Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 23:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 1.1MB
- Sample260808-3dblqswdqa
- SHA256 aeb937a519457e4f1eee95165ee1c33bacb60d1d236b188b5850d432cb15db90
- MD5 8af98a6621d0b4f49e8bf0e6c138e6a5
- SHA1 a33adef6dcd64a6f6c610e3502b30668305e3f04
- SHA512 5189ddeafe5f690d5beaccf66af26de6bb10003c3e0eb100db546445f0ae5f9dc738510606ce679be833c4788c910005cf0b993dcade5323c92ee423b8dbbc1c
- SSDEEP 12288:2rq3gCucGs9QxhjaIuEtGKeCbPz1f2X7sXgYbuMeSK7LoyNS:scGhjaId0KeCb9YanTK7LoyN
- TLSH T1F0358E0255FB85B9CC67B03D5BA7800DB231A8035A05EFE5BE9C83288F5B47859F7B85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Steam\steamapps\common\Animal Company\steam_appid.txt 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe 5804 2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_8af98a6621d0b4f49e8bf0e6c138e6a5_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:5804
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\SonaceLoader\loader_20260809_002329.log
- Size 316B
- SHA256 b4f588fcfa8d21a2b95fd3aa1a3fa7b55afd02aebe139aeea9137bf68ce6583c
- MD5 58d8a7c381fc96a2d0570b0f1b53ca6f
- SHA1 42a79fc27945720662c18283c2d766bc1972edc5
- SHA512 c68e3328a1356941edfe448438391143b9bacce9cdc45b9cf203e5f8f64b8b5f3296dd4c042dfaa4f07c1bc4e8ca152b682044484159829e6f049758d50cb603
- TLSH T1BEE0E61B1AB3761C25E64D83167C7A82164848394504C4DF72DEC314A2442DFBF76D30
- MD5 SHA1 SHA512 TLSH