afaf4062a5b6fc3c009e7a4451e9caafe94e5c4dc9d4bea925ae8cf7ab381385

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 20:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_cdefd3c95b9d026db68c1463c7639d64_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Size 6.9MB
Sample260808-zg22bavanf
SHA256 afaf4062a5b6fc3c009e7a4451e9caafe94e5c4dc9d4bea925ae8cf7ab381385
MD5 cdefd3c95b9d026db68c1463c7639d64
SHA1 a920691e36df00212fb420b5bb45ad5f417db7c9
SHA512 193a5b16510fe4c647f948204d1dc3c8cd8019ef325b71b52e2e671c7a1f48caeddc71bff1bd38ccd6e0abb757ffb429d6a32f29dc4a80b1116aa17fd1f20f64
SSDEEP 196608:t07YzA1HeT39IigjvKub75bcjWgbkzfPSkjU38p:61+TtIiavB5IjWqkzf
TLSH
T14076335833FA5CE9D9F3423996C1C88BEE71A4981772CB8B43B441E25F372A15F79260
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2816	2026-08-08_cdefd3c95b9d026db68c1463c7639d64_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
2816	2026-08-08_cdefd3c95b9d026db68c1463c7639d64_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
864	cmd.exe
4272	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 2816	4420	2026-08-08_cdefd3c95b9d026db68c1463c7639d64_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	90
PID 2816 wrote to memory of 4272	2816	2026-08-08_cdefd3c95b9d026db68c1463c7639d64_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	91
PID 2816 wrote to memory of 864	2816	2026-08-08_cdefd3c95b9d026db68c1463c7639d64_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-08-08_cdefd3c95b9d026db68c1463c7639d64_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_cdefd3c95b9d026db68c1463c7639d64_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Users\Admin\AppData\Local\Temp\2026-08-08_cdefd3c95b9d026db68c1463c7639d64_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-08_cdefd3c95b9d026db68c1463c7639d64_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c npm upgrade
    3⤵
    - Executes a command shell one-liner
    PID:4272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c npm start
    3⤵
    - Executes a command shell one-liner
    PID:864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\base_library.zip
Size 1.3MB
SHA256 9f15fed288e8437df3c0b13c7ca382a29eb7310f6fc9b49435c737f34ac182d4
MD5 db4a3e83828ab1d62ac24e8505274541
SHA1 47679655a3be0ff97f14daa1a30a1ce09944a6d4
SHA512 97dec2a90fc63ff3d45c3b6827c185a432930ab1c48bcd2ccc61c69dec7b539d26179d345fa5b032df6967ffa3c9563ef8d27467ca40eb56bc51ce2e0105e147
SSDEEP 12288:uttcY+bStOmgRF1+fYNXPh26UZWAzau7joqYnhjHgkVHdmmPcHz1dG6sF7aYceZ:uttcY+UHCiaAd+cqHdmmPmzvwaYceZ
TLSH
T1DA55D6817A92A5B3FC84F3BA04260A0EA3658571BF45C747389FC5E46F8F2E49E914DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI44202\python312.dll
Size 6.7MB
SHA256 789a42ac160cef98f8925cb347473eeeb4e70f5513242e7faba5139ba06edf2d
MD5 550288a078dffc3430c08da888e70810
SHA1 01b1d31f37fb3fd81d893cc5e4a258e976f5884f
SHA512 7244432fc3716f7ef27630d4e8fbc8180a2542aa97a01d44dca260ab43966dd8ac98b6023400b0478a4809aace1a128f1f4d6e544f2e591a5b436fd4c8a9d723
SSDEEP 49152:mz0oCxOqKWneF3o1VLCClOTNRpaOviXEYWyb3eOYTvuFsx/iac84YNFXiTlv5WF4:mooCcqKLHX+az2Ro8Kv7HDMiEB/
TLSH
T193665A127298C0B9D967A1B4CD13C28FE7B17C51BF10530B31AAB36E2F737A2465A785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads