815e627ba876931914d347df7eadc517f24612f5b4009f4e398c823b79f4cabb

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Size 1.4MB
Sample260802-etscesch55
SHA256 815e627ba876931914d347df7eadc517f24612f5b4009f4e398c823b79f4cabb
MD5 4bcdc504b42854fdca5011d4655ad24b
SHA1 d9ffe54bc9242185181861b2019f81bb9385b137
SHA512 fa5acf0e84e83ea52de2b71452c2842738eb7c541d0820d76bd579b446f5af8b91bb590ab53aee2cdbc6dd4024c33212b006d2c54cbfda4dbfaede9565faaef6
SSDEEP 24576:b65aAFyVNX9dDEcWd4FneIq9Ba+lW6KnyetsiZngiGA+O93l0fZm:b6FFgFLXFkQbR1tJZngi7+O93+xm
TLSH
T18B65AE4773B551F9D0ABC078C642960BEBB2785513209AEF13E09A682F736E12F7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1988	sc.exe
4996	sc.exe

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3816	cmd.exe
1584	cmd.exe
2188	cmd.exe
3224	cmd.exe
4804	cmd.exe
1100	cmd.exe
4992	cmd.exe
3416	cmd.exe
2564	cmd.exe
1084	cmd.exe
2308	cmd.exe
416	cmd.exe
4436	cmd.exe

Kills process with taskkill 8 IoCs

defense_evasion

pid	Process
1484	taskkill.exe
604	taskkill.exe
1672	taskkill.exe
1108	taskkill.exe
4484	taskkill.exe
3836	taskkill.exe
1832	taskkill.exe
3552	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3820	2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
3820	2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	taskkill.exe
Token: SeDebugPrivilege	3552	taskkill.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeDebugPrivilege	604	taskkill.exe
Token: SeDebugPrivilege	1672	taskkill.exe
Token: SeDebugPrivilege	1108	taskkill.exe
Token: SeDebugPrivilege	4484	taskkill.exe
Token: SeDebugPrivilege	3836	taskkill.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 3224	3820	2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	86
PID 3820 wrote to memory of 3816	3820	2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	88
PID 3820 wrote to memory of 4436	3820	2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	89
PID 3820 wrote to memory of 416	3820	2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	90
PID 3820 wrote to memory of 2308	3820	2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	91
PID 3820 wrote to memory of 1084	3820	2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	92
PID 3820 wrote to memory of 2564	3820	2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	93
PID 2564 wrote to memory of 2432	2564	cmd.exe	103
PID 3816 wrote to memory of 1832	3816	cmd.exe	104
PID 416 wrote to memory of 1988	416	cmd.exe	105
PID 4436 wrote to memory of 3552	4436	cmd.exe	106
PID 2308 wrote to memory of 1484	2308	cmd.exe	107
PID 3224 wrote to memory of 604	3224	cmd.exe	108
PID 3820 wrote to memory of 3416	3820	2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	109
PID 3820 wrote to memory of 4992	3820	2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	110
PID 3820 wrote to memory of 1100	3820	2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	111
PID 3820 wrote to memory of 2188	3820	2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	112
PID 3820 wrote to memory of 4804	3820	2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	113
PID 3820 wrote to memory of 1584	3820	2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe	114
PID 4804 wrote to memory of 1672	4804	cmd.exe	122
PID 4992 wrote to memory of 1108	4992	cmd.exe	123
PID 2188 wrote to memory of 4996	2188	cmd.exe	124
PID 1100 wrote to memory of 4484	1100	cmd.exe	125
PID 3416 wrote to memory of 3836	3416	cmd.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:604
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1832
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:416
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:1988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe" MD5
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\2026-08-01_4bcdc504b42854fdca5011d4655ad24b_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe" MD5
    3⤵
    PID:2432
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\system32\taskkill.exe
    taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\system32\sc.exe
    sc stop HTTPDebuggerPro
    3⤵
    - Launches sc.exe
    PID:4996
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /IM HTTPDebuggerSvc.exe /F >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\system32\taskkill.exe
    taskkill /IM HTTPDebuggerSvc.exe /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c @RD /S /Q "C:\Users\%username%\AppData\Local\Microsoft\Windows\INetCache\IE" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1584