c146c61a100e5a2f18f93c69fe055f8d3253b3bd7aa300a5669639c08cd57695

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 07:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_aefa0c287108abcfe07033604b9278d6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 39.4MB
Sample260805-jkweyasbmd
SHA256 c146c61a100e5a2f18f93c69fe055f8d3253b3bd7aa300a5669639c08cd57695
MD5 aefa0c287108abcfe07033604b9278d6
SHA1 dc25bce783f6f163ee7c48c1fe89ed901b9fe89b
SHA512 75f0b49831f921ac824783830e3b4d0a6d809074249fc420aad60865d9bdd21890727825b3f518ce0f66443ea0df015fd0931a362640da636be50ee167f50ab1
SSDEEP 786432:kQ6n18tU6ayzBPhiiXM9TZpAyykMAblSUDTAyy9brK+sw+bJ2/8at5QxS6:kQE8tmSBZiiXM97lfcbi51SoS6
TLSH
T1AD97234BB29900EAC87AC03C8596954BF2723851037497EB37ED965A6F37BF11A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	2026-08-05_aefa0c287108abcfe07033604b9278d6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
640	2026-08-05_aefa0c287108abcfe07033604b9278d6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
640	2026-08-05_aefa0c287108abcfe07033604b9278d6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 640	1548	2026-08-05_aefa0c287108abcfe07033604b9278d6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-08-05_aefa0c287108abcfe07033604b9278d6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_aefa0c287108abcfe07033604b9278d6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\2026-08-05_aefa0c287108abcfe07033604b9278d6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-05_aefa0c287108abcfe07033604b9278d6_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe" /UAC
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads