91f877ff15f4c54195902d4da85fd728162a9f7db92b76ecf32a5e70894278bb

Analysis

max time kernel
150s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 08:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_c11f0fb84d3b40394777614d2ab67d37_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 18.1MB
Sample260820-jx31jsgp3x
SHA256 91f877ff15f4c54195902d4da85fd728162a9f7db92b76ecf32a5e70894278bb
MD5 c11f0fb84d3b40394777614d2ab67d37
SHA1 b42f5f6bea247e76935de7ea43193d9b500e943c
SHA512 c68161b253f8779e99381a564b316f249b8435333b91fb261f4901ebe7d275838d106c75def61fce6bd2cfbccdeff50362506b6f54328e4969590e54e4eab346
SSDEEP 393216:+ojf1xkPzKwN9s0nDN97l0vX7mCoBmvXbqOf7RkkPxzqWAc1i9TnXfCp76weI5bI:YeXbqFjUQTXKpW+V1g
TLSH
T15017F10BB2E408D8E277D37CC6A2DA17E67238050F3099DB16E165592F77AD05B3BB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
612	cmd.exe
4600	cmd.exe
3256	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3736	timeout.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5748 wrote to memory of 3256	5748	2026-08-20_c11f0fb84d3b40394777614d2ab67d37_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	89
PID 3256 wrote to memory of 700	3256	cmd.exe	91
PID 3256 wrote to memory of 6104	3256	cmd.exe	92
PID 3256 wrote to memory of 4128	3256	cmd.exe	93
PID 5748 wrote to memory of 612	5748	2026-08-20_c11f0fb84d3b40394777614d2ab67d37_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	95
PID 612 wrote to memory of 4600	612	cmd.exe	97
PID 4600 wrote to memory of 3736	4600	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-20_c11f0fb84d3b40394777614d2ab67d37_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_c11f0fb84d3b40394777614d2ab67d37_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5748
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\2026-08-20_c11f0fb84d3b40394777614d2ab67d37_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\2026-08-20_c11f0fb84d3b40394777614d2ab67d37_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe" MD5
    3⤵
    PID:700
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:6104
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:4128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo You need to run the KeyAuthApp.init(); function before any other KeyAuth functions && timeout /t 5"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:3736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads