b41ab86a043a8693fd228c1704ff919fe56ab4727a91af8dca1c7c5b18d3c392

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_72ec6f62d8619bac28de96204cf2d0f6_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
Size 1.4MB
Sample260810-kcbagayzcx
SHA256 b41ab86a043a8693fd228c1704ff919fe56ab4727a91af8dca1c7c5b18d3c392
MD5 72ec6f62d8619bac28de96204cf2d0f6
SHA1 410ac49425d2d56527801c144fdef307d0b96cdd
SHA512 4e60e1a21c10691ba3fc36b3aec3134659b1312b57d2cbb0ff107aa1bbdf8034e274a9097f17ea67dbee00dee1cdd18b3c0d66d185bf4478108e41c23d3307c1
SSDEEP 24576:b1LEgeK1z/t30frVsGcdEp26KBpSQrrQVQPpAYuOqoEMGlOhNHEJIodrodV:N39V/Bi2dEp26KBpSQrPoOKMrhN4+
TLSH
T1BD657D1BA69510E9C07AC178CA665112FA71BC5507306ADF27E067262F37FE0AF3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5996	IntelHidEventSvc.exe
5648	plink.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 5996	2580	2026-08-10_72ec6f62d8619bac28de96204cf2d0f6_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	88
PID 2580 wrote to memory of 5648	2580	2026-08-10_72ec6f62d8619bac28de96204cf2d0f6_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-10_72ec6f62d8619bac28de96204cf2d0f6_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_72ec6f62d8619bac28de96204cf2d0f6_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Users\Admin\AppData\Local\Temp\plink\IntelHidEventSvc.exe
  "C:\Users\Admin\AppData\Local\Temp\plink\IntelHidEventSvc.exe"
  2⤵
  - Executes dropped EXE
  PID:5996
- C:\Users\Admin\AppData\Local\Temp\plink\plink.exe
  "C:\Users\Admin\AppData\Local\Temp\plink\plink.exe"
  2⤵
  - Executes dropped EXE
  PID:5648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Setup_main.log

Path C:\Users\Admin\AppData\Local\Temp\Setup_main.log
Size 1KB
SHA256 fd1ab2ee23831057dcba6cbc79a762c1fb9b5ae05007f4285185630c7eb418f7
MD5 e9c8dc863e6746a0351ccaa36e8c7976
SHA1 f325bc34a879355fb78eb1ff559ab943c729379c
SHA512 249f4bd50fc2ca5e01a541f13eab295f7d0341b2ea03acacdcceadd54b308bc0a42ff9d687de76d090eae329ac82fe8f98f39258ea2e859609b156464901e30e
TLSH
T19231D642C2EF8637586516474A6E8EF8C4F209DD2A152A65FF2244E831C0F1B9FE3788
MD5 SHA1 SHA512 TLSH

Submit Download

Setup_main.log

Path C:\Users\Admin\AppData\Local\Temp\Setup_main.log
Size 1023B
SHA256 97ac7673b12066e9cc7a987119d8be3e070d196cd1bf1c6cc82628e0faaf66f2
MD5 2e1762ecb91dae2407d51f1ca77372d6
SHA1 92ade914792e0939add64174808b24701bcc8556
SHA512 825ca3c14111660d6fce9d327b2b1beeadc5c0a450d130657dc2af5ba0dee2825d65a93a4d9555a6c64a1529d35c3a6998e4084bf835d23a84dd3ee3246677bc
TLSH
T1B0119442C2EB873B582552474E6E8EF888F309DD2B151A64FF2154A431C0F1B9FE7398
MD5 SHA1 SHA512 TLSH

Submit Download

IntelHidEventSvc.exe

Path C:\Users\Admin\AppData\Local\Temp\plink\IntelHidEventSvc.exe
Size 118KB
SHA256 d11803e105cc9d62e9f0dd25f572454ca203c3fb1de819d7d17ad6a6b6ad45df
MD5 e144a1dc31a89ee1acf50f119975ed93
SHA1 f15a02ea2cc1a1bcdb063903d62411291441d5de
SHA512 f8fb7ec32eec637567957151210abc4c0ce64d8b1dd53a73ef830b302df0ce459a744b41df216b9613f0e4b2977cf7a70c1e2815eb1a8fa9b9dd390aa52e320d
SSDEEP 3072:wIA3lTeSVyttsmnIXNjAsxxcNqTA2xDJKOxGIquxGUhJXewTz:+lLVyttQZGqTA2xDkO9CUbuqz
TLSH
T131C37C0274921A9DC822C0B88A477922D73A7E54173047F70BE57A593E747F2AEBF319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plink.exe

Path C:\Users\Admin\AppData\Local\Temp\plink\plink.exe
Size 1018KB
SHA256 e5621ffe4879f0ec39ed40f688db9399c2d43054d41ef14472fa335c4693b915
MD5 663b3c6559dab0e0866e0edfaad9516d
SHA1 3681353b664f6e2b5590af0a8c7f6a9254629f5e
SHA512 3174dde49d9f365883a091beb4e2f05c17216877f01c92535cffd07990ac69ce7820155c58b2531cb62cf511c3a7aecb016d1fe54cfa0b4161ee86e27f9e9cf9
SSDEEP 24576:urVsGcdEp26KBpSQrrQVQPpAYuOqoEMGlOhNHEJIodrodj:u2dEp26KBpSQrPoOKMrhN4c
TLSH
T117258E17A39610EDD06AC2B9CB669111EA71FC450B30BADF17E067262E26FD06F3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads