Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/08/2026, 01:22
General
- Target 2026-08-19_dce87c7485aad61b53ead0add1af44e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 21.0MB
- Sample260820-brd58sag83
- SHA256 faaa4056d770b70945755437b10aff1863577de5b21e9453900d3a189f9cf4f8
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Loads dropped DLL 52 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 6 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_dce87c7485aad61b53ead0add1af44e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_dce87c7485aad61b53ead0add1af44e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_dce87c7485aad61b53ead0add1af44e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_dce87c7485aad61b53ead0add1af44e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"2⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "netsh wlan show profiles"3⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Wi-Fi Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic os get Caption"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get Name3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name4⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
_raw_cbc.pyd
_raw_ecb.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp311-win_amd64.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
base_library.zip
cacert.pem
md.cp311-win_amd64.pyd
md__mypyc.cp311-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
_psutil_windows.pyd
pyexpat.pyd
python3.DLL
python311.dll
pythoncom311.dll
pywintypes311.dll
select.pyd
sqlite3.dll
ucrtbase.dll
unicodedata.pyd
INSTALLER
win32api.pyd
cc's.txt
memory/4236-276-0x00007FF90EFB0000-0x00007FF90EFBC000-memory.dmp
memory/4236-294-0x00007FF90BA50000-0x00007FF90BA79000-memory.dmp
memory/4236-217-0x00007FF9070B0000-0x00007FF90717D000-memory.dmp
memory/4236-219-0x00007FF916380000-0x00007FF916399000-memory.dmp
memory/4236-212-0x00007FF90FEE0000-0x00007FF90FF13000-memory.dmp
memory/4236-222-0x00007FF915A20000-0x00007FF915A35000-memory.dmp
memory/4236-207-0x00007FF917BC0000-0x00007FF917BE3000-memory.dmp
memory/4236-225-0x00007FF914E40000-0x00007FF914E52000-memory.dmp
memory/4236-208-0x00007FF915780000-0x00007FF9157AB000-memory.dmp
memory/4236-230-0x00007FF910D30000-0x00007FF910D53000-memory.dmp
memory/4236-229-0x00007FF91AC60000-0x00007FF91AC6D000-memory.dmp
memory/4236-203-0x00007FF903D40000-0x00007FF904329000-memory.dmp
memory/4236-233-0x00007FF907A20000-0x00007FF907B97000-memory.dmp
memory/4236-232-0x00007FF916310000-0x00007FF91633E000-memory.dmp
memory/4236-204-0x00007FF9157B0000-0x00007FF91586C000-memory.dmp
memory/4236-237-0x00007FF911180000-0x00007FF91119C000-memory.dmp
memory/4236-236-0x00007FF9157B0000-0x00007FF91586C000-memory.dmp
memory/4236-199-0x00007FF916310000-0x00007FF91633E000-memory.dmp
memory/4236-240-0x00007FF90F000000-0x00007FF90F014000-memory.dmp
memory/4236-195-0x00007FF91AC60000-0x00007FF91AC6D000-memory.dmp
memory/4236-192-0x00007FF916340000-0x00007FF916376000-memory.dmp
memory/4236-244-0x00007FF9174D0000-0x00007FF9174DB000-memory.dmp
memory/4236-243-0x00007FF90FEE0000-0x00007FF90FF13000-memory.dmp
memory/4236-187-0x00007FF916380000-0x00007FF916399000-memory.dmp
memory/4236-248-0x00007FF903820000-0x00007FF903D40000-memory.dmp
memory/4236-249-0x00007FF90EFD0000-0x00007FF90EFF3000-memory.dmp
memory/4236-252-0x00007FF906440000-0x00007FF90655C000-memory.dmp
memory/4236-189-0x00007FF91ACC0000-0x00007FF91ACCD000-memory.dmp
memory/4236-251-0x00007FF9070B0000-0x00007FF90717D000-memory.dmp
memory/4236-175-0x00007FF917BC0000-0x00007FF917BE3000-memory.dmp
memory/4236-256-0x00007FF90D3E0000-0x00007FF90D418000-memory.dmp
memory/4236-177-0x00007FF91ADF0000-0x00007FF91ADFF000-memory.dmp
memory/4236-261-0x00007FF916EB0000-0x00007FF916EBB000-memory.dmp
memory/4236-262-0x00007FF916C80000-0x00007FF916C8B000-memory.dmp
memory/4236-264-0x00007FF9159F0000-0x00007FF9159FC000-memory.dmp
memory/4236-266-0x00007FF915680000-0x00007FF91568B000-memory.dmp
memory/4236-268-0x00007FF9140F0000-0x00007FF9140FB000-memory.dmp
memory/4236-270-0x00007FF911620000-0x00007FF91162C000-memory.dmp
memory/4236-272-0x00007FF90FE70000-0x00007FF90FE7D000-memory.dmp
memory/4236-271-0x00007FF90EFD0000-0x00007FF90EFF3000-memory.dmp
memory/4236-274-0x00007FF90EFC0000-0x00007FF90EFCE000-memory.dmp
memory/4236-181-0x00007FF9163D0000-0x00007FF9163E9000-memory.dmp
memory/4236-277-0x00007FF90DDC0000-0x00007FF90DDCC000-memory.dmp
memory/4236-278-0x00007FF90D3D0000-0x00007FF90D3DB000-memory.dmp
memory/4236-280-0x00007FF90CB30000-0x00007FF90CB3C000-memory.dmp
memory/4236-282-0x00007FF90C8B0000-0x00007FF90C8BD000-memory.dmp
memory/4236-283-0x00007FF90C340000-0x00007FF90C352000-memory.dmp
memory/4236-284-0x00007FF90C8A0000-0x00007FF90C8AC000-memory.dmp
memory/4236-281-0x00007FF90C8C0000-0x00007FF90C8CC000-memory.dmp
memory/4236-285-0x00007FF90C310000-0x00007FF90C334000-memory.dmp
memory/4236-279-0x00007FF90D2C0000-0x00007FF90D2CB000-memory.dmp
memory/4236-275-0x00007FF90D3E0000-0x00007FF90D418000-memory.dmp
memory/4236-273-0x00007FF906440000-0x00007FF90655C000-memory.dmp
memory/4236-269-0x00007FF9174D0000-0x00007FF9174DB000-memory.dmp
memory/4236-267-0x00007FF9143E0000-0x00007FF9143EC000-memory.dmp
memory/4236-265-0x00007FF907A20000-0x00007FF907B97000-memory.dmp
memory/4236-263-0x00007FF910D30000-0x00007FF910D53000-memory.dmp
memory/4236-260-0x00007FF915A20000-0x00007FF915A35000-memory.dmp
memory/4236-183-0x00007FF9163A0000-0x00007FF9163CD000-memory.dmp
memory/4236-215-0x00007FF903820000-0x00007FF903D40000-memory.dmp
memory/4236-293-0x00007FF9035C0000-0x00007FF903812000-memory.dmp
memory/4236-166-0x00007FF903D40000-0x00007FF904329000-memory.dmp
memory/4236-320-0x00007FF917BC0000-0x00007FF917BE3000-memory.dmp
memory/4236-327-0x00007FF91AC60000-0x00007FF91AC6D000-memory.dmp
memory/4236-319-0x00007FF903D40000-0x00007FF904329000-memory.dmp
memory/4236-337-0x00007FF907A20000-0x00007FF907B97000-memory.dmp
memory/4236-333-0x00007FF9070B0000-0x00007FF90717D000-memory.dmp
memory/4236-332-0x00007FF903820000-0x00007FF903D40000-memory.dmp
memory/4236-331-0x00007FF90FEE0000-0x00007FF90FF13000-memory.dmp
memory/4236-338-0x00007FF911180000-0x00007FF91119C000-memory.dmp
memory/4236-324-0x00007FF916380000-0x00007FF916399000-memory.dmp
memory/4236-366-0x00007FF903D40000-0x00007FF904329000-memory.dmp
memory/4236-393-0x00007FF917BC0000-0x00007FF917BE3000-memory.dmp
memory/4236-394-0x00007FF91ADF0000-0x00007FF91ADFF000-memory.dmp
memory/4236-392-0x00007FF903D40000-0x00007FF904329000-memory.dmp
memory/4236-396-0x00007FF9163A0000-0x00007FF9163CD000-memory.dmp
memory/4236-401-0x00007FF916310000-0x00007FF91633E000-memory.dmp
memory/4236-408-0x00007FF914E40000-0x00007FF914E52000-memory.dmp
memory/4236-414-0x00007FF90EFD0000-0x00007FF90EFF3000-memory.dmp
memory/4236-413-0x00007FF9174D0000-0x00007FF9174DB000-memory.dmp
memory/4236-412-0x00007FF90F000000-0x00007FF90F014000-memory.dmp
memory/4236-410-0x00007FF907A20000-0x00007FF907B97000-memory.dmp
memory/4236-437-0x00007FF9035C0000-0x00007FF903812000-memory.dmp
memory/4236-436-0x00007FF90BA50000-0x00007FF90BA79000-memory.dmp
memory/4236-435-0x00007FF90C310000-0x00007FF90C334000-memory.dmp
memory/4236-434-0x00007FF90C8A0000-0x00007FF90C8AC000-memory.dmp
memory/4236-433-0x00007FF90C340000-0x00007FF90C352000-memory.dmp
memory/4236-432-0x00007FF90C8B0000-0x00007FF90C8BD000-memory.dmp
memory/4236-431-0x00007FF90C8C0000-0x00007FF90C8CC000-memory.dmp
memory/4236-430-0x00007FF90CB30000-0x00007FF90CB3C000-memory.dmp
memory/4236-429-0x00007FF90D2C0000-0x00007FF90D2CB000-memory.dmp
memory/4236-428-0x00007FF90D3D0000-0x00007FF90D3DB000-memory.dmp
memory/4236-427-0x00007FF90DDC0000-0x00007FF90DDCC000-memory.dmp
memory/4236-426-0x00007FF90EFB0000-0x00007FF90EFBC000-memory.dmp
memory/4236-425-0x00007FF90EFC0000-0x00007FF90EFCE000-memory.dmp
memory/4236-424-0x00007FF90FE70000-0x00007FF90FE7D000-memory.dmp
memory/4236-423-0x00007FF911620000-0x00007FF91162C000-memory.dmp
memory/4236-422-0x00007FF9140F0000-0x00007FF9140FB000-memory.dmp
memory/4236-421-0x00007FF9143E0000-0x00007FF9143EC000-memory.dmp
memory/4236-420-0x00007FF915680000-0x00007FF91568B000-memory.dmp
memory/4236-419-0x00007FF9159F0000-0x00007FF9159FC000-memory.dmp
memory/4236-418-0x00007FF916C80000-0x00007FF916C8B000-memory.dmp
memory/4236-417-0x00007FF916EB0000-0x00007FF916EBB000-memory.dmp
memory/4236-416-0x00007FF90D3E0000-0x00007FF90D418000-memory.dmp
memory/4236-415-0x00007FF906440000-0x00007FF90655C000-memory.dmp
memory/4236-405-0x00007FF903820000-0x00007FF903D40000-memory.dmp
memory/4236-411-0x00007FF911180000-0x00007FF91119C000-memory.dmp
memory/4236-409-0x00007FF910D30000-0x00007FF910D53000-memory.dmp
memory/4236-407-0x00007FF915A20000-0x00007FF915A35000-memory.dmp
memory/4236-406-0x00007FF9070B0000-0x00007FF90717D000-memory.dmp
memory/4236-404-0x00007FF90FEE0000-0x00007FF90FF13000-memory.dmp
memory/4236-403-0x00007FF915780000-0x00007FF9157AB000-memory.dmp
memory/4236-402-0x00007FF9157B0000-0x00007FF91586C000-memory.dmp
memory/4236-400-0x00007FF91AC60000-0x00007FF91AC6D000-memory.dmp
memory/4236-397-0x00007FF916380000-0x00007FF916399000-memory.dmp
memory/4236-399-0x00007FF916340000-0x00007FF916376000-memory.dmp
memory/4236-398-0x00007FF91ACC0000-0x00007FF91ACCD000-memory.dmp
memory/4236-395-0x00007FF9163D0000-0x00007FF9163E9000-memory.dmp