24e69a12db557341a0d1acdd6781f5dc34bff3a01bcdac199681b82fa4b02706

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Size 876KB
Sample260801-ftzbeaeb84
SHA256 24e69a12db557341a0d1acdd6781f5dc34bff3a01bcdac199681b82fa4b02706
MD5 653ed6fe8b394725d1d3bb74d7394403
SHA1 93fc89cb569d1352a9d973641c22200c217d181c
SHA512 ac53ac28747d7a4655e02b254e271ad60daa5251a6ddf89e6da94e155b322588074713bee49a78eeac95c79e4647f8beee996c5ab15045d3e7605ee930336d8c
SSDEEP 24576:NTIBlzd/bWlVQJL1AXZDRG5+WT+O93l0fZ:NUx0VQxQEg8+O93+x
TLSH
T1E8159E57A7A410F9D167C079C5438613EBB3B86513209BDB03A09A7A1F33AD56F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3420	sc.exe
1952	sc.exe
1320	sc.exe
4376	sc.exe

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3156	cmd.exe
4340	cmd.exe
2348	cmd.exe
1860	cmd.exe
2004	cmd.exe
3188	cmd.exe
4496	cmd.exe
1516	cmd.exe
5008	cmd.exe
4588	cmd.exe
3404	cmd.exe
4832	cmd.exe
4280	cmd.exe
1880	cmd.exe
3884	cmd.exe
4976	cmd.exe
2636	cmd.exe
4224	cmd.exe
1956	cmd.exe
1360	cmd.exe
2676	cmd.exe
4756	cmd.exe
1560	cmd.exe
4200	cmd.exe
2808	cmd.exe
4524	cmd.exe

Kills process with taskkill 16 IoCs

defense_evasion

pid	Process
2196	taskkill.exe
2684	taskkill.exe
4988	taskkill.exe
3740	taskkill.exe
2628	taskkill.exe
4264	taskkill.exe
4828	taskkill.exe
3048	taskkill.exe
2688	taskkill.exe
4592	taskkill.exe
4984	taskkill.exe
4188	taskkill.exe
1936	taskkill.exe
4868	taskkill.exe
1148	taskkill.exe
4864	taskkill.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	taskkill.exe
Token: SeDebugPrivilege	2196	taskkill.exe
Token: SeDebugPrivilege	2684	taskkill.exe
Token: SeDebugPrivilege	4188	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	4988	taskkill.exe
Token: SeDebugPrivilege	3740	taskkill.exe
Token: SeDebugPrivilege	4864	taskkill.exe
Token: SeDebugPrivilege	2628	taskkill.exe
Token: SeDebugPrivilege	4264	taskkill.exe
Token: SeDebugPrivilege	4592	taskkill.exe
Token: SeDebugPrivilege	1936	taskkill.exe
Token: SeDebugPrivilege	2688	taskkill.exe
Token: SeDebugPrivilege	4868	taskkill.exe
Token: SeDebugPrivilege	1148	taskkill.exe
Token: SeDebugPrivilege	4984	taskkill.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 4976	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	86
PID 4596 wrote to memory of 4756	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	87
PID 4596 wrote to memory of 2676	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	88
PID 4596 wrote to memory of 3156	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	89
PID 4596 wrote to memory of 1516	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	90
PID 4596 wrote to memory of 2636	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	91
PID 4596 wrote to memory of 5008	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	92
PID 4596 wrote to memory of 4588	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	93
PID 2676 wrote to memory of 4828	2676	cmd.exe	94
PID 1516 wrote to memory of 4376	1516	cmd.exe	95
PID 2636 wrote to memory of 2196	2636	cmd.exe	96
PID 4756 wrote to memory of 2684	4756	cmd.exe	97
PID 4588 wrote to memory of 4476	4588	cmd.exe	98
PID 3156 wrote to memory of 4188	3156	cmd.exe	99
PID 4596 wrote to memory of 4832	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	101
PID 4596 wrote to memory of 1860	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	102
PID 4596 wrote to memory of 2348	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	103
PID 4596 wrote to memory of 1560	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	104
PID 4596 wrote to memory of 3404	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	105
PID 4596 wrote to memory of 4340	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	106
PID 4832 wrote to memory of 3048	4832	cmd.exe	107
PID 1860 wrote to memory of 4988	1860	cmd.exe	108
PID 3404 wrote to memory of 3740	3404	cmd.exe	109
PID 2348 wrote to memory of 4864	2348	cmd.exe	110
PID 1560 wrote to memory of 3420	1560	cmd.exe	111
PID 4596 wrote to memory of 4200	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	112
PID 4596 wrote to memory of 4224	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	113
PID 4596 wrote to memory of 4280	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	114
PID 4596 wrote to memory of 2004	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	115
PID 4596 wrote to memory of 1956	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	116
PID 4596 wrote to memory of 1880	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	117
PID 4596 wrote to memory of 3188	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	118
PID 4596 wrote to memory of 2808	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	119
PID 4596 wrote to memory of 4524	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	120
PID 4596 wrote to memory of 4496	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	121
PID 4596 wrote to memory of 3884	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	122
PID 4596 wrote to memory of 1360	4596	2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	123
PID 2004 wrote to memory of 1952	2004	cmd.exe	124
PID 3884 wrote to memory of 2628	3884	cmd.exe	125
PID 4224 wrote to memory of 4264	4224	cmd.exe	126
PID 4200 wrote to memory of 1936	4200	cmd.exe	127
PID 1956 wrote to memory of 4592	1956	cmd.exe	128
PID 2808 wrote to memory of 2688	2808	cmd.exe	129
PID 3188 wrote to memory of 1148	3188	cmd.exe	130
PID 4524 wrote to memory of 4868	4524	cmd.exe	131
PID 4496 wrote to memory of 1320	4496	cmd.exe	132
PID 4280 wrote to memory of 4984	4280	cmd.exe	133

C:\Users\Admin\AppData\Local\Temp\2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4976
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4828
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4188
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4376
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2196
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe" MD5
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\2026-08-01_653ed6fe8b394725d1d3bb74d7394403_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe" MD5
    3⤵
    PID:4476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4864
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:3420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3740
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4264
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:1952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1956
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1880
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1148
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4524
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:1320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2628
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1360