4CE665D43E771B84B0370AADB03D05EA63F277D45A3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-07-23_421cbb5fb29279ce9a9c9431c8aad6ee_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-07-23_421cbb5fb29279ce9a9c9431c8aad6ee_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6976 wrote to memory of 1988	6976	2026-07-23_421cbb5fb29279ce9a9c9431c8aad6ee_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	89
PID 6976 wrote to memory of 1988	6976	2026-07-23_421cbb5fb29279ce9a9c9431c8aad6ee_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	89
PID 6976 wrote to memory of 712	6976	2026-07-23_421cbb5fb29279ce9a9c9431c8aad6ee_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 6976 wrote to memory of 712	6976	2026-07-23_421cbb5fb29279ce9a9c9431c8aad6ee_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 6976 wrote to memory of 5392	6976	2026-07-23_421cbb5fb29279ce9a9c9431c8aad6ee_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	93
PID 6976 wrote to memory of 5392	6976	2026-07-23_421cbb5fb29279ce9a9c9431c8aad6ee_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	93
PID 6976 wrote to memory of 5200	6976	2026-07-23_421cbb5fb29279ce9a9c9431c8aad6ee_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	95
PID 6976 wrote to memory of 5200	6976	2026-07-23_421cbb5fb29279ce9a9c9431c8aad6ee_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-07-23_421cbb5fb29279ce9a9c9431c8aad6ee_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_421cbb5fb29279ce9a9c9431c8aad6ee_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:6976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5200

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3364

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6744