Overview

overview

7

Static

static

3

2026-08-21...ar.exe

windows10-2004-x64

7

2026-08-21...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 01:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-21_5fba4b04a37a2f47bdd6667c878ed9a7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 66.8MB
  • Sample260821-b8ehbsha69
  • SHA256 f892e02ab1f1639249e0bddc184e817e13640b54cb89dce89801079416205462
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-21_5fba4b04a37a2f47bdd6667c878ed9a7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_5fba4b04a37a2f47bdd6667c878ed9a7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4728
    • C:\Users\Admin\AppData\Local\Temp\2026-08-21_5fba4b04a37a2f47bdd6667c878ed9a7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-21_5fba4b04a37a2f47bdd6667c878ed9a7_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:3900
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004EC
    1⤵
      PID:4912

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\VCRUNTIME140.dll
          • Size 116KB
          • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\VCRUNTIME140_1.dll
          • Size 48KB
          • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _asyncio.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\_asyncio.pyd
          • Size 69KB
          • SHA256 3b46fa8f966288ead65465468c8e300b9179f5d7b39aa25d7231ff3702ca7887
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\_bz2.pyd
          • Size 83KB
          • SHA256 cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cffi_backend.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\_cffi_backend.cp312-win_amd64.pyd
          • Size 175KB
          • SHA256 86f136553ba301c70e7bada8416b77eb4a07f76ccb02f7d73c2999a38fa5fa5b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\_ctypes.pyd
          • Size 122KB
          • SHA256 6c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\_hashlib.pyd
          • Size 64KB
          • SHA256 43acecdc00dd5f9a19b48ff251106c63c975c732b9a2a7b91714642f76be074d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\_lzma.pyd
          • Size 156KB
          • SHA256 a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _overlapped.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\_overlapped.pyd
          • Size 54KB
          • SHA256 2187281a097025c03991cd8eb2c9ca416278b898bd640a8732421b91ada607e8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\_queue.pyd
          • Size 31KB
          • SHA256 0a6acfd24dfbaa777460c6d003f71af473d5415607807973a382512f77d075fa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\_socket.pyd
          • Size 81KB
          • SHA256 67aca001d36f2fce6d88dbf46863f60c0b291395b6777c22b642198f98184ba3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libportaudio64bit.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\_sounddevice_data\portaudio-binaries\libportaudio64bit.dll
          • Size 299KB
          • SHA256 433b77811ed6a2509cd15d9af826335c458cd0ef5f424b02b97597c74e170462
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\_ssl.pyd
          • Size 174KB
          • SHA256 fa5e6fe9545f83704f78316e27446a0026fbebb9c0c3c63faed73a12d89784d4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _uuid.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\_uuid.pyd
          • Size 25KB
          • SHA256 8ae23bfa84ce64c3240c61bedb06172bfd76be2ad30788d4499cb24047fce09f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _wmi.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\_wmi.pyd
          • Size 36KB
          • SHA256 73b7ee3156ef63d6eb7df9900ef3d200a276df61a70d08bd96f5906c39a3ac32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _helpers.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\aiohttp\_helpers.cp312-win_amd64.pyd
          • Size 51KB
          • SHA256 767cbef142e5e39c760c6f133cdadb39bd103d614ac2770023c4dac24271983e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _http_parser.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\aiohttp\_http_parser.cp312-win_amd64.pyd
          • Size 257KB
          • SHA256 17cd604b21acd9b07b26ec7a40303eed5c6a566d4abc0188d2ec00ab58b48638
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _http_writer.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\aiohttp\_http_writer.cp312-win_amd64.pyd
          • Size 49KB
          • SHA256 ab2e84a94cd5009292216a8d4497ee04a5fd9cb1caa824833e573cce664f1ff7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _websocket.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\aiohttp\_websocket.cp312-win_amd64.pyd
          • Size 36KB
          • SHA256 95f09d24ea5b708845dd324f5560475e08349d25b69f711047297f806911bda5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\base_library.zip
          • Size 1.3MB
          • SHA256 f36454a982f5665d4e7fcc69ee81146965358fcb7f5d59f2cd8861ca89c66efa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _frozenlist.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\frozenlist\_frozenlist.cp312-win_amd64.pyd
          • Size 85KB
          • SHA256 8be6e6cc104018c0dc1ae0694330f44b94fabb6c50eec086373ddf24117d78a7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\libcrypto-3.dll
          • Size 5.0MB
          • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\libffi-8.dll
          • Size 38KB
          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\libssl-3.dll
          • Size 774KB
          • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multidict.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\multidict\_multidict.cp312-win_amd64.pyd
          • Size 45KB
          • SHA256 b521b7e3b6bed424a0719c36735bc4bf2bb8b0926370b31c221c604e81f8d78b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _helpers_c.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\propcache\_helpers_c.cp312-win_amd64.pyd
          • Size 73KB
          • SHA256 c8c7c9259a47961321b6d913b3cb70215a37b9cff1dbde9e9cbc3250c1b5ad77
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\pyexpat.pyd
          • Size 197KB
          • SHA256 d32d7722d6ed2b2780c039d63af044554c0ba9cf6e6efef28ebc79cb443d2da0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python3.DLL
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\python3.DLL
          • Size 66KB
          • SHA256 25a39e721c26e53bec292395d093211bba70465280acfa2059fa52957ec975b2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python312.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\python312.dll
          • Size 6.6MB
          • SHA256 c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\select.pyd
          • Size 30KB
          • SHA256 00bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Lorem ipsum.txt
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
          • Size 1KB
          • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\unicodedata.pyd
          • Size 1.1MB
          • SHA256 bf669344d1b1c607d10304be47d2a2fb572e043109181e2c5c1038485af0c3d7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _quoting_c.cp312-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI47282\yarl\_quoting_c.cp312-win_amd64.pyd
          • Size 95KB
          • SHA256 7ddfe201d613b2a048768040a9cf4be7b7c1dcd0555cbde00f0cc99496c3ef7f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download