Overview

overview

7

Static

static

3

2026-08-01...ar.exe

windows10-2004-x64

7

2026-08-01...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 00:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_a2e7c553582c5190130a737f5d263cd4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 15.0MB
  • Sample260802-aewdbaak4z
  • SHA256 777c5cd75648f8bd95514be1e534b26138a1f8235f993383e379fb41b641e177
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • Loads dropped DLL 23 IoCs
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_a2e7c553582c5190130a737f5d263cd4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_a2e7c553582c5190130a737f5d263cd4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3576
    • C:\Users\Admin\AppData\Local\Temp\2026-08-01_a2e7c553582c5190130a737f5d263cd4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-01_a2e7c553582c5190130a737f5d263cd4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3916
      • C:\Windows\SYSTEM32\tasklist.exe
        tasklist /FI "IMAGENAME eq 2026-08-01_a2e7c553582c5190130a737f5d263cd4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe" /FO CSV /NH
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:2900
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /PID 3576 /F
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1568

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\VCRUNTIME140.dll
        • Size 93KB
        • SHA256 92d50f7c4055718812cd3d823aa2821d6718eb55d2ab2bac55c2e47260c25a76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\_bz2.pyd
        • Size 84KB
        • SHA256 20895fa331712701ebfdbb9ab87e394309e910f1d782929fd65b59ed76d9c90f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\_ctypes.pyd
        • Size 124KB
        • SHA256 73acf2e0e28040cd696255abd53caaa811470b17a07c7b4d5a94f346b7474391
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\_hashlib.pyd
        • Size 64KB
        • SHA256 12a84bacb071b1948a9f751ac8d0653ba71a8f6b217a69fe062608e532065c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\_lzma.pyd
        • Size 159KB
        • SHA256 6384ded31408788d35a89dc3f7705ea2928f6bbdeb8b627f0d1b2d7b1ea13e16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\_queue.pyd
        • Size 28KB
        • SHA256 3bc50ac551635b9ce6fbcddea5d3d621c1216e49e9958fa24546ab8f6f2d111a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\_socket.pyd
        • Size 78KB
        • SHA256 258a5f0b4d362b2fed80b24eeabcb3cdd1602e32ff79d87225da6d15106b17a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\_ssl.pyd
        • Size 151KB
        • SHA256 e4aa33b312cec5aa5a0b064557576844879e0dccc40047c9d0a769a1d03f03f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\base_library.zip
        • Size 858KB
        • SHA256 e113502ecb8e0b8962cab091abd6d7a732065e7f266fa285cefcd503ac261307
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\cache\os.py
        • Size 6KB
        • SHA256 5e4d07989e53d4639bcc08ce9e6eb25092e7103a21b5f5cca7c7b8cc22787fb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sys.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\cache\sys.py
        • Size 6KB
        • SHA256 8787bee9f0ef0c9b4ffe92f7463297603ba57c1802ed7d107ac761718e12b965
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\libcrypto-1_1.dll
        • Size 3.2MB
        • SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\libssl-1_1.dll
        • Size 674KB
        • SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\psutil\_psutil_windows.pyd
        • Size 75KB
        • SHA256 d5685e38faccdf97ce6ffe4cf53cbfcf48bb20bf83abe316fba81d1abd093cb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __init__.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\pyarmor_runtime_000000\__init__.py
        • Size 101B
        • SHA256 25eeaf9e39e78384b5f7b7cbca615ac107f1dec2840767e9097294170df19567
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        pyarmor_runtime.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\pyarmor_runtime_000000\pyarmor_runtime.pyd
        • Size 605KB
        • SHA256 06b881bb56a47d7a2942387134fa5cff3258e126524976c69d7d0cbf3e024fc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\python3.dll
        • Size 58KB
        • SHA256 1dc81d8066d44480163233f249468039d3de97e91937965e7a369ae1499013da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\python39.dll
        • Size 4.3MB
        • SHA256 a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pythoncom39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\pywin32_system32\pythoncom39.dll
        • Size 543KB
        • SHA256 9b3d25eb5b8cd86dac4b6301df30c2a9b9815732e52b6d8e96bf58a6ad988a84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\pywin32_system32\pywintypes39.dll
        • Size 139KB
        • SHA256 4dcdc4f5e684d0c031122515b4f089e33dc0cc9869ef1ab65832ac90cf428906
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\select.pyd
        • Size 28KB
        • SHA256 c7ffae6dc927cf10ac5da08614912bb3ad8fc52aa0ef9bc376d831e72dd74460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\ucrtbase.dll
        • Size 964KB
        • SHA256 f714459e4ad2ba2d378af1e5b3b654add7aa9e88186ef31579d0f133d078335d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\unicodedata.pyd
        • Size 1.1MB
        • SHA256 7f02a99a23cc3ff63ecb10ba6006e2da7bf685530bad43882ebf90d042b9eeb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\win32api.pyd
        • Size 131KB
        • SHA256 2ab33cca6227c6a2d5d9cc5e694a678a292b3b26e299cb94343a466900d7014c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32crypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI35762\win32crypt.pyd
        • Size 124KB
        • SHA256 f8eddf3ca7024622cc4de54aa24f6eb2befddc6c93a7ca9a7dea9ea8d636de6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3916-140-0x0000000061B00000-0x0000000061BA5000-memory.dmp
        Download