e960078242229173798816537350746552098e57ddb3a2adee1154ba07b14285

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_86ffd4058b1efd986aedfe144be4067e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.7MB
Sample260806-btlyvsfb43
SHA256 e960078242229173798816537350746552098e57ddb3a2adee1154ba07b14285
MD5 86ffd4058b1efd986aedfe144be4067e
SHA1 72091f4debb0a4cc589dda91daa493de690bca61
SHA512 860726df97abb427a75aa23d63e5f8034d4a275a1a4208b1178572f194dc4600f4f3a1ad349ec9ff8567da437aa6d6d88d423cd20399eb5820cb6d445236283c
SSDEEP 24576:CZUJFwHe13MZwt30GiC2iwMVHtpkZkctz2gazVfFCxBjk2kGi05aHSDwRodIodD:BUHu3gwB7ii5ctSgWqoaaHSDw4
TLSH
T18D859E17E6A510F9D4BBC13CCA425526FA71B8520770ABDF13905A662F23BE0AF3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3372	puttygen.exe
2612	IntelHidEventSvc.exe
3004	puttygen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 3372	4932	2026-08-06_86ffd4058b1efd986aedfe144be4067e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 3372 wrote to memory of 2612	3372	puttygen.exe	90
PID 3372 wrote to memory of 3004	3372	puttygen.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-06_86ffd4058b1efd986aedfe144be4067e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_86ffd4058b1efd986aedfe144be4067e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\042\puttygen.exe
  "C:\Users\Admin\AppData\Local\Temp\042\puttygen.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Users\Admin\AppData\Local\Temp\puttygen\IntelHidEventSvc.exe
    "C:\Users\Admin\AppData\Local\Temp\puttygen\IntelHidEventSvc.exe"
    3⤵
    - Executes dropped EXE
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\puttygen\puttygen.exe
    "C:\Users\Admin\AppData\Local\Temp\puttygen\puttygen.exe"
    3⤵
    - Executes dropped EXE
    PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

puttygen.exe

Path C:\Users\Admin\AppData\Local\Temp\042\puttygen.exe
Size 1.4MB
SHA256 58f8146048abd9114ce112f0fdb5eb8fd56dba9ea2433cf4e529d2cf6dd46335
MD5 792e130a4cfeab4ec6cbaeb873a17a87
SHA1 16b1cd6ed898392fac929d09ee1c0a145d0df4fd
SHA512 81159c7e7fbc8f4cd7c0277e570d52b099f9980b94886a49a5c6223300ad957b536694470ad62a50441660b9f85e164d4bf37a7a165e864321f801af784e8585
SSDEEP 24576:FFwHe13MZwt30GiC2iwMVHtpkZkctz2gazVfFCxBjk2kGi05aHSDwRodIod7:IHu3gwB7ii5ctSgWqoaaHSDwg
TLSH
T15A65AF17E69210FDD07BC138CA525522FA71B8560770ABDF13A05A662F27BE0AF3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup_main.log

Path C:\Users\Admin\AppData\Local\Temp\Setup_main.log
Size 1KB
SHA256 f9d4113bdcd8b29561ab64e8bb2f48f956bbe7ad2489f406d1b3323f3f637964
MD5 40ec0fdf300d2255ad7d0abe42399072
SHA1 7ef4b218115248c470bff7ee8a8d0b9d14a76d30
SHA512 75fc6a327dd6bdd81c96dc946a8c01b9e2b4a5525079c401751eb5b2feb6afc7017e9aa2ad922a51fda9929154322113ed9e17d9664e17b9c7577a9acd9080fc
TLSH
T13B1103C44AABD7B64C89300B0FA489894BEF98FE5A112A543F31447477D0F17DEAEA50
MD5 SHA1 SHA512 TLSH

Submit Download

Setup_main.log

Path C:\Users\Admin\AppData\Local\Temp\Setup_main.log
Size 1KB
SHA256 b7fa95abae6496a85f306bde65f17c8154cfcca2d0eec30dcb5bbe2762a1591f
MD5 593ab780a5791dc3063bfab0ba4617b7
SHA1 66251b5f58fe388729c61e50e86492e8f5fe0586
SHA512 ca78f5de389769778f1a08d433d88b7ed983a49cfc6ccaaea27ba4d05974c06203658c4bbbea9b655ee739051547e6b947978ecdcab4fc48530a877f1fec2ad4
TLSH
T1CE315AC80AAFD6764C8D31070F948DC94BEBC8F919152A557F3240B4B6C1F4BDEAEA40
MD5 SHA1 SHA512 TLSH

Submit Download

IntelHidEventSvc.exe

Path C:\Users\Admin\AppData\Local\Temp\puttygen\IntelHidEventSvc.exe
Size 118KB
SHA256 d11803e105cc9d62e9f0dd25f572454ca203c3fb1de819d7d17ad6a6b6ad45df
MD5 e144a1dc31a89ee1acf50f119975ed93
SHA1 f15a02ea2cc1a1bcdb063903d62411291441d5de
SHA512 f8fb7ec32eec637567957151210abc4c0ce64d8b1dd53a73ef830b302df0ce459a744b41df216b9613f0e4b2977cf7a70c1e2815eb1a8fa9b9dd390aa52e320d
SSDEEP 3072:wIA3lTeSVyttsmnIXNjAsxxcNqTA2xDJKOxGIquxGUhJXewTz:+lLVyttQZGqTA2xDkO9CUbuqz
TLSH
T131C37C0274921A9DC822C0B88A477922D73A7E54173047F70BE57A593E747F2AEBF319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

puttygen.exe

Path C:\Users\Admin\AppData\Local\Temp\puttygen\puttygen.exe
Size 985KB
SHA256 3156e261ff5ed59ee517d016988109358477898a9fa0043739462236dace6e4a
MD5 4444bc2dc02993ca7b81379de4fd2e97
SHA1 7bea9b61aec4b68f29f8c84feae327222dc8ebb0
SHA512 62d26e9423d1584564372a2d72466c71e92e0c6931fb6ca7e7b2a6a063da8d0cd88ff1510bcda45f116e55483790792e1da4d6fd9af9338b0345a0c567351b57
SSDEEP 24576:HiC2iwMVHtpkZkctz2gazVfFCxBjk2kGi05aHSDwRodIodM:Hii5ctSgWqoaaHSDwb
TLSH
T1AC25BF17E35610EDD06AC1788B969532FB72F8560771AAEF03A096362F27BD05F39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads