Analysis
- max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 23:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 1.1MB
- Sample260808-3dblqswdqa
- SHA256 aeb937a519457e4f1eee95165ee1c33bacb60d1d236b188b5850d432cb15db90
- MD5 8af98a6621d0b4f49e8bf0e6c138e6a5
- SHA1 a33adef6dcd64a6f6c610e3502b30668305e3f04
- SHA512 5189ddeafe5f690d5beaccf66af26de6bb10003c3e0eb100db546445f0ae5f9dc738510606ce679be833c4788c910005cf0b993dcade5323c92ee423b8dbbc1c
- SSDEEP 12288:2rq3gCucGs9QxhjaIuEtGKeCbPz1f2X7sXgYbuMeSK7LoyNS:scGhjaId0KeCb9YanTK7LoyN
- TLSH T1F0358E0255FB85B9CC67B03D5BA7800DB231A8035A05EFE5BE9C83288F5B47859F7B85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Steam\steamapps\common\Animal Company\steam_appid.txt 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 556 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:556
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\SonaceLoader\loader_20260809_002328.log
- Size 316B
- SHA256 dfc0dd24a8ad9bb9bc5af5204867a55d020eb9f246fbb78f9d0940f78c0ad545
- MD5 2a298f5a59258c8e0d314209e4b4fe42
- SHA1 4e97f1afa9fa723aa84c74d9f1ae1846fe65ec14
- SHA512 dba9f19eb91ac76cb123ce5ce26a9aa36f96ad35fcf8b3286d186f6d0f9a0dc542f00cbe90419ea4ecf88e610998888568dd8ac1442da993e4f2ea896b60a099
- TLSH T1A9E0EC931EB3F69429E68D83167C7A822448800A4604C4DE72DEC318A2882DFBD7ED30
- MD5 SHA1 SHA512 TLSH