Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 03:31
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-15_98018b9abef300a6a3cdc8836de2c815_cobalt-strike_glassworm_megazord_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_98018b9abef300a6a3cdc8836de2c815_cobalt-strike_glassworm_megazord_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
150 seconds
General
- Target 2026-08-15_98018b9abef300a6a3cdc8836de2c815_cobalt-strike_glassworm_megazord_njrat_satacom_vidar.exe
- Size 75.9MB
- Sample260815-d2216adf44
- SHA256 726df1d839147b059afb364793a242de4de8fd64e3be05b816d563cd2480275a
- MD5 98018b9abef300a6a3cdc8836de2c815
- SHA1 d503d9693c042bbaf171d52530c4cae226fe2d19
- SHA512 deeed5bb8be8eab43bff474f85941ffbc3c7ca7eb10e67b853f1f84573d8469ce75cc3e304049ac8506d38898ba4c7aa903e94060e4cf19b46f9dfc9239fade3
- SSDEEP 393216:rGDTTo07NdAzwamVw5Z8vU0v/GIseP2dcaCad4FGZ3dpGRtOIUc9l5lZmYCWDpgO:aDw+PZAiDtOBc9pDaUV5OtsFitaMo9
- TLSH T12D08B015F3E84A16EA3FC27CC1638112E6F1B4531352C6CF0559EA992F63BC19B3B266
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 17 IoCs
resource yara_rule behavioral2/memory/1648-9-0x0000000000610000-0x000000000124D000-memory.dmp family_salatstealer behavioral2/memory/1648-10-0x0000000000610000-0x000000000124D000-memory.dmp family_salatstealer behavioral2/memory/1648-11-0x0000000000610000-0x000000000124D000-memory.dmp family_salatstealer behavioral2/memory/1648-22-0x0000000000610000-0x000000000124D000-memory.dmp family_salatstealer behavioral2/memory/5828-24-0x0000000000BE0000-0x000000000181D000-memory.dmp family_salatstealer behavioral2/memory/5828-25-0x0000000000BE0000-0x000000000181D000-memory.dmp family_salatstealer behavioral2/memory/1788-43-0x00000000009A0000-0x00000000015DD000-memory.dmp family_salatstealer behavioral2/memory/5828-56-0x0000000000BE0000-0x000000000181D000-memory.dmp family_salatstealer behavioral2/memory/5828-60-0x0000000000BE0000-0x000000000181D000-memory.dmp family_salatstealer behavioral2/memory/5828-61-0x0000000000BE0000-0x000000000181D000-memory.dmp family_salatstealer behavioral2/memory/5828-62-0x0000000000BE0000-0x000000000181D000-memory.dmp family_salatstealer behavioral2/memory/5828-63-0x0000000000BE0000-0x000000000181D000-memory.dmp family_salatstealer behavioral2/memory/5828-64-0x0000000000BE0000-0x000000000181D000-memory.dmp family_salatstealer behavioral2/memory/5828-65-0x0000000000BE0000-0x000000000181D000-memory.dmp family_salatstealer behavioral2/memory/5828-66-0x0000000000BE0000-0x000000000181D000-memory.dmp family_salatstealer behavioral2/memory/5828-67-0x0000000000BE0000-0x000000000181D000-memory.dmp family_salatstealer behavioral2/memory/5828-68-0x0000000000BE0000-0x000000000181D000-memory.dmp family_salatstealer - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 17 IoCs
resource yara_rule behavioral2/memory/1648-9-0x0000000000610000-0x000000000124D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/1648-10-0x0000000000610000-0x000000000124D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/1648-11-0x0000000000610000-0x000000000124D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/1648-22-0x0000000000610000-0x000000000124D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5828-24-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5828-25-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/1788-43-0x00000000009A0000-0x00000000015DD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5828-56-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5828-60-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5828-61-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5828-62-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5828-63-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5828-64-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5828-65-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5828-66-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5828-67-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/5828-68-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 17 IoCs
resource yara_rule behavioral2/memory/1648-9-0x0000000000610000-0x000000000124D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/1648-10-0x0000000000610000-0x000000000124D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/1648-11-0x0000000000610000-0x000000000124D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/1648-22-0x0000000000610000-0x000000000124D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5828-24-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5828-25-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/1788-43-0x00000000009A0000-0x00000000015DD000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5828-56-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5828-60-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5828-61-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5828-62-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5828-63-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5828-64-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5828-65-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5828-66-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5828-67-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/5828-68-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 17 IoCs
resource yara_rule behavioral2/memory/1648-9-0x0000000000610000-0x000000000124D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/1648-10-0x0000000000610000-0x000000000124D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/1648-11-0x0000000000610000-0x000000000124D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/1648-22-0x0000000000610000-0x000000000124D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5828-24-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5828-25-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/1788-43-0x00000000009A0000-0x00000000015DD000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5828-56-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5828-60-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5828-61-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5828-62-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5828-63-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5828-64-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5828-65-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5828-66-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5828-67-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/5828-68-0x0000000000BE0000-0x000000000181D000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 21 IoCs
resource yara_rule behavioral2/files/0x0003000000000432-4.dat UPX behavioral2/memory/1648-8-0x0000000000610000-0x000000000124D000-memory.dmp UPX behavioral2/memory/1648-9-0x0000000000610000-0x000000000124D000-memory.dmp UPX behavioral2/memory/1648-10-0x0000000000610000-0x000000000124D000-memory.dmp UPX behavioral2/memory/1648-11-0x0000000000610000-0x000000000124D000-memory.dmp UPX behavioral2/memory/5828-23-0x0000000000BE0000-0x000000000181D000-memory.dmp UPX behavioral2/memory/1648-22-0x0000000000610000-0x000000000124D000-memory.dmp UPX behavioral2/memory/5828-24-0x0000000000BE0000-0x000000000181D000-memory.dmp UPX behavioral2/memory/5828-25-0x0000000000BE0000-0x000000000181D000-memory.dmp UPX behavioral2/memory/1788-32-0x00000000009A0000-0x00000000015DD000-memory.dmp UPX behavioral2/memory/1788-43-0x00000000009A0000-0x00000000015DD000-memory.dmp UPX behavioral2/memory/5828-56-0x0000000000BE0000-0x000000000181D000-memory.dmp UPX behavioral2/memory/5828-60-0x0000000000BE0000-0x000000000181D000-memory.dmp UPX behavioral2/memory/5828-61-0x0000000000BE0000-0x000000000181D000-memory.dmp UPX behavioral2/memory/5828-62-0x0000000000BE0000-0x000000000181D000-memory.dmp UPX behavioral2/memory/5828-63-0x0000000000BE0000-0x000000000181D000-memory.dmp UPX behavioral2/memory/5828-64-0x0000000000BE0000-0x000000000181D000-memory.dmp UPX behavioral2/memory/5828-65-0x0000000000BE0000-0x000000000181D000-memory.dmp UPX behavioral2/memory/5828-66-0x0000000000BE0000-0x000000000181D000-memory.dmp UPX behavioral2/memory/5828-67-0x0000000000BE0000-0x000000000181D000-memory.dmp UPX behavioral2/memory/5828-68-0x0000000000BE0000-0x000000000181D000-memory.dmp UPX - Executes dropped EXE 3 IoCs
pid Process 1648 recovered.exe 5828 ShellHost.exe 1788 ShellHost.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
resource yara_rule behavioral2/files/0x0003000000000432-4.dat upx behavioral2/memory/1648-8-0x0000000000610000-0x000000000124D000-memory.dmp upx behavioral2/memory/1648-9-0x0000000000610000-0x000000000124D000-memory.dmp upx behavioral2/memory/1648-10-0x0000000000610000-0x000000000124D000-memory.dmp upx behavioral2/memory/1648-11-0x0000000000610000-0x000000000124D000-memory.dmp upx behavioral2/memory/5828-23-0x0000000000BE0000-0x000000000181D000-memory.dmp upx behavioral2/memory/1648-22-0x0000000000610000-0x000000000124D000-memory.dmp upx behavioral2/memory/5828-24-0x0000000000BE0000-0x000000000181D000-memory.dmp upx behavioral2/memory/5828-25-0x0000000000BE0000-0x000000000181D000-memory.dmp upx behavioral2/memory/1788-32-0x00000000009A0000-0x00000000015DD000-memory.dmp upx behavioral2/memory/1788-43-0x00000000009A0000-0x00000000015DD000-memory.dmp upx behavioral2/memory/5828-56-0x0000000000BE0000-0x000000000181D000-memory.dmp upx behavioral2/memory/5828-60-0x0000000000BE0000-0x000000000181D000-memory.dmp upx behavioral2/memory/5828-61-0x0000000000BE0000-0x000000000181D000-memory.dmp upx behavioral2/memory/5828-62-0x0000000000BE0000-0x000000000181D000-memory.dmp upx behavioral2/memory/5828-63-0x0000000000BE0000-0x000000000181D000-memory.dmp upx behavioral2/memory/5828-64-0x0000000000BE0000-0x000000000181D000-memory.dmp upx behavioral2/memory/5828-65-0x0000000000BE0000-0x000000000181D000-memory.dmp upx behavioral2/memory/5828-66-0x0000000000BE0000-0x000000000181D000-memory.dmp upx behavioral2/memory/5828-67-0x0000000000BE0000-0x000000000181D000-memory.dmp upx behavioral2/memory/5828-68-0x0000000000BE0000-0x000000000181D000-memory.dmp upx - Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\ShellHost.exe ShellHost.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\308d4da5-2af5-4b23-e7e7-d30353d5a52a recovered.exe File opened for modification C:\Program Files (x86)\Microsoft.NET\wininit.exe recovered.exe File opened for modification C:\Program Files (x86)\Windows Defender\308d4da5-2af5-4b23-e7e7-d30353d5a52a recovered.exe File opened for modification C:\Program Files (x86)\Windows Defender\dwm.exe recovered.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\308d4da5-2af5-4b23-e7e7-d30353d5a52a recovered.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ShellHost.exe recovered.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language recovered.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ShellHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ShellHost.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 1648 recovered.exe 1648 recovered.exe 1648 recovered.exe 1648 recovered.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 2984 powershell.exe 2984 powershell.exe 1788 ShellHost.exe 1788 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe 5828 ShellHost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2984 powershell.exe Token: SeDebugPrivilege 5828 ShellHost.exe Token: SeIncreaseQuotaPrivilege 2984 powershell.exe Token: SeSecurityPrivilege 2984 powershell.exe Token: SeTakeOwnershipPrivilege 2984 powershell.exe Token: SeLoadDriverPrivilege 2984 powershell.exe Token: SeSystemProfilePrivilege 2984 powershell.exe Token: SeSystemtimePrivilege 2984 powershell.exe Token: SeProfSingleProcessPrivilege 2984 powershell.exe Token: SeIncBasePriorityPrivilege 2984 powershell.exe Token: SeCreatePagefilePrivilege 2984 powershell.exe Token: SeBackupPrivilege 2984 powershell.exe Token: SeRestorePrivilege 2984 powershell.exe Token: SeShutdownPrivilege 2984 powershell.exe Token: SeDebugPrivilege 2984 powershell.exe Token: SeSystemEnvironmentPrivilege 2984 powershell.exe Token: SeRemoteShutdownPrivilege 2984 powershell.exe Token: SeUndockPrivilege 2984 powershell.exe Token: SeManageVolumePrivilege 2984 powershell.exe Token: 33 2984 powershell.exe Token: 34 2984 powershell.exe Token: 35 2984 powershell.exe Token: 36 2984 powershell.exe Token: SeIncreaseQuotaPrivilege 2984 powershell.exe Token: SeSecurityPrivilege 2984 powershell.exe Token: SeTakeOwnershipPrivilege 2984 powershell.exe Token: SeLoadDriverPrivilege 2984 powershell.exe Token: SeSystemProfilePrivilege 2984 powershell.exe Token: SeSystemtimePrivilege 2984 powershell.exe Token: SeProfSingleProcessPrivilege 2984 powershell.exe Token: SeIncBasePriorityPrivilege 2984 powershell.exe Token: SeCreatePagefilePrivilege 2984 powershell.exe Token: SeBackupPrivilege 2984 powershell.exe Token: SeRestorePrivilege 2984 powershell.exe Token: SeShutdownPrivilege 2984 powershell.exe Token: SeDebugPrivilege 2984 powershell.exe Token: SeSystemEnvironmentPrivilege 2984 powershell.exe Token: SeRemoteShutdownPrivilege 2984 powershell.exe Token: SeUndockPrivilege 2984 powershell.exe Token: SeManageVolumePrivilege 2984 powershell.exe Token: 33 2984 powershell.exe Token: 34 2984 powershell.exe Token: 35 2984 powershell.exe Token: 36 2984 powershell.exe Token: SeIncreaseQuotaPrivilege 2984 powershell.exe Token: SeSecurityPrivilege 2984 powershell.exe Token: SeTakeOwnershipPrivilege 2984 powershell.exe Token: SeLoadDriverPrivilege 2984 powershell.exe Token: SeSystemProfilePrivilege 2984 powershell.exe Token: SeSystemtimePrivilege 2984 powershell.exe Token: SeProfSingleProcessPrivilege 2984 powershell.exe Token: SeIncBasePriorityPrivilege 2984 powershell.exe Token: SeCreatePagefilePrivilege 2984 powershell.exe Token: SeBackupPrivilege 2984 powershell.exe Token: SeRestorePrivilege 2984 powershell.exe Token: SeShutdownPrivilege 2984 powershell.exe Token: SeDebugPrivilege 2984 powershell.exe Token: SeSystemEnvironmentPrivilege 2984 powershell.exe Token: SeRemoteShutdownPrivilege 2984 powershell.exe Token: SeUndockPrivilege 2984 powershell.exe Token: SeManageVolumePrivilege 2984 powershell.exe Token: 33 2984 powershell.exe Token: 34 2984 powershell.exe Token: 35 2984 powershell.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5944 wrote to memory of 1648 5944 2026-08-15_98018b9abef300a6a3cdc8836de2c815_cobalt-strike_glassworm_megazord_njrat_satacom_vidar.exe 90 PID 1648 wrote to memory of 5828 1648 recovered.exe 92 PID 5828 wrote to memory of 2984 5828 ShellHost.exe 94 PID 5828 wrote to memory of 1788 5828 ShellHost.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_98018b9abef300a6a3cdc8836de2c815_cobalt-strike_glassworm_megazord_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_98018b9abef300a6a3cdc8836de2c815_cobalt-strike_glassworm_megazord_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5944 -
C:\Users\Admin\AppData\Local\Temp\recovered.exe"C:\Users\Admin\AppData\Local\Temp\recovered.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Program Files (x86)\Windows Photo Viewer\ShellHost.exe"C:\Program Files (x86)\Windows Photo Viewer\ShellHost.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5828 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\ShellHost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\ShellHost.exe" -4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1788
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\recovered.exe
- Size 3.4MB
- SHA256 a33d2d78ac46d0d6996200b6cb0ccf41677019dd3b0fa5bd91454caff2730e2f
- MD5 b1849e847b4f8119d008a73d740c7d47
- SHA1 a6913c4db3a4b6893b344a03d674bd4d393dd139
- SHA512 4b894a53a3200fe1f0a88a53df7c52a15ab42a9a4b4f9c94a549409bc98e423b0e7f2b912cd596e14cccbe55632f5d2c71f6c1068bd79b0b53af6740d20be412
- SSDEEP 98304:Er+0L4MdYlFa97x2TU2k0tu3uv44hjm351/:mpdd8a99k2e3+51
- TLSH T108F53305DACCF503EF3A78356A466AE76189D3A431F661E0976D6BBBACA4DC0D103F10
- MD5 SHA1 SHA512 SSDEEP TLSH