Overview

overview

7

Static

static

3

2026-07-30...ar.exe

windows10-2004-x64

7

2026-07-30...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 15:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_762d2db706f9056b170bb97144f48c78_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 35.6MB
  • Sample260730-ss3cwsck8t
  • SHA256 6b3ecfdaeec3dfb824a02b0446d8bbc3490753d5db8932baf9818657698eec48
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 16 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_762d2db706f9056b170bb97144f48c78_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_762d2db706f9056b170bb97144f48c78_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Users\Admin\AppData\Local\Temp\2026-07-30_762d2db706f9056b170bb97144f48c78_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-30_762d2db706f9056b170bb97144f48c78_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3396
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:2980

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        SDL2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\SDL2.dll
        • Size 2.4MB
        • SHA256 520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2_image.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\SDL2_image.dll
        • Size 122KB
        • SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2_mixer.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\SDL2_mixer.dll
        • Size 285KB
        • SHA256 2a0fc5e9f72c2eaec3240cb82b7594a58ccda609485981f256b94d0a4dd8d6f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SDL2_ttf.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\SDL2_ttf.dll
        • Size 1.5MB
        • SHA256 fcdfabdfce868eb33f7514025ff59c1bb6c418f1bcd6ace2300a9cd4053e1d63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\VCRUNTIME140.dll
        • Size 95KB
        • SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\VCRUNTIME140_1.dll
        • Size 36KB
        • SHA256 34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\_asyncio.pyd
        • Size 63KB
        • SHA256 a9a99a2b847e46c0efce7fcfefd27f4bce58baf9207277c17bffd09ef4d274e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\_bz2.pyd
        • Size 81KB
        • SHA256 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp310-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\_cffi_backend.cp310-win_amd64.pyd
        • Size 174KB
        • SHA256 4f1ce205c2be986c9d38b951b6bcb6045eb363e06dacc069a41941f80be9068c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\_ctypes.pyd
        • Size 120KB
        • SHA256 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\_decimal.pyd
        • Size 248KB
        • SHA256 9aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\_elementtree.pyd
        • Size 125KB
        • SHA256 262d771de19a071c2d086717c29dc9a704b33f95f6aa06ec2092f3e8f54495ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\_hashlib.pyd
        • Size 63KB
        • SHA256 caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\_lzma.pyd
        • Size 154KB
        • SHA256 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiprocessing.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\_multiprocessing.pyd
        • Size 33KB
        • SHA256 7581edea33c1db0a49b8361e51e6291688601640e57d75909fb2007b2104fa4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\_overlapped.pyd
        • Size 48KB
        • SHA256 2ebbb0583259528a5178dd37439a64affcb1ab28cf323c6dc36a8c30362aa992
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\_queue.pyd
        • Size 30KB
        • SHA256 925f05255f4aae0997dc4ec94d900fd15950fd840685d5b8aa755427c7422b14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\_socket.pyd
        • Size 77KB
        • SHA256 e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\_ssl.pyd
        • Size 156KB
        • SHA256 d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\_uuid.pyd
        • Size 24KB
        • SHA256 990586f2a2ba00d48b59bdd03d3c223b8e9fb7d7fab6d414bac2833eb1241ca2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\base_library.zip
        • Size 859KB
        • SHA256 a0f5c7f0bac1ea9dc86d60d20f903cc42cff3f21737426d69d47909fc28b6dcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        config.js
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\config.js
        • Size 33KB
        • SHA256 1d33869d1970c5c1e94fe964aebaba8125339fc8335960cd41da4d43a2d6ca82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        INSTALLER
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\flask-3.1.2.dist-info\INSTALLER
        • Size 4B
        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
        • MD5 SHA1 SHA512
        Submit Download

        freetype.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\freetype.dll
        • Size 639KB
        • SHA256 1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        gg.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\gg.py
        • Size 17KB
        • SHA256 1c3e8e18947d5a07cbdc1dbb744ac1be3a8f55d0b57b3dece8f15b54c3ef4704
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keyauth.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\keyauth.py
        • Size 19KB
        • SHA256 3b75d239374a256eb9c64927c819ad6f9af5c8185494a4180b291c6ad8fcf948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libjpeg-9.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\libjpeg-9.dll
        • Size 238KB
        • SHA256 3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libmodplug-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\libmodplug-1.dll
        • Size 259KB
        • SHA256 0c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libogg-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\libogg-0.dll
        • Size 25KB
        • SHA256 57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libopus-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\libopus-0.dll
        • Size 359KB
        • SHA256 771cae79410f7fcc4f993a105a18c4ed9e8cbddd6f807a42228d95f575808806
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libopusfile-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\libopusfile-0.dll
        • Size 45KB
        • SHA256 ccaaca81810bd2d1cab4692b4253a639f8d5516996db0e24d881efd3efdcc6a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libpng16-16.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\libpng16-16.dll
        • Size 206KB
        • SHA256 e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\libssl-1_1.dll
        • Size 688KB
        • SHA256 d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libtiff-5.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\libtiff-5.dll
        • Size 422KB
        • SHA256 ebfe97ac5ef26b94945af3db5ffd110a4b8e92dc02559bf81ccb33f0d5ebce95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libwebp-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\libwebp-7.dll
        • Size 437KB
        • SHA256 9a53563b6058f70f2725029b7dd2fe96f869c20e8090031cd303e994dfe07b50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        portmidi.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\portmidi.dll
        • Size 41KB
        • SHA256 c9f8d9043ac1570b10f104f2d00aec791f56261c84ee40773be73d0a3822e013
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\pyexpat.pyd
        • Size 194KB
        • SHA256 4a2d59993bce76790c6d923af81bf404f8e2cb73552e320113663b14cf78748c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\python3.DLL
        • Size 64KB
        • SHA256 dc909eb798a23ba8ee9f8e3f307d97755bc0d2dc0cb342cedae81fbbad32a8a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\python310.dll
        • Size 4.3MB
        • SHA256 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pythoncom310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\pywin32_system32\pythoncom310.dll
        • Size 664KB
        • SHA256 aa968a983382fd68b3e81ba56f4e34861c47dace4afed5dab24648257ff440b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes310.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\pywin32_system32\pywintypes310.dll
        • Size 132KB
        • SHA256 7a7e9bce1b56932dcc1d27edd05adbaeab82a201a15e0f24d2d32fbd99c1b682
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\select.pyd
        • Size 29KB
        • SHA256 db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\unicodedata.pyd
        • Size 1.1MB
        • SHA256 1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        welcome.mp3
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\welcome.mp3
        • Size 1.1MB
        • SHA256 e9f2abe2759061a1f225a2c5b0ac51f38755acd51374458dd87067749fcd2958
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\win32\win32api.pyd
        • Size 131KB
        • SHA256 d2c0726bbc6707aec4e86743496b719cb8c6654dd77f6670290ef1beebb2a02e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI10962\zlib1.dll
        • Size 106KB
        • SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download