Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/08/2026, 05:10
General
- Target 2026-08-16_09aa95b229c10a3b61c331d72d9e03ab_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
- Size 32.1MB
- Sample260816-ftwwaa1vex
- SHA256 71f6c37de2289e53f9629962b460afa4c16601ef1ededd4564c3aba37788b736
Malware Config
Signatures
- Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs
- Detects executables containing URLs to raw contents of a Github gist 2 IoCs
- Detects executables manipulated with Fody 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_09aa95b229c10a3b61c331d72d9e03ab_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_09aa95b229c10a3b61c331d72d9e03ab_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2880-0-0x00007FF9027EF000-0x00007FF9027F0000-memory.dmp
memory/2880-1-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/2880-2-0x000001B2CD5B0000-0x000001B2CF5CA000-memory.dmp
memory/2880-3-0x000001B2D1200000-0x000001B2D1212000-memory.dmp
memory/2880-5-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/2880-6-0x000001B2D1220000-0x000001B2D1236000-memory.dmp
memory/2880-4-0x000001B2EA8C0000-0x000001B2EAADC000-memory.dmp
memory/2880-7-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/2880-8-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/2880-9-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/2880-10-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/2880-11-0x000001B2ED2B0000-0x000001B2ED2D2000-memory.dmp
memory/2880-12-0x000001B2ED320000-0x000001B2ED35C000-memory.dmp
memory/2880-15-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/2880-16-0x00007FF902660000-0x00007FF903004000-memory.dmp
memory/2880-17-0x00007FF902660000-0x00007FF903004000-memory.dmp