Overview

overview

7

Static

static

3

2026-07-31...ar.exe

windows10-2004-x64

7

2026-07-31...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 11:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-31_53e4068c79a028a5cce7ef224282c07b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 64.0MB
  • Sample260731-n2ynvasxa1
  • SHA256 adcf4a7e5866f7710e160e56d9a301c9f6417909e8e0210c3efed8b3cefe5ad1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 54 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-31_53e4068c79a028a5cce7ef224282c07b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-31_53e4068c79a028a5cce7ef224282c07b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:6036
    • C:\Users\Admin\AppData\Local\Temp\2026-07-31_53e4068c79a028a5cce7ef224282c07b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-07-31_53e4068c79a028a5cce7ef224282c07b_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      PID:1548

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\PySide6\MSVCP140_1.dll
        • Size 27KB
        • SHA256 a3334166847fbad128f67add03ab4db2eb344f117e8e9f1bc8595d28117bc11f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140_2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\PySide6\MSVCP140_2.dll
        • Size 254KB
        • SHA256 e14d01942d1a7e34714766aad7871bc47e9a920d7adaecdffa306f8f77b02685
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\PySide6\Qt6Core.dll
        • Size 5.8MB
        • SHA256 4825d4960f69f848a2b08af8066a7a2338e3a4f63c2aebc7cbfed0f7b2ea7fe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\PySide6\Qt6Gui.dll
        • Size 8.8MB
        • SHA256 529e4c97f68a031f6acf45f9480761f859df8bc2f02ddc5dbdf05522d742c569
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt6Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\PySide6\Qt6Widgets.dll
        • Size 6.2MB
        • SHA256 d33dafdb2058cbb97e4f4c0e192dff5c30322129cac718a37bb0bf1f3288f885
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\PySide6\QtCore.pyd
        • Size 3.4MB
        • SHA256 b4e4665ca44c06cf720f0ca862310028d4eb102f2382fcd5f1b041b457bf2cb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\PySide6\QtGui.pyd
        • Size 4.0MB
        • SHA256 1f98a45a55b9d4677edf32d678ea3f88a2b791f20758267d1aa821664ac706dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\PySide6\QtWidgets.pyd
        • Size 5.9MB
        • SHA256 d90ea7e7f8719352b1695ecc0485b0da45886f01b7d63d827383084cf8792f58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyside6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\PySide6\pyside6.abi3.dll
        • Size 230KB
        • SHA256 49e534a361a6dc24fb271429998f49d0a82aa3839d43d4e3ec5bb81571d3e474
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_bz2.pyd
        • Size 84KB
        • SHA256 0ec5bdf4c688c1d2bda00f61e1f9e1369188c1019173a5412981f6569a997347
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_ctypes.pyd
        • Size 124KB
        • SHA256 ed4170b2c2c302639301a01c6aac4c5575e6e4c936edc803d3ba6c34444e35e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _elementtree.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_elementtree.pyd
        • Size 131KB
        • SHA256 9b72b42c3fa741025d760db945d47f948271c884e61e5cbfb94f1c99b0446636
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_hashlib.pyd
        • Size 65KB
        • SHA256 dfacbb48ade3d53780ff1e6875da90930a4a5d593e21984779079bd6f98f3768
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_lzma.pyd
        • Size 156KB
        • SHA256 ed997ca4956fe7e27cc702adaa8d31136312361d285b7b845c8829d8c5a89ae8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_queue.pyd
        • Size 32KB
        • SHA256 eb4070d87384565985a59a7139e0903b120044059cb0934a9a425c360e93a34c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_socket.pyd
        • Size 83KB
        • SHA256 961dc7c65a28c174688e2f6b7803a615b9c034849a17cfc6527a27ccb2eeadb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_ssl.pyd
        • Size 174KB
        • SHA256 78728b5e06037e3adfe922b59bb1dd19dea391e9ca02e21caab3cdc832111036
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\_wmi.pyd
        • Size 38KB
        • SHA256 4f6361517b4e127642d4e641ddbfa060b3d32da8ac7fc7a35a51c02680933084
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\base_library.zip
        • Size 1.3MB
        • SHA256 dfb745a0c17d072323b5a7edc2b758aa7f128a73d39f9bb6ef938523f23c8368
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        examples-1.json
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\botocore\data\amp\2020-08-01\examples-1.json
        • Size 44B
        • SHA256 2b76fa9a06248adbdc79c4a5253fa257f1100139af3b24aceba88a248e6ac748
        • MD5 SHA1 SHA512
        Submit Download

        paginators-1.json
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\botocore\data\apprunner\2020-05-15\paginators-1.json
        • Size 23B
        • SHA256 84843b01b2c1b18e1f3d234b54c834752e399ba72364a1538dba7764b878ce3f
        • MD5 SHA1 SHA512
        Submit Download

        waiters-2.json
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\botocore\data\backupsearch\2018-05-10\waiters-2.json
        • Size 39B
        • SHA256 7ec034fe6c02979ed414f8aac495162dbf4013b81df64a414f8c74ffa43b770c
        • MD5 SHA1 SHA512
        Submit Download

        endpoint-rule-set-1.json.gz
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\botocore\data\cloudfront\2015-07-27\endpoint-rule-set-1.json.gz
        • Size 1KB
        • SHA256 cd0af7abf14ab60d03011dfab227202918cc9c5e37a669432a32c7cb3e8e89c5
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        paginators-1.json
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\botocore\data\cloudfront\2015-07-27\paginators-1.json
        • Size 1KB
        • SHA256 23bbb88753057e506f1497a672b2c74a7eee3ab11e0c573b79c586ab00f1185f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        waiters-2.json
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\botocore\data\cloudfront\2015-07-27\waiters-2.json
        • Size 1KB
        • SHA256 8f3444a83c5f220d8a6e63d83a60e86200efcbc9960042b4c3f3661280aa8472
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        endpoint-rule-set-1.json.gz
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\botocore\data\cloudfront\2016-09-29\endpoint-rule-set-1.json.gz
        • Size 1KB
        • SHA256 a1d18d9d19840ff4c897486aa3eb94cfdeb305a84d01f446ea1155fb47f5707d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\pyexpat.pyd
        • Size 199KB
        • SHA256 6b4f77625a28693032ae629d8c4bc49a4d05a5362ff8c2d03eaa3dded554bcb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\python3.DLL
        • Size 68KB
        • SHA256 e6811bc64d0cc2a8525098b691db364679602c7456894c2f69e1837214a8a705
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\python312.dll
        • Size 6.6MB
        • SHA256 b6227a506a9963e7c8182785a54e14a193af51f7b277a61dda04492b499f49ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\select.pyd
        • Size 32KB
        • SHA256 e6bff4f35ab49a84f9e5ccd4b26eff30e1b2d7adb67d91911c4b84bfabcc28b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\shiboken6\MSVCP140.dll
        • Size 552KB
        • SHA256 117509b27d9f7d572a787633191cc45c6ee2968ca3548154ace2dc76cd415385
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Shiboken.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\shiboken6\Shiboken.pyd
        • Size 32KB
        • SHA256 e09e05fb2e8b12429e9fe265d661025df3cb2d20b805c1e4f17eb9c914e4e750
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\shiboken6\VCRUNTIME140_1.dll
        • Size 40KB
        • SHA256 cefef11efcb0177a1a86395eb10dd0b22190570dca25baea72a7c0d2febac727
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        shiboken6.abi3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI60362\shiboken6\shiboken6.abi3.dll
        • Size 361KB
        • SHA256 b31da63ac678a1e17aaf8b970620b1b3d04dbbc88c5f2c1334cb29d83617db56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1548-2016-0x00007FFCFDA90000-0x00007FFCFE0C6000-memory.dmp
        Download

        memory/1548-2019-0x00007FFD00830000-0x00007FFD00C31000-memory.dmp
        Download

        memory/1548-2012-0x00007FFCFE0D0000-0x00007FFCFE6D3000-memory.dmp
        Download

        memory/1548-2005-0x00007FFD01680000-0x00007FFD019F7000-memory.dmp
        Download

        memory/1548-2038-0x0000026E965D0000-0x0000026E965E0000-memory.dmp
        Download