2c2541f6a3a7615ad186fe2fbe960b187d129b6bd2c904f596eb8c1007449c64

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 13:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_ac8138e718edfe6155301041937a7d9d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.5MB
Sample260809-q58dkayflc
SHA256 2c2541f6a3a7615ad186fe2fbe960b187d129b6bd2c904f596eb8c1007449c64
MD5 ac8138e718edfe6155301041937a7d9d
SHA1 301a8cf4ba657445df0264907f9b8046c39006b7
SHA512 8f5a11fc7864aed5a3eab56289ca1738789edb6849b36e9242815ef74aca082d4bc404dfc37af66d80ee98bcdcd61e283e92d61cf9256c91b19137033ea74e54
SSDEEP 24576:i1LEgeK1zwt303IOlmISDVTv6VnWOB2LbjpfRpPsI9BDUpKS8b1EAe76Xyodyod:K39VwBGS3VTv6VnWOB2Lf/T4pj8bXe
TLSH
T1B3656C1BB29510E9D07AC178CA665112FA71BC550730AADF17E067262F37BE0AF3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	2026-08-09_ac8138e718edfe6155301041937a7d9d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe

Executes dropped EXE 2 IoCs

pid	Process
2096	IntelHidEventSvc.exe
832	psftp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 2096	5032	2026-08-09_ac8138e718edfe6155301041937a7d9d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	83
PID 5032 wrote to memory of 832	5032	2026-08-09_ac8138e718edfe6155301041937a7d9d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-09_ac8138e718edfe6155301041937a7d9d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_ac8138e718edfe6155301041937a7d9d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Users\Admin\AppData\Local\Temp\psftp\IntelHidEventSvc.exe
  "C:\Users\Admin\AppData\Local\Temp\psftp\IntelHidEventSvc.exe"
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Users\Admin\AppData\Local\Temp\psftp\psftp.exe
  "C:\Users\Admin\AppData\Local\Temp\psftp\psftp.exe"
  2⤵
  - Executes dropped EXE
  PID:832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup_main.log

Path C:\Users\Admin\AppData\Local\Temp\Setup_main.log
Size 1KB
SHA256 e4b620a1928e1e8b284b462a6e76f27aca88a443306b3d5fa9f0fe1b80427a5b
MD5 e9329eaf23c44ae3c893d580dab13b22
SHA1 7c560ca2d551c275f541f23c49c3638a5d1bfcfa
SHA512 0abe394b830b260dff56932a978ba5eaa453a577ff5c9c3f1935de1128fcb838d5dad26856b44d90a24bf2c670f699c1bbe99120305f6d635a21c1f20f1d8da5
TLSH
T1D831700187AF87774C9A500366769FCC82A328DDDE057B1EEB2A60D43368F1D6F62791
MD5 SHA1 SHA512 TLSH

Submit Download

Setup_main.log

Path C:\Users\Admin\AppData\Local\Temp\Setup_main.log
Size 1023B
SHA256 8f222f6c0ee6c3ebbf08df3337215d62676e23caa7a5e06c0099d065319bda15
MD5 91e52a87c7d3e6a2eea2debd459e1562
SHA1 df3133ebcda8467614d408fbce58cc16a7a1c1fe
SHA512 6fe9b69ba43a1c75273648ee09c59f9a636fa0afeb3e5fb7e770352ee5f36b580197fd2f2691de6bdb4634b2d02d81b122a4e79c883c1da505af8a224bea343d
TLSH
T1CB116A018BAF873B4C9A500356768FCC829328DDDF153B1EEF2964943298B1D6BA2790
MD5 SHA1 SHA512 TLSH

Submit Download

IntelHidEventSvc.exe

Path C:\Users\Admin\AppData\Local\Temp\psftp\IntelHidEventSvc.exe
Size 118KB
SHA256 d11803e105cc9d62e9f0dd25f572454ca203c3fb1de819d7d17ad6a6b6ad45df
MD5 e144a1dc31a89ee1acf50f119975ed93
SHA1 f15a02ea2cc1a1bcdb063903d62411291441d5de
SHA512 f8fb7ec32eec637567957151210abc4c0ce64d8b1dd53a73ef830b302df0ce459a744b41df216b9613f0e4b2977cf7a70c1e2815eb1a8fa9b9dd390aa52e320d
SSDEEP 3072:wIA3lTeSVyttsmnIXNjAsxxcNqTA2xDJKOxGIquxGUhJXewTz:+lLVyttQZGqTA2xDkO9CUbuqz
TLSH
T131C37C0274921A9DC822C0B88A477922D73A7E54173047F70BE57A593E747F2AEBF319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

psftp.exe

Path C:\Users\Admin\AppData\Local\Temp\psftp\psftp.exe
Size 1.0MB
SHA256 7b04cb14d2b5461598fe1fbd057a72092075b550a668492d031d13379f173031
MD5 9beaab6ed628f7f2c4abf801c6089f67
SHA1 5283f8e7b5066b8dc72b8cfaf838b816e30cf943
SHA512 a62ceb22d9c752ee6582447cf7ba5a3cbe02b59ea0c7e5f3f15708a326089b856494af67e8578b169366d42b162ae8f6c8f4f311b07cb838509d00362f5ce59c
SSDEEP 24576:CIOlmISDVTv6VnWOB2LbjpfRpPsI9BDUpKS8b1EAe76Xyodyodo:CS3VTv6VnWOB2Lf/T4pj8bXeh
TLSH
T18F358F17A39610EDC06AC1B98B665111EA71F8550B30BADF17E067252E37FE0AF3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads