Overview

overview

7

Static

static

3

2026-08-09...ar.exe

windows10-2004-x64

7

2026-08-09...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 15:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_e93c9327054a14f410ead78c1941bbcc_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 74.6MB
  • Sample260809-s8prqshm3y
  • SHA256 2690dbfce4bfbd303000a12296635eefb1f96f20d1b01224a97fc5d1ab3a02ff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 60 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_e93c9327054a14f410ead78c1941bbcc_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_e93c9327054a14f410ead78c1941bbcc_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:264
    • C:\Users\Admin\AppData\Local\Temp\2026-08-09_e93c9327054a14f410ead78c1941bbcc_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-09_e93c9327054a14f410ead78c1941bbcc_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4924
      • C:\Users\Admin\AppData\Local\Temp\_MEI2642\install.exe
        C:\Users\Admin\AppData\Local\Temp\_MEI2642\install.exe -pbeznogym
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1484
        • C:\ProgramData\Microsoft\compiler.exe
          "C:\ProgramData\Microsoft\compiler.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2720
          • C:\ProgramData\Microsoft\compiler.exe
            "C:\ProgramData\Microsoft\compiler.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4532
        • C:\ProgramData\Microsoft\smss.exe
          "C:\ProgramData\Microsoft\smss.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:620
          • C:\ProgramData\Microsoft\smss.exe
            "C:\ProgramData\Microsoft\smss.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3360
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "ver"
              6⤵
              • Executes a command shell one-liner
              PID:3248
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004EC
    1⤵
      PID:4524

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          compiler.exe
          • Path C:\ProgramData\Microsoft\compiler.exe
          • Size 6.7MB
          • SHA256 80d645e255a6f33056f7ec59102a0d98a77dcc4108572f5a0b941c44a0c812dc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI2642\VCRUNTIME140.dll
          • Size 95KB
          • SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI2642\base_library.zip
          • Size 1.0MB
          • SHA256 5095e4485228a97675e8033f944b0773225981b20dac032174f942c7f96f2ab3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python310.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI2642\python310.dll
          • Size 4.3MB
          • SHA256 14b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27202\VCRUNTIME140_1.dll
          • Size 36KB
          • SHA256 34048abaa070ecc13b318cea31425f4ca3edd133d350318ac65259e6058c8b32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27202\_socket.pyd
          • Size 77KB
          • SHA256 e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27202\_ssl.pyd
          • Size 156KB
          • SHA256 d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27202\base_library.zip
          • Size 1.0MB
          • SHA256 3a95761deefc61d7e6b98d9404cbd78cd8c189dfd9b6fffb3c0a5ef1e206843f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27202\libcrypto-1_1.dll
          • Size 3.3MB
          • SHA256 9b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27202\libssl-1_1.dll
          • Size 688KB
          • SHA256 d74ce01319ae6f54483a19375524aa39d9f5fd91f06cf7df238ca25e043130fd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pywintypes310.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27202\pywin32_system32\pywintypes310.dll
          • Size 131KB
          • SHA256 c8ec6429d243aef1f78969863be23d59273fa6303760a173ab36ab71d5676005
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27202\select.pyd
          • Size 29KB
          • SHA256 db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ucrtbase.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27202\ucrtbase.dll
          • Size 1.1MB
          • SHA256 048d4c5a51e45777ba15facdaddbf7702594a2268e8de1768ab0f5f4e4d7e733
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27202\unicodedata.pyd
          • Size 1.1MB
          • SHA256 1fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32api.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27202\win32api.pyd
          • Size 136KB
          • SHA256 7ab0d714e44093649551623b93cc2aea4b30915adcb114bc1b75c548c3135b59
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32event.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI27202\win32event.pyd
          • Size 28KB
          • SHA256 257bc8bc6980f1825e020cfd2ffde693669e171b04def929bebdca7307cef13c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI6202\_bz2.pyd
          • Size 81KB
          • SHA256 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI6202\_ctypes.pyd
          • Size 120KB
          • SHA256 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI6202\_lzma.pyd
          • Size 154KB
          • SHA256 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI6202\_queue.pyd
          • Size 30KB
          • SHA256 925f05255f4aae0997dc4ec94d900fd15950fd840685d5b8aa755427c7422b14
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI6202\base_library.zip
          • Size 1.0MB
          • SHA256 d4d12cc6818eaa8140cb9c5759cc653665f8ec63968064b7ce049c0e16185f37
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-7.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI6202\libffi-7.dll
          • Size 32KB
          • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI6202\pyexpat.pyd
          • Size 194KB
          • SHA256 4a2d59993bce76790c6d923af81bf404f8e2cb73552e320113663b14cf78748c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI6202\python3.DLL
          • Size 64KB
          • SHA256 dc909eb798a23ba8ee9f8e3f307d97755bc0d2dc0cb342cedae81fbbad32a8a9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3360-1168-0x0000026620300000-0x0000026620652000-memory.dmp
          Download