Overview

overview

8

Static

static

3

2026-08-10...ar.exe

windows10-2004-x64

1

2026-08-10...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 01:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_c23c75bfa6babf61cc8b53b9665857b7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
  • Size 1.5MB
  • Sample260810-cd4peayglc
  • SHA256 9f5910ddc7603b6ad7188856a6cd8ec1fa9dd2a9358eedc35aa4f20a45ace5b0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecution

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_c23c75bfa6babf61cc8b53b9665857b7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_c23c75bfa6babf61cc8b53b9665857b7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe"
    1⤵
    • Downloads MZ/PE file
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4644
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\update.cmd
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5752
      • C:\Windows\system32\timeout.exe
        timeout /t 1 /nobreak
        3⤵
        • Delays execution with timeout.exe
        PID:2816
      • C:\Users\Admin\AppData\Local\Temp\2026-08-10_c23c75bfa6babf61cc8b53b9665857b7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-10_c23c75bfa6babf61cc8b53b9665857b7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_poet-rat_vidar.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1732

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        hunter.png
        • Path C:\Users\Admin\AppData\Local\Temp\LoadoutsManager\hunter.png
        • Size 48KB
        • SHA256 b70347e16c9a07fdee8a1d1be6508e1b6dd759a28ea3378f55f6618e679fdb4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        titan.png
        • Path C:\Users\Admin\AppData\Local\Temp\LoadoutsManager\titan.png
        • Size 49KB
        • SHA256 8656bfb594df7b8c53ef260d9f58a04fe5cb08d85ba71fdb6fc52103e1871abc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        warlock.png
        • Path C:\Users\Admin\AppData\Local\Temp\LoadoutsManager\warlock.png
        • Size 49KB
        • SHA256 e196ff5be4ce08a432e685fccb5a9c78e3d17a0a29f180926c8b7f982d4d2fac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LoadoutsManager_update.exe
        • Path C:\Users\Admin\AppData\Local\Temp\LoadoutsManager_update.exe
        • Size 1.5MB
        • SHA256 52d8caa56991c5876970954d4e8bc5afa9c2c245d633a97a41810fd4fe675eff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        settings.ini
        • Path C:\Users\Admin\AppData\Local\Temp\loadouts_d2\settings.ini
        • Size 3KB
        • SHA256 6de037aa139078e52f5fd6729c3ea49ecda3d1c68cb30a8f6181c77137193eca
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        update.cmd
        • Path C:\Users\Admin\AppData\Local\Temp\update.cmd
        • Size 588B
        • SHA256 1d4a809e461be8dc8c66aa95347fadbfb295e9bca00d7691e4039029d72c9143
        • MD5 SHA1 SHA512 TLSH
        Submit Download