Overview

overview

7

Static

static

3

2026-08-22...ar.exe

windows10-2004-x64

7

2026-08-22...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/08/2026, 05:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-22_8b291df140d9f2cda8652a354a00e254_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 12.3MB
  • Sample260823-fxp7xashpd
  • SHA256 97409e24a9fd8921037ca6a19c466753ea9c7f63381d51ab1e927b7583d0c1fc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 20 IoCs
  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-22_8b291df140d9f2cda8652a354a00e254_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-22_8b291df140d9f2cda8652a354a00e254_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:476
    • C:\Users\Admin\AppData\Local\Temp\2026-08-22_8b291df140d9f2cda8652a354a00e254_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-22_8b291df140d9f2cda8652a354a00e254_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      PID:2496

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\_bz2.pyd
        • Size 83KB
        • SHA256 55894b2b98d01f37b9a8cf4daf926d0161ff23c2fb31c56f9dbbac3a61932712
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\_ctypes.pyd
        • Size 129KB
        • SHA256 5c4c489ac052795c27af063c96bc4db5ab250144d4839050cfa9bb3836b87c32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\_hashlib.pyd
        • Size 63KB
        • SHA256 78223aef72777efc93c739f5308a3fc5de28b7d10e6975b8947552a62592772b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\_lzma.pyd
        • Size 155KB
        • SHA256 e44dea262a24df69fd9b50b08d09ae6f8b051137ce0834640c977091a6f9fca8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\_queue.pyd
        • Size 34KB
        • SHA256 73cade82ee139459fe5841e5631274fc9caf7f579418b613f278125435653539
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\_socket.pyd
        • Size 82KB
        • SHA256 62d0493ced6ca33e2fd8141649dd9889c23b2e9afc5fdf56edb4f888c88fb823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\_ssl.pyd
        • Size 178KB
        • SHA256 e94f0195363c5c9babfc4c17ec6fb1aa8bbabf59e377db66ce6a79c4c58bbd07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\base_library.zip
        • Size 1.3MB
        • SHA256 6e30043dfa5faf9c31bd8fb71778e8e0701275b620696d29ad274846676b7175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\certifi\cacert.pem
        • Size 292KB
        • SHA256 94edeb66e91774fcae93a05650914e29096259a5c7e871a1f65d461ab5201b47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\charset_normalizer\md.cp313-win_amd64.pyd
        • Size 10KB
        • SHA256 002697227449b6d69026d149cfb220ac85d83b13056c8aa6b9dac3fd3b76caa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.cp313-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\charset_normalizer\md__mypyc.cp313-win_amd64.pyd
        • Size 122KB
        • SHA256 c393098e7803abf08ee8f7381ad7b0f8faffbf66319c05d72823308e898f8cfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\python313.dll
        • Size 5.8MB
        • SHA256 78b1dd211c0e66a0603df48da2c9b67a915ab3258701b9285d3faa255ed8dc25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes313.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\pywin32_system32\pywintypes313.dll
        • Size 132KB
        • SHA256 d011068781cfba0955258505dbe7e5c7d3d0b955e7f7640d2f1019d425278087
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\select.pyd
        • Size 31KB
        • SHA256 81f124b01a85882e362a42e94a13c0eff2f4ccd72d461821dc5457a789554413
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\unicodedata.pyd
        • Size 695KB
        • SHA256 3f462ee6e7743a87e5791181936539642e3761c55de3de980a125f91fe21f123
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\win32\win32api.pyd
        • Size 130KB
        • SHA256 e19294bc2c145a9d87d4a2d8412830c8ff4c8c1b9ad005bd68abd4b566af1887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download