250290100b1cf16f26a1b2143371df4eab685565642646cc66beb48ab3ee0dbf

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_d6438584318759fbb0b604c71492a437_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Size 2.2MB
Sample260810-cakgcsde32
SHA256 250290100b1cf16f26a1b2143371df4eab685565642646cc66beb48ab3ee0dbf
MD5 d6438584318759fbb0b604c71492a437
SHA1 21b37414074fb9bdfbab38ba582a27073ef75eab
SHA512 84d293beafd137f60d657116908fd06df66864cf23e6e12d0e520e91fee192dd4cfe7506d0b818b38ae0972a5b904999c5ca87ae65c6b7051d55f536b779f7ca
SSDEEP 49152:si4qyXC2iX9d3MTYneAXFB3uKPdvt1phJNqx5pMCc67n4er:si+LYneAXFB3uKPdvdHNTPC
TLSH
T1E6B5A05666F950FDC077D078C95B5617E77174180330AAEB0BE449AA3F23BE0A77AB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion execution

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4324	2026-08-10_d6438584318759fbb0b604c71492a437_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4504	cmd.exe
6008	cmd.exe
868	cmd.exe
544	cmd.exe
5812	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
468	timeout.exe
3420	timeout.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 4504	4324	2026-08-10_d6438584318759fbb0b604c71492a437_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	91
PID 4504 wrote to memory of 700	4504	cmd.exe	92
PID 4504 wrote to memory of 3236	4504	cmd.exe	93
PID 4504 wrote to memory of 3908	4504	cmd.exe	94
PID 4324 wrote to memory of 6008	4324	2026-08-10_d6438584318759fbb0b604c71492a437_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	95
PID 6008 wrote to memory of 868	6008	cmd.exe	96
PID 868 wrote to memory of 468	868	cmd.exe	100
PID 4324 wrote to memory of 544	4324	2026-08-10_d6438584318759fbb0b604c71492a437_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	102
PID 544 wrote to memory of 5812	544	cmd.exe	103
PID 5812 wrote to memory of 3420	5812	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_d6438584318759fbb0b604c71492a437_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d6438584318759fbb0b604c71492a437_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\2026-08-10_d6438584318759fbb0b604c71492a437_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\2026-08-10_d6438584318759fbb0b604c71492a437_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe" MD5
    3⤵
    PID:700
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:3236
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:3908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6008
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:868
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo CURL Error: Failure when receiving data from the peer && timeout /t 5"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo CURL Error: Failure when receiving data from the peer && timeout /t 5"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5812
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads