Analysis
- max time kernel
148s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/08/2026, 04:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
- Size 1.4MB
- Sample260823-e1epxaxvh1
- SHA256 d0e27483216a7d895159b52e74eb4b127b57384ba05decfd33e4ad7e6f23bfaf
- MD5 97f66c14de62a53f8f899db144f0eaec
- SHA1 6891369585a5b54028c43ae444e48ed047e8dd0b
- SHA512 a79cca38811b6e7cdd8d182fde011756b1ec5f9f29ba68e68f3c3e68ce2dc8d4c7cf264d49d732e6b5b83aa89d1c45d6fc656cba5333ec416c5fe5d934b80641
- SSDEEP 24576:XrxobeKT11YOTVVddBrXrqy7y10RUL32aGiAJrayRKxh0lhSMXle2ugy0+O93l0x:OZT1Zrd7X60UL32aGiAJrayRKYPz+O9i
- TLSH T16365AE17A7A414F9C17BC138C6574A17E7B2781903219BEF13D09AA92F23AD16F3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org 1 api.ipify.org - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3324 cmd.exe 120 cmd.exe 6092 cmd.exe - Delays execution with timeout.exe 1 IoCs
pid Process 4512 timeout.exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 3348 wmic.exe 3348 wmic.exe 3348 wmic.exe 3348 wmic.exe 1212 wmic.exe 1212 wmic.exe 1212 wmic.exe 1212 wmic.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3348 wmic.exe Token: SeSecurityPrivilege 3348 wmic.exe Token: SeTakeOwnershipPrivilege 3348 wmic.exe Token: SeLoadDriverPrivilege 3348 wmic.exe Token: SeSystemProfilePrivilege 3348 wmic.exe Token: SeSystemtimePrivilege 3348 wmic.exe Token: SeProfSingleProcessPrivilege 3348 wmic.exe Token: SeIncBasePriorityPrivilege 3348 wmic.exe Token: SeCreatePagefilePrivilege 3348 wmic.exe Token: SeBackupPrivilege 3348 wmic.exe Token: SeRestorePrivilege 3348 wmic.exe Token: SeShutdownPrivilege 3348 wmic.exe Token: SeDebugPrivilege 3348 wmic.exe Token: SeSystemEnvironmentPrivilege 3348 wmic.exe Token: SeRemoteShutdownPrivilege 3348 wmic.exe Token: SeUndockPrivilege 3348 wmic.exe Token: SeManageVolumePrivilege 3348 wmic.exe Token: 33 3348 wmic.exe Token: 34 3348 wmic.exe Token: 35 3348 wmic.exe Token: 36 3348 wmic.exe Token: SeIncreaseQuotaPrivilege 3348 wmic.exe Token: SeSecurityPrivilege 3348 wmic.exe Token: SeTakeOwnershipPrivilege 3348 wmic.exe Token: SeLoadDriverPrivilege 3348 wmic.exe Token: SeSystemProfilePrivilege 3348 wmic.exe Token: SeSystemtimePrivilege 3348 wmic.exe Token: SeProfSingleProcessPrivilege 3348 wmic.exe Token: SeIncBasePriorityPrivilege 3348 wmic.exe Token: SeCreatePagefilePrivilege 3348 wmic.exe Token: SeBackupPrivilege 3348 wmic.exe Token: SeRestorePrivilege 3348 wmic.exe Token: SeShutdownPrivilege 3348 wmic.exe Token: SeDebugPrivilege 3348 wmic.exe Token: SeSystemEnvironmentPrivilege 3348 wmic.exe Token: SeRemoteShutdownPrivilege 3348 wmic.exe Token: SeUndockPrivilege 3348 wmic.exe Token: SeManageVolumePrivilege 3348 wmic.exe Token: 33 3348 wmic.exe Token: 34 3348 wmic.exe Token: 35 3348 wmic.exe Token: 36 3348 wmic.exe Token: SeIncreaseQuotaPrivilege 1212 wmic.exe Token: SeSecurityPrivilege 1212 wmic.exe Token: SeTakeOwnershipPrivilege 1212 wmic.exe Token: SeLoadDriverPrivilege 1212 wmic.exe Token: SeSystemProfilePrivilege 1212 wmic.exe Token: SeSystemtimePrivilege 1212 wmic.exe Token: SeProfSingleProcessPrivilege 1212 wmic.exe Token: SeIncBasePriorityPrivilege 1212 wmic.exe Token: SeCreatePagefilePrivilege 1212 wmic.exe Token: SeBackupPrivilege 1212 wmic.exe Token: SeRestorePrivilege 1212 wmic.exe Token: SeShutdownPrivilege 1212 wmic.exe Token: SeDebugPrivilege 1212 wmic.exe Token: SeSystemEnvironmentPrivilege 1212 wmic.exe Token: SeRemoteShutdownPrivilege 1212 wmic.exe Token: SeUndockPrivilege 1212 wmic.exe Token: SeManageVolumePrivilege 1212 wmic.exe Token: 33 1212 wmic.exe Token: 34 1212 wmic.exe Token: 35 1212 wmic.exe Token: 36 1212 wmic.exe Token: SeIncreaseQuotaPrivilege 1212 wmic.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2924 wrote to memory of 3348 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 89 PID 2924 wrote to memory of 1212 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 94 PID 2924 wrote to memory of 3324 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 97 PID 3324 wrote to memory of 1808 3324 cmd.exe 98 PID 3324 wrote to memory of 4452 3324 cmd.exe 99 PID 3324 wrote to memory of 2052 3324 cmd.exe 100 PID 2924 wrote to memory of 120 2924 2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe 101 PID 120 wrote to memory of 6092 120 cmd.exe 102 PID 6092 wrote to memory of 4512 6092 cmd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3348
-
-
C:\Windows\System32\Wbem\wmic.exewmic PATH Win32_VideoController GET PNPDeviceID2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1212
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\2026-08-22_97f66c14de62a53f8f899db144f0eaec_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe" MD53⤵PID:1808
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:4452
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:2052
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo CURL Error: SSL connect error && timeout /t 5"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:120 -
C:\Windows\system32\cmd.execmd /C "color b && title Error && echo CURL Error: SSL connect error && timeout /t 5"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6092 -
C:\Windows\system32\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
PID:4512
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5704