Analysis
- max time kernel
69s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 00:47
General
- Target 2026-08-07_b1ab588dbdac31cb9c4ba589d478e558_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar.exe
- Size 16.6MB
- Sample260808-a5p9zseq3w
- SHA256 ac05ff0d5b8452241bcaead9bd075679e91401c3b2cbda6397f8a496143bfef0
Malware Config
Signatures
- Detects executables manipulated with Fody 2 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_b1ab588dbdac31cb9c4ba589d478e558_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_b1ab588dbdac31cb9c4ba589d478e558_cobalt-strike_glassworm_icedid_luca-stealer_njrat_remcos_satacom_stealc_vidar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\evilcheats\launcher\bin\Login_x64.exe300006 24020 "C:\Users\Admin\AppData\Local\Temp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
API_x64.dll
Login_x64.exe
memory/4616-21-0x00007FFF3CD70000-0x00007FFF3D143000-memory.dmp
memory/4616-24-0x0000014D24F00000-0x0000014D24F01000-memory.dmp
memory/4616-8-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-9-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-10-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-11-0x0000014D07BE0000-0x0000014D07BE1000-memory.dmp
memory/4616-12-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-13-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-23-0x0000014D23AC0000-0x0000014D23ACE000-memory.dmp
memory/4616-15-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-7-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-17-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-19-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-20-0x00007FFF66630000-0x00007FFF66632000-memory.dmp
memory/4616-6-0x0000014D05330000-0x0000014D05FEC000-memory.dmp
memory/4616-5-0x00007FFF4335F000-0x00007FFF43360000-memory.dmp
memory/4616-14-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-22-0x0000014D23AF0000-0x0000014D23B2E000-memory.dmp
memory/4616-25-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-26-0x0000014D261E0000-0x0000014D26294000-memory.dmp
memory/4616-27-0x0000014D250A0000-0x0000014D250C2000-memory.dmp
memory/4616-28-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-29-0x0000014D24DB0000-0x0000014D24DBE000-memory.dmp
memory/4616-31-0x0000014D24E30000-0x0000014D24E38000-memory.dmp
memory/4616-32-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-33-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-34-0x0000014D21200000-0x0000014D213A6000-memory.dmp
memory/4616-35-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-36-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-37-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-38-0x00007FFF431D0000-0x00007FFF43B74000-memory.dmp
memory/4616-40-0x0000014D24F00000-0x0000014D24F01000-memory.dmp