Overview

overview

7

Static

static

3

2026-08-04...ar.exe

windows10-2004-x64

7

2026-08-04...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 13:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_ed7be84732e92e2380034b1ecc910600_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 14.2MB
  • Sample260804-qv486ax1ds
  • SHA256 725e4f4fa41c764c08e365371ff0ee7c908bf2e220bf6700fa731b3b8eeace22
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscovery

Malware Config

Signatures

  • Loads dropped DLL 22 IoCs
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_ed7be84732e92e2380034b1ecc910600_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_ed7be84732e92e2380034b1ecc910600_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4812
    • C:\Users\Admin\AppData\Local\Temp\2026-08-04_ed7be84732e92e2380034b1ecc910600_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-04_ed7be84732e92e2380034b1ecc910600_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2272
      • C:\Windows\SYSTEM32\tasklist.exe
        tasklist /FI "IMAGENAME eq 2026-08-04_ed7be84732e92e2380034b1ecc910600_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe" /FO CSV /NH
        3⤵
        • Discovers running processes
        • Suspicious use of AdjustPrivilegeToken
        PID:3596
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /PID 4812 /F
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2216

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\VCRUNTIME140.dll
        • Size 93KB
        • SHA256 92d50f7c4055718812cd3d823aa2821d6718eb55d2ab2bac55c2e47260c25a76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\_bz2.pyd
        • Size 84KB
        • SHA256 20895fa331712701ebfdbb9ab87e394309e910f1d782929fd65b59ed76d9c90f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\_ctypes.pyd
        • Size 124KB
        • SHA256 73acf2e0e28040cd696255abd53caaa811470b17a07c7b4d5a94f346b7474391
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\_hashlib.pyd
        • Size 64KB
        • SHA256 12a84bacb071b1948a9f751ac8d0653ba71a8f6b217a69fe062608e532065c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\_lzma.pyd
        • Size 159KB
        • SHA256 6384ded31408788d35a89dc3f7705ea2928f6bbdeb8b627f0d1b2d7b1ea13e16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\_queue.pyd
        • Size 28KB
        • SHA256 3bc50ac551635b9ce6fbcddea5d3d621c1216e49e9958fa24546ab8f6f2d111a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\_socket.pyd
        • Size 78KB
        • SHA256 258a5f0b4d362b2fed80b24eeabcb3cdd1602e32ff79d87225da6d15106b17a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\_ssl.pyd
        • Size 151KB
        • SHA256 e4aa33b312cec5aa5a0b064557576844879e0dccc40047c9d0a769a1d03f03f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\base_library.zip
        • Size 858KB
        • SHA256 8968ceaf8316d2285cfe9c0139a16b5437abb425a1a34c75acadd70353e60809
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\cache\os.py
        • Size 6KB
        • SHA256 619b2078f6d19bbbb9dfe44eea4f60ef62ad7da872c6c468359026a14108c372
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sys.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\cache\sys.py
        • Size 6KB
        • SHA256 95065c8d83fc43b6c766e8a08e83a22514140442b3f87db8842e436b3f2aa309
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\libcrypto-1_1.dll
        • Size 3.2MB
        • SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\libssl-1_1.dll
        • Size 674KB
        • SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\psutil\_psutil_windows.pyd
        • Size 75KB
        • SHA256 d5685e38faccdf97ce6ffe4cf53cbfcf48bb20bf83abe316fba81d1abd093cb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __init__.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\pyarmor_runtime_000000\__init__.py
        • Size 101B
        • SHA256 32debbe3447ad98dfdfd23167f9a068eb2f5c3ddaed2cbcb301494f390c9bc03
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        pyarmor_runtime.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\pyarmor_runtime_000000\pyarmor_runtime.pyd
        • Size 605KB
        • SHA256 398e4af37cfe91ab050b2399054e166d4050418a9209a05e00c013509ed3760c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\python3.DLL
        • Size 58KB
        • SHA256 1dc81d8066d44480163233f249468039d3de97e91937965e7a369ae1499013da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\python39.dll
        • Size 4.3MB
        • SHA256 a56afcf5f3a72769c77c3bc43c9b84197180a8b3380b6258073223bfd72ed47a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pythoncom39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\pywin32_system32\pythoncom39.dll
        • Size 543KB
        • SHA256 9b3d25eb5b8cd86dac4b6301df30c2a9b9815732e52b6d8e96bf58a6ad988a84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\pywin32_system32\pywintypes39.dll
        • Size 139KB
        • SHA256 4dcdc4f5e684d0c031122515b4f089e33dc0cc9869ef1ab65832ac90cf428906
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\select.pyd
        • Size 28KB
        • SHA256 c7ffae6dc927cf10ac5da08614912bb3ad8fc52aa0ef9bc376d831e72dd74460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\unicodedata.pyd
        • Size 1.1MB
        • SHA256 7f02a99a23cc3ff63ecb10ba6006e2da7bf685530bad43882ebf90d042b9eeb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\win32api.pyd
        • Size 131KB
        • SHA256 2ab33cca6227c6a2d5d9cc5e694a678a292b3b26e299cb94343a466900d7014c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32crypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI48122\win32crypt.pyd
        • Size 124KB
        • SHA256 f8eddf3ca7024622cc4de54aa24f6eb2befddc6c93a7ca9a7dea9ea8d636de6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2272-98-0x0000000061B00000-0x0000000061BA5000-memory.dmp
        Download