Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 00:47
General
- Target 2026-08-07_b1ab588dbdac31cb9c4ba589d478e558_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar.exe
- Size 16.6MB
- Sample260808-a5p9zseq3w
- SHA256 ac05ff0d5b8452241bcaead9bd075679e91401c3b2cbda6397f8a496143bfef0
Malware Config
Signatures
- Detects executables manipulated with Fody 2 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_b1ab588dbdac31cb9c4ba589d478e558_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_b1ab588dbdac31cb9c4ba589d478e558_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\evilcheats\launcher\bin\Login_x64.exe300006 24020 "C:\Users\Admin\AppData\Local\Temp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
API_x64.dll
Login_x64.exe
memory/2156-15-0x000002A437150000-0x000002A437188000-memory.dmp
memory/2156-18-0x000002A438B70000-0x000002A438C24000-memory.dmp
memory/2156-6-0x000002A41A9A0000-0x000002A41A9B0000-memory.dmp
memory/2156-11-0x00007FFA7F0B0000-0x00007FFA7F0B2000-memory.dmp
memory/2156-12-0x00007FFA5C190000-0x00007FFA5C563000-memory.dmp
memory/2156-13-0x000002A41A9A0000-0x000002A41A9B0000-memory.dmp
memory/2156-14-0x000002A41A9A0000-0x000002A41A9B0000-memory.dmp
memory/2156-16-0x000002A437120000-0x000002A43712E000-memory.dmp
memory/2156-5-0x000002A418100000-0x000002A418DBC000-memory.dmp
memory/2156-7-0x000002A419140000-0x000002A419141000-memory.dmp
memory/2156-19-0x000002A438CC0000-0x000002A438CE2000-memory.dmp
memory/2156-20-0x000002A41A9A0000-0x000002A41A9B0000-memory.dmp
memory/2156-21-0x000002A4394F0000-0x000002A4395F2000-memory.dmp
memory/2156-22-0x000002A41A9A0000-0x000002A41A9B0000-memory.dmp
memory/2156-23-0x000002A41A9A0000-0x000002A41A9B0000-memory.dmp
memory/2156-24-0x000002A438C30000-0x000002A438C3E000-memory.dmp
memory/2156-26-0x000002A438CA0000-0x000002A438CA8000-memory.dmp
memory/2156-29-0x000002A438A90000-0x000002A438A91000-memory.dmp