Analysis
- max time kernel
152s - max time network
80s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 01:00
General
- Target 2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 92.7MB
- Sample260810-bc3kaaycka
- SHA256 c85ca05572f5857c3f5ac1d28834169c7333457addb8c35426a9bb1407561307
Malware Config
Signatures
- Clipboard Data 1 TTPs 2 IoCs
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Kills process with taskkill 1 IoCs
- Modifies data under HKEY_USERS 4 IoCs
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: LoadsDriver 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"3⤵
- Clipboard Data
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Get-Clipboard4⤵
- Clipboard Data
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /F /IM Discord.exe"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskkill.exetaskkill /F /IM Discord.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "sc query type= service state= all"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc query type= service state= all4⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ipconfig /all"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\ipconfig.exeipconfig /all4⤵
- Gathers network information
-
-
-
C:\Windows\SYSTEM32\fodhelper.exefodhelper.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"4⤵
- Loads dropped DLL
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c shutdown -l3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\shutdown.exeshutdown -l4⤵
-
-
-
C:\Windows\SYSTEM32\netsh.exenetsh wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exeC:\Users\Admin\AppData\Local\Temp\2026-08-10_2bbe3de49af88e5d08e1aa61cf850321_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a30855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000368 000000cc1⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 0000039c 000000cc1⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 0000037c 000000cc1⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000308 000000cc1⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000000e8 000000cc1⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 0000012c 000000cc1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
MSVCP140.dll
MSVCP140_1.dll
Qt5Core.dll
VCRUNTIME140_1.dll
qtdeclarative_en.qm
QtCore.pyd
sip.cp312-win_amd64.pyd
VCRUNTIME140.dll
_brotli.cp312-win_amd64.pyd
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_tkinter.pyd
_uuid.pyd
_wmi.pyd
antivm.py
autodestruct.py
base_library.zip
clipboard.py
discord_token.py
Lorem ipsum.txt
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
pyexpat.pyd
python3.DLL
python312.dll
select.pyd
telegram_c2.py
ucrtbase.dll
unicodedata.pyd
emissive_mask.png
RadioDelegateSpecifics.qml
SwitchSpecifics.qml
memory/1100-2781-0x00007FFC84950000-0x00007FFC8495D000-memory.dmp
memory/1100-2808-0x00007FFC74B10000-0x00007FFC74BDE000-memory.dmp
memory/1100-2775-0x00007FFC74B10000-0x00007FFC74BDE000-memory.dmp
memory/1100-2774-0x00007FFC7E1B0000-0x00007FFC7E442000-memory.dmp
memory/1100-2768-0x00007FFC72970000-0x00007FFC72EA3000-memory.dmp
memory/1100-2766-0x00007FFC82D60000-0x00007FFC82D74000-memory.dmp
memory/1100-2776-0x00007FFC76900000-0x00007FFC76F41000-memory.dmp
memory/1100-2761-0x00007FFC8AA90000-0x00007FFC8AAB5000-memory.dmp
memory/1100-2762-0x00007FFC84960000-0x00007FFC84996000-memory.dmp
memory/1100-2787-0x00007FFC72460000-0x00007FFC72531000-memory.dmp
memory/1100-2759-0x00007FFC84AF0000-0x00007FFC84AFF000-memory.dmp
memory/1100-2758-0x00007FFC73080000-0x00007FFC73745000-memory.dmp
memory/1100-2754-0x00007FFC86CD0000-0x00007FFC86CDD000-memory.dmp
memory/1100-2780-0x00007FFC86B70000-0x00007FFC86B98000-memory.dmp
memory/1100-2752-0x00007FFC849A0000-0x00007FFC849B9000-memory.dmp
memory/1100-2748-0x00007FFC86B70000-0x00007FFC86B98000-memory.dmp
memory/1100-2745-0x00007FFC76900000-0x00007FFC76F41000-memory.dmp
memory/1100-2735-0x00007FFC7E1B0000-0x00007FFC7E442000-memory.dmp
memory/1100-2798-0x00007FFC84AF0000-0x00007FFC84AFF000-memory.dmp
memory/1100-2799-0x00007FFC80920000-0x00007FFC80936000-memory.dmp
memory/1100-2802-0x00007FFC7F0B0000-0x00007FFC7F0DE000-memory.dmp
memory/1100-2801-0x00007FFC82D60000-0x00007FFC82D74000-memory.dmp
memory/1100-2800-0x00007FFC72170000-0x00007FFC7233A000-memory.dmp
memory/1100-2731-0x00007FFC86C00000-0x00007FFC86C2D000-memory.dmp
memory/1100-2728-0x00007FFC8AA70000-0x00007FFC8AA8A000-memory.dmp
memory/1100-2791-0x00007FFC72340000-0x00007FFC7245A000-memory.dmp
memory/1100-2790-0x00007FFC86CD0000-0x00007FFC86CDD000-memory.dmp
memory/1100-2806-0x00007FFC7F070000-0x00007FFC7F088000-memory.dmp
memory/1100-2807-0x00007FFC7F0E0000-0x00007FFC7F113000-memory.dmp
memory/1100-2805-0x00007FFC7E100000-0x00007FFC7E124000-memory.dmp
memory/1100-2809-0x00007FFC71D80000-0x00007FFC71FCA000-memory.dmp
memory/1100-2772-0x00007FFC7F0E0000-0x00007FFC7F113000-memory.dmp
memory/1100-2804-0x00007FFC71FD0000-0x00007FFC72169000-memory.dmp
memory/1100-2803-0x00007FFC72970000-0x00007FFC72EA3000-memory.dmp
memory/1100-2810-0x00007FFC71950000-0x00007FFC71D75000-memory.dmp
memory/1100-2811-0x00007FFC70110000-0x00007FFC714B7000-memory.dmp
memory/1100-2812-0x00007FFC7BDF0000-0x00007FFC7BE12000-memory.dmp
memory/1100-2813-0x00007FFC72340000-0x00007FFC7245A000-memory.dmp
memory/1100-2814-0x00007FFC80920000-0x00007FFC80936000-memory.dmp
memory/1100-2815-0x00007FFC72170000-0x00007FFC7233A000-memory.dmp
memory/1100-3248-0x00007FFC7F0B0000-0x00007FFC7F0DE000-memory.dmp
memory/1100-3210-0x00007FFC73080000-0x00007FFC73745000-memory.dmp
memory/1100-3217-0x00007FFC8AA90000-0x00007FFC8AAB5000-memory.dmp
memory/1100-3240-0x00007FFC7F0E0000-0x00007FFC7F113000-memory.dmp
memory/1100-2725-0x00007FFC8D2C0000-0x00007FFC8D2CF000-memory.dmp
memory/1100-3239-0x00007FFC72970000-0x00007FFC72EA3000-memory.dmp
memory/1100-3241-0x00007FFC74B10000-0x00007FFC74BDE000-memory.dmp
memory/1100-2723-0x00007FFC8AA90000-0x00007FFC8AAB5000-memory.dmp
memory/1100-2715-0x00007FFC73080000-0x00007FFC73745000-memory.dmp
memory/1100-3903-0x00007FFC70110000-0x00007FFC714B7000-memory.dmp
memory/1100-3902-0x00007FFC71950000-0x00007FFC71D75000-memory.dmp
memory/1100-3869-0x00007FFC73080000-0x00007FFC73745000-memory.dmp
memory/1100-3901-0x00007FFC71D80000-0x00007FFC71FCA000-memory.dmp
memory/5452-3870-0x00007FFC73080000-0x00007FFC73745000-memory.dmp
memory/5452-3875-0x00007FFC7E1B0000-0x00007FFC7E442000-memory.dmp
memory/5452-3879-0x00007FFC86CD0000-0x00007FFC86CDD000-memory.dmp
memory/5452-3878-0x00007FFC849A0000-0x00007FFC849B9000-memory.dmp
memory/5452-3877-0x00007FFC86B70000-0x00007FFC86B98000-memory.dmp
memory/5452-3874-0x00007FFC86C00000-0x00007FFC86C2D000-memory.dmp
memory/5452-3871-0x00007FFC8AA90000-0x00007FFC8AAB5000-memory.dmp
memory/5452-3876-0x00007FFC76900000-0x00007FFC76F41000-memory.dmp
memory/5452-3873-0x00007FFC8AA70000-0x00007FFC8AA8A000-memory.dmp
memory/5452-3872-0x00007FFC8D2C0000-0x00007FFC8D2CF000-memory.dmp