2c2541f6a3a7615ad186fe2fbe960b187d129b6bd2c904f596eb8c1007449c64

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 13:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_ac8138e718edfe6155301041937a7d9d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.5MB
Sample260809-q58dkayflc
SHA256 2c2541f6a3a7615ad186fe2fbe960b187d129b6bd2c904f596eb8c1007449c64
MD5 ac8138e718edfe6155301041937a7d9d
SHA1 301a8cf4ba657445df0264907f9b8046c39006b7
SHA512 8f5a11fc7864aed5a3eab56289ca1738789edb6849b36e9242815ef74aca082d4bc404dfc37af66d80ee98bcdcd61e283e92d61cf9256c91b19137033ea74e54
SSDEEP 24576:i1LEgeK1zwt303IOlmISDVTv6VnWOB2LbjpfRpPsI9BDUpKS8b1EAe76Xyodyod:K39VwBGS3VTv6VnWOB2Lf/T4pj8bXe
TLSH
T1B3656C1BB29510E9D07AC178CA665112FA71BC550730AADF17E067262F37BE0AF3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4376	IntelHidEventSvc.exe
2112	psftp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5872 wrote to memory of 4376	5872	2026-08-09_ac8138e718edfe6155301041937a7d9d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89
PID 5872 wrote to memory of 2112	5872	2026-08-09_ac8138e718edfe6155301041937a7d9d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-09_ac8138e718edfe6155301041937a7d9d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_ac8138e718edfe6155301041937a7d9d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Users\Admin\AppData\Local\Temp\psftp\IntelHidEventSvc.exe
  "C:\Users\Admin\AppData\Local\Temp\psftp\IntelHidEventSvc.exe"
  2⤵
  - Executes dropped EXE
  PID:4376
- C:\Users\Admin\AppData\Local\Temp\psftp\psftp.exe
  "C:\Users\Admin\AppData\Local\Temp\psftp\psftp.exe"
  2⤵
  - Executes dropped EXE
  PID:2112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup_main.log

Path C:\Users\Admin\AppData\Local\Temp\Setup_main.log
Size 1KB
SHA256 ac1648f7c12c901ed51c3b2d9c6a7a57273a64561b98ebaf0fc47d96c2587d3d
MD5 74f38222cbf6f80513ed7e045f8a5c4f
SHA1 893067d207804508241a57344340903c27a34b66
SHA512 063fd336342cca8597162664e1c79c3ad4475743affa17014d680ad9e29990dd501a7a73d177fbaa31469a532bfc3b50fc321711ebb2d25d36247b06296fa9b1
TLSH
T14531A501839F9B7744AF104366B6CFCC829398DE96413A1EAB3154E83768F5A7E477C1
MD5 SHA1 SHA512 TLSH

Submit Download

Setup_main.log

Path C:\Users\Admin\AppData\Local\Temp\Setup_main.log
Size 1023B
SHA256 f91a7effe36f6075a068d89ab6c1904ea6ef83750ec00dc5330e05144509822e
MD5 66678412fb81500434bb086ca87133bb
SHA1 c31a312301e503ae8cfbdd2713ea001bbf90ad3d
SHA512 743ee1d42f4de70991650c6166ab09788607eb9d582a73eafd5dbf4761048c5aad5f914a0223bc4065dc102d6f9b6eac1a85297b9e3f39091485526a901748ba
TLSH
T1EB119301839F87B648AE514356B68B8C82D39CDF96013A1E9F21549C3798F5A7A8B7C0
MD5 SHA1 SHA512 TLSH

Submit Download

IntelHidEventSvc.exe

Path C:\Users\Admin\AppData\Local\Temp\psftp\IntelHidEventSvc.exe
Size 118KB
SHA256 d11803e105cc9d62e9f0dd25f572454ca203c3fb1de819d7d17ad6a6b6ad45df
MD5 e144a1dc31a89ee1acf50f119975ed93
SHA1 f15a02ea2cc1a1bcdb063903d62411291441d5de
SHA512 f8fb7ec32eec637567957151210abc4c0ce64d8b1dd53a73ef830b302df0ce459a744b41df216b9613f0e4b2977cf7a70c1e2815eb1a8fa9b9dd390aa52e320d
SSDEEP 3072:wIA3lTeSVyttsmnIXNjAsxxcNqTA2xDJKOxGIquxGUhJXewTz:+lLVyttQZGqTA2xDkO9CUbuqz
TLSH
T131C37C0274921A9DC822C0B88A477922D73A7E54173047F70BE57A593E747F2AEBF319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

psftp.exe

Path C:\Users\Admin\AppData\Local\Temp\psftp\psftp.exe
Size 1.0MB
SHA256 7b04cb14d2b5461598fe1fbd057a72092075b550a668492d031d13379f173031
MD5 9beaab6ed628f7f2c4abf801c6089f67
SHA1 5283f8e7b5066b8dc72b8cfaf838b816e30cf943
SHA512 a62ceb22d9c752ee6582447cf7ba5a3cbe02b59ea0c7e5f3f15708a326089b856494af67e8578b169366d42b162ae8f6c8f4f311b07cb838509d00362f5ce59c
SSDEEP 24576:CIOlmISDVTv6VnWOB2LbjpfRpPsI9BDUpKS8b1EAe76Xyodyodo:CS3VTv6VnWOB2Lf/T4pj8bXeh
TLSH
T18F358F17A39610EDC06AC1B98B665111EA71F8550B30BADF17E067252E37FE0AF3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5872-47-0x000001CE75970000-0x000001CE759EC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads