8d374bc3c865f0a084ae4e5cab74c8ab732dd440ab60bc34e8f575fb712c9cee

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 02:09

Target
2026-08-22_b390f313001995de3c984fe140efd056_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 883KB
Sample260823-ck8a6sdn2t
SHA256 8d374bc3c865f0a084ae4e5cab74c8ab732dd440ab60bc34e8f575fb712c9cee
MD5 b390f313001995de3c984fe140efd056
SHA1 04f86a2874be2d0d4c70d1158518a9e7e46da7bd
SHA512 259bc53d809b3dab650c2e58fedc94b3a39f9dd03ac3b914b6a9ba884a184ba22c5ca7c1ca49b865c799a6dfb65cff0477c2eadb7304c377db9b38d4c09c16db
SSDEEP 12288:NDTNUNcCtUf0MI9gAjef4F6GUqaAqQ9QOkBF/9rtoPCH0S2vpfj8flmDxcTgEE1H:d2Yf0MI5x1QOkBFhy40S2
TLSH
T1BD156C16E66400BCE0B7C6B4CE665D43D771B84B03706ADB07D06AA63F277E45A3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-22_b390f313001995de3c984fe140efd056_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-22_b390f313001995de3c984fe140efd056_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 6180	1128	2026-08-22_b390f313001995de3c984fe140efd056_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 1128 wrote to memory of 6180	1128	2026-08-22_b390f313001995de3c984fe140efd056_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 1128 wrote to memory of 2916	1128	2026-08-22_b390f313001995de3c984fe140efd056_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	92
PID 1128 wrote to memory of 2916	1128	2026-08-22_b390f313001995de3c984fe140efd056_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	92
PID 1128 wrote to memory of 5316	1128	2026-08-22_b390f313001995de3c984fe140efd056_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	94
PID 1128 wrote to memory of 5316	1128	2026-08-22_b390f313001995de3c984fe140efd056_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	94
PID 1128 wrote to memory of 1228	1128	2026-08-22_b390f313001995de3c984fe140efd056_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	95
PID 1128 wrote to memory of 1228	1128	2026-08-22_b390f313001995de3c984fe140efd056_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-08-22_b390f313001995de3c984fe140efd056_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_b390f313001995de3c984fe140efd056_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:6180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3264