5ea2c1bfad6057ca801caac8c305788797da6258b355547f8e73171381d698bd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 1.9MB
Sample260816-ftmydabd49
SHA256 5ea2c1bfad6057ca801caac8c305788797da6258b355547f8e73171381d698bd
MD5 0ad4bf779a11b5eaced26621f1f9e24a
SHA1 3d14835e9c0a07dfd5c8e570abca6fc67db08d72
SHA512 61b311436b09abe1aacd70b3557e35159ab9a2450acaf6278bb0428689dce28424cc1d3aafe43638ba6757628958b285babf01c6cad5ecd1d90bdf78e6c70ca2
SSDEEP 24576:PfKxxbuMOeLW61nf2+m/oxz/y/N9w/XYwUFzz:XKDuMOs5n+FgUFX
TLSH
T1C5954A296E541DDCD06A843DCB838A8ED2B1BC1A1F718BD717A17BA72E321D01E3B751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 1440	2880	2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	86
PID 2880 wrote to memory of 2444	2880	2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	85
PID 2880 wrote to memory of 1440	2880	2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	86
PID 2880 wrote to memory of 1440	2880	2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	86
PID 2880 wrote to memory of 2444	2880	2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	85
PID 2880 wrote to memory of 2444	2880	2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	85
PID 2880 wrote to memory of 1440	2880	2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	86
PID 2880 wrote to memory of 1440	2880	2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	86
PID 2880 wrote to memory of 1440	2880	2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	86
PID 2880 wrote to memory of 1440	2880	2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	86
PID 2880 wrote to memory of 2444	2880	2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	85
PID 2880 wrote to memory of 2444	2880	2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	85
PID 2880 wrote to memory of 2444	2880	2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	85
PID 2880 wrote to memory of 2444	2880	2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
  2⤵
  PID:2444
- C:\Users\Admin\AppData\Local\Temp\2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-16_0ad4bf779a11b5eaced26621f1f9e24a_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
  2⤵
  PID:1440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2880-0-0x0000000140000000-0x0000000140211000-memory.dmp

Download

memory/2880-1-0x0000000140000000-0x0000000140211000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads