Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 01:23
General
- Target 2026-07-28_4262cd81eaa213dba212e14b0a3d5a28_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 15.4MB
- Sample260729-br42naek21
- SHA256 dd865ad29a4afc719cd3916ff2c6b013c819c634be8f462ae99b786f57c94554
Malware Config
Signatures
- Loads dropped DLL 24 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_4262cd81eaa213dba212e14b0a3d5a28_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_4262cd81eaa213dba212e14b0a3d5a28_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_4262cd81eaa213dba212e14b0a3d5a28_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_4262cd81eaa213dba212e14b0a3d5a28_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "manage-bde -protectors -get C:"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\manage-bde.exe"C:\Windows\system32\manage-bde.exe" -protectors -get C:4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_tkinter.pyd
base_library.zip
md.cp312-win_amd64.pyd
md__mypyc.cp312-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python3.DLL
python312.dll
select.pyd
tcl86t.dll
msgcat-1.6.1.tm
auto.tcl
cp1252.enc
pkgIndex.tcl
init.tcl
pkgIndex.tcl
package.tcl
tclIndex
tm.tcl
tk86t.dll
button.tcl
entry.tcl
icons.tcl
listbox.tcl
menu.tcl
panedwindow.tcl
pkgIndex.tcl
scale.tcl
tk.tcl
unicodedata.pyd
zlib1.dll
memory/3220-1014-0x00007FFCEA740000-0x00007FFCEB0E4000-memory.dmp
memory/3220-1012-0x000001B56CBC0000-0x000001B56CBE2000-memory.dmp
memory/3220-1009-0x00007FFCEA740000-0x00007FFCEB0E4000-memory.dmp
memory/3220-1008-0x00007FFCEA740000-0x00007FFCEB0E4000-memory.dmp
memory/3220-1007-0x00007FFCEA8CF000-0x00007FFCEA8D0000-memory.dmp
memory/4864-1032-0x00007FFCFDEF0000-0x00007FFCFDF1A000-memory.dmp
memory/4864-1033-0x0000021006420000-0x0000021006919000-memory.dmp