Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 02:38
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-01_cafadcd881607a97b8fe9584e6d1b1ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_cafadcd881607a97b8fe9584e6d1b1ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target 2026-08-01_cafadcd881607a97b8fe9584e6d1b1ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 1.2MB
- Sample260801-c46axswbqa
- SHA256 e5283dad1e55376d34c34a2bd7bbfa8cfd862361a8adcc8b47a46239682f8e94
- MD5 cafadcd881607a97b8fe9584e6d1b1ed
- SHA1 31bba1199da58c6fb00140955dd3bb1760971123
- SHA512 a5a8dd12746240eaa6650e32fb651dba8555d59c47a05e5a45f4cd05d9c81c5536f87a1cb41c44d942d40695d6c2396642fc4461ecd4be913c85d0e916790dc1
- SSDEEP 24576:0dEwFnj0LXN1Z2pQA+86O0bRSEVz0nhp:0df0L4pQvtVYnr
- TLSH T15A45AE02729400F8D0F36274D923960FE739B897833096EF37AD49692F673D15ABAB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-08-01_cafadcd881607a97b8fe9584e6d1b1ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2456 2026-08-01_cafadcd881607a97b8fe9584e6d1b1ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 2456 2026-08-01_cafadcd881607a97b8fe9584e6d1b1ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 2456 2026-08-01_cafadcd881607a97b8fe9584e6d1b1ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 2456 2026-08-01_cafadcd881607a97b8fe9584e6d1b1ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2456 2026-08-01_cafadcd881607a97b8fe9584e6d1b1ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2456 2026-08-01_cafadcd881607a97b8fe9584e6d1b1ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_cafadcd881607a97b8fe9584e6d1b1ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_cafadcd881607a97b8fe9584e6d1b1ed_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2456