Overview

overview

7

Static

static

3

2026-08-06...ar.exe

windows10-2004-x64

7

2026-08-06...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 20:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-06_a7e875e8799061243182101b2d85393e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 71.1MB
  • Sample260806-zhpsdaam2s
  • SHA256 cec49cd8102631bc954793cdb28a521f71a3280305814411d24eacbbece54ff5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 43 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_a7e875e8799061243182101b2d85393e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-06_a7e875e8799061243182101b2d85393e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4328
    • C:\Users\Admin\AppData\Local\Temp\2026-08-06_a7e875e8799061243182101b2d85393e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-06_a7e875e8799061243182101b2d85393e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4244
      • C:\Users\Admin\AppData\Local\Temp\_MEI43282\install.exe
        C:\Users\Admin\AppData\Local\Temp\_MEI43282\install.exe -pbeznogym
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3824
        • C:\ProgramData\Microsoft\compiler.exe
          "C:\ProgramData\Microsoft\compiler.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2312
          • C:\ProgramData\Microsoft\compiler.exe
            "C:\ProgramData\Microsoft\compiler.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2684
        • C:\ProgramData\Microsoft\smss.exe
          "C:\ProgramData\Microsoft\smss.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3452
          • C:\ProgramData\Microsoft\smss.exe
            "C:\ProgramData\Microsoft\smss.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2824
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "ver"
              6⤵
              • Executes a command shell one-liner
              PID:744
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3384

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          compiler.exe
          • Path C:\ProgramData\Microsoft\compiler.exe
          • Size 6.7MB
          • SHA256 80d645e255a6f33056f7ec59102a0d98a77dcc4108572f5a0b941c44a0c812dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23122\VCRUNTIME140_1.dll
          • Size 36KB
          • SHA256 34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23122\_socket.pyd
          • Size 77KB
          • SHA256 e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23122\_ssl.pyd
          • Size 156KB
          • SHA256 d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23122\base_library.zip
          • Size 1.0MB
          • SHA256 3a95761deefc61d7e6b98d9404cbd78cd8c189dfd9b6fffb3c0a5ef1e206843f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23122\libcrypto-1_1.dll
          • Size 3.3MB
          • SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23122\libssl-1_1.dll
          • Size 688KB
          • SHA256 d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pywintypes310.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23122\pywin32_system32\pywintypes310.dll
          • Size 131KB
          • SHA256 c8ec6429d243aef1f78969863be23d59273fa6303760a173ab36ab71d5676005
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23122\select.pyd
          • Size 29KB
          • SHA256 db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ucrtbase.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23122\ucrtbase.dll
          • Size 1.1MB
          • SHA256 048d4c5a51e45777ba15facdaddbf7702594a2268e8de1768ab0f5f4e4d7e733
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23122\unicodedata.pyd
          • Size 1.1MB
          • SHA256 1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32api.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23122\win32api.pyd
          • Size 136KB
          • SHA256 7ab0d714e44093649551623b93cc2aea4b30915adcb114bc1b75c548c3135b59
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32event.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI23122\win32event.pyd
          • Size 28KB
          • SHA256 257bc8bc6980f1825e020cfd2ffde693669e171b04def929bebdca7307cef13c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI34522\_bz2.pyd
          • Size 81KB
          • SHA256 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI34522\_ctypes.pyd
          • Size 120KB
          • SHA256 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI34522\_lzma.pyd
          • Size 154KB
          • SHA256 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI34522\base_library.zip
          • Size 1.0MB
          • SHA256 2a2a38d128c7e2bb539d3c811999863f820431becfcd6d88e921749a5b6f1e05
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-7.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI34522\libffi-7.dll
          • Size 32KB
          • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI34522\python3.DLL
          • Size 64KB
          • SHA256 dc909eb798a23ba8ee9f8e3f307d97755bc0d2dc0cb342cedae81fbbad32a8a9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI43282\VCRUNTIME140.dll
          • Size 95KB
          • SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI43282\base_library.zip
          • Size 1.0MB
          • SHA256 fe35d325cd876969004d40d42b4001cb0ea8ccab86231dc0fa8a1c70408a1eb9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python310.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI43282\python310.dll
          • Size 4.3MB
          • SHA256 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ucrtbase.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI43282\ucrtbase.dll
          • Size 1.3MB
          • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2824-1293-0x00000186B9780000-0x00000186B9894000-memory.dmp
          Download