d43bff29522e56c73cbeb4b8e7580556802b1f755f263b6dfc62ee06a5b760ec

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_57ef08b79149d17d58fae30107579d1e_amadey_cobalt-strike_glassworm_icedid_poet-rat_satacom.exe
Size 8.5MB
Sample260802-klez1syfqa
SHA256 d43bff29522e56c73cbeb4b8e7580556802b1f755f263b6dfc62ee06a5b760ec
MD5 57ef08b79149d17d58fae30107579d1e
SHA1 c6fdb885b91f60487040af030273ba9f4f318610
SHA512 e13005cb7267cdf078a318a1cbc2ec16e2c25ba0b682e0851ff852e7813e96ecbc3a19e9fc8a5947097196e4b3cb4410360331f9a056f382dbd59e35653ed400
SSDEEP 196608:ozAmx3PqB5o7QQLDebroj9HTlaFb53EjCetR0FMhqSXQsdQ1N:2x3Uo7QHetR0FMhqSXQsuz
TLSH
T10B969D147B840EF2E137D175CAA44233D7307885B6258D2B49D4EB490E3BEE14E6EA9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion trojan

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
396	2026-08-02_57ef08b79149d17d58fae30107579d1e_amadey_cobalt-strike_glassworm_icedid_poet-rat_satacom.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-02_57ef08b79149d17d58fae30107579d1e_amadey_cobalt-strike_glassworm_icedid_poet-rat_satacom.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	396	2026-08-02_57ef08b79149d17d58fae30107579d1e_amadey_cobalt-strike_glassworm_icedid_poet-rat_satacom.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_57ef08b79149d17d58fae30107579d1e_amadey_cobalt-strike_glassworm_icedid_poet-rat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_57ef08b79149d17d58fae30107579d1e_amadey_cobalt-strike_glassworm_icedid_poet-rat_satacom.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\81e74b2d-6bd7-81be-70b9-8fd60ec579e6\WebView2Loader.dll
Size 159KB
SHA256 12f7708910e1aac5cc9ac43603d122f1d2e770ae2651830a07ef8b3117f28c55
MD5 e08c7255be2fe5b2c0991b3161589181
SHA1 6bbfea42b7fbe29fbd830f09e754f027f69f2a50
SHA512 65b620065c0fcd6ed51066d18b40129b26c90d7908ffc6d579ae72204573ca49ca39ab0cf4d1205e85de35988f055cd4be3c9270159b8dc4907be366df49bf7d
SSDEEP 3072:VT3DhbXErY+deJmnFA5fYFvfBBY11U9yTT3nkFEtJYDUWycML:jUrNOWFCYFvfBuFncEtJNWM
TLSH
T15EF34B4773E500BBE177C27889674A46E776B8111B60AAEF03A443791F23BD0AE3D761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/396-3-0x000001A5A8990000-0x000001A5A89A0000-memory.dmp

Download