Overview

overview

7

Static

static

3

2026-08-23...ar.exe

windows10-2004-x64

7

2026-08-23...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/08/2026, 04:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-23_9bbab78e73f6badd910da41f9699af96_cobalt-strike_glassworm_icedid_lazagne_luca-stealer_njrat_satacom_vidar.exe
  • Size 64.6MB
  • Sample260824-el8dnsca65
  • SHA256 89b639c5a0a077c5a08210364be4c44f1785733b5a3e8a5a3443f2b1e3135ced
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 60 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-23_9bbab78e73f6badd910da41f9699af96_cobalt-strike_glassworm_icedid_lazagne_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-23_9bbab78e73f6badd910da41f9699af96_cobalt-strike_glassworm_icedid_lazagne_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Users\Admin\AppData\Local\Temp\2026-08-23_9bbab78e73f6badd910da41f9699af96_cobalt-strike_glassworm_icedid_lazagne_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-23_9bbab78e73f6badd910da41f9699af96_cobalt-strike_glassworm_icedid_lazagne_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:708
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:2588

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _imaging.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\PIL\_imaging.cp311-win_amd64.pyd
        • Size 2.3MB
        • SHA256 ae78de3d4beb277ae0d4572b94ff2699283e5935f54ebb71b377073fe480b56f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\VCRUNTIME140.dll
        • Size 106KB
        • SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_asyncio.pyd
        • Size 63KB
        • SHA256 8ec1af6be27a49e3dc70075d0b5ef9255fad52cbbdab6a5072080085b4e45e89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_bz2.pyd
        • Size 82KB
        • SHA256 50e21ce62f8d9bab92f6a7e9b39a86406c32d2df18408bb52ffb3d245c644c7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_ctypes.pyd
        • Size 120KB
        • SHA256 b59e103f8ec6c1190ded21eef27bea01579220909c3968eeec37d46d2ed39e80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_hashlib.pyd
        • Size 63KB
        • SHA256 19dd3b5ebb840885543974a4cb6c8ea4539d76e3672be0f390a3a82443391778
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_lzma.pyd
        • Size 155KB
        • SHA256 ab822f7e846d4388b6f435d788a028942096ba1344297e0b7005c9d50814981b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_overlapped.pyd
        • Size 49KB
        • SHA256 ca131fc4a8c77daff8cff1b7e743b564745f6d2b4f9bb371b1286eb383c0692e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_queue.pyd
        • Size 31KB
        • SHA256 9517689d7d97816dee9e6c01ffd35844a3af6cde3ff98f3a709d52157b1abe03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_socket.pyd
        • Size 77KB
        • SHA256 e05c5342d55cb452e88e041061faba492d6dd9268a7f67614a8143540aca2bfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\_ssl.pyd
        • Size 157KB
        • SHA256 3bac94d8713a143095ef8e2f5d2b4a3765ebc530c8ca051080d415198cecf380
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\base_library.zip
        • Size 1.7MB
        • SHA256 94ac418152a76c05735e722cd6ac37c08b2fd2d76844d67e239edfb2159b6850
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        __init__.py
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\cv2\__init__.py
        • Size 6KB
        • SHA256 8fb8564fded89056f8f393d2f1e2ae71a2f6e109cda78f20e422b81819ec64f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 eb975c94e5f4292edd9a8207e356fe4ea0c66e802c1e9305323d37185f85ad6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\libffi-8.dll
        • Size 37KB
        • SHA256 68fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libopenblas.FB5AE2TYXYH2IJRDKGDGQ3XBKLKTF43H.gfortran-win_amd64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\libopenblas.FB5AE2TYXYH2IJRDKGDGQ3XBKLKTF43H.gfortran-win_amd64.dll
        • Size 34.0MB
        • SHA256 b863f35d267fd95c74ca502ac85977f00ebc3effa3373da7ff47b1eac08192d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\libssl-1_1.dll
        • Size 686KB
        • SHA256 d98dd943517963fd0e790fde00965822aa4e4a48e8a479afad74abf14a300771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiarray_tests.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\numpy\core\_multiarray_tests.cp311-win_amd64.pyd
        • Size 64KB
        • SHA256 71e9776c8f4668544c03601b3a08aba9ad297bc6984b99b34cbd36883684e84c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiarray_umath.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\numpy\core\_multiarray_umath.cp311-win_amd64.pyd
        • Size 2.6MB
        • SHA256 2e297899c2197371ed50265da941357618c6162a2f0364917e5e53910bf4aca9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _pocketfft_internal.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\numpy\fft\_pocketfft_internal.cp311-win_amd64.pyd
        • Size 108KB
        • SHA256 13c3bc8dbf89949b6bcf3745bc73ae66696660ea7823293376e28852ddfa2049
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _umath_linalg.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\numpy\linalg\_umath_linalg.cp311-win_amd64.pyd
        • Size 100KB
        • SHA256 1c0a4eca4646f1b1bb4073f53b983ab897dd2cbe023cbf1ea90ae2f3ae741a02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bounded_integers.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\numpy\random\_bounded_integers.cp311-win_amd64.pyd
        • Size 206KB
        • SHA256 c08fabb006a0d4e0ba5f97cff1bc002de92216461ccb167f985777dc9e633a1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _common.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\numpy\random\_common.cp311-win_amd64.pyd
        • Size 152KB
        • SHA256 6ce7f5a6d1685aaaea21c18bf28da21de23b9f72b3361a953b83c71fe0efd628
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bit_generator.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\numpy\random\bit_generator.cp311-win_amd64.pyd
        • Size 131KB
        • SHA256 6cb54d242e46b48ffeb92bedf07762c10a0ead29a61d011bc0a3281ea4935456
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mtrand.cp311-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\numpy\random\mtrand.cp311-win_amd64.pyd
        • Size 528KB
        • SHA256 dcbdaf0fc2a9bec22fe2c8b6f23cada9e788f8f8ef9a149fe24f20403e4bf144
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\pyexpat.pyd
        • Size 194KB
        • SHA256 3d81d06311a8a15967533491783ea9c7fc88d594f40eee64076723cebdd58928
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\python3.DLL
        • Size 65KB
        • SHA256 852b901e17022c437f8fc3039a5af2ee80c5d509c9ef5f512041af17c48fcd61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\python311.dll
        • Size 5.5MB
        • SHA256 0a9f2c98f36ba8974a944127b5b7e90e638010e472f2eb6598fc55b1bda9e7ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pythoncom311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\pywin32_system32\pythoncom311.dll
        • Size 675KB
        • SHA256 9111856645f779f137c46d78a68374292fc512a2a4038466476bb9c6024097b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\pywin32_system32\pywintypes311.dll
        • Size 134KB
        • SHA256 6583c15de0f5a1b20c8750b0599e5cf162f91f239f8341bda842485d8bbc9887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\select.pyd
        • Size 29KB
        • SHA256 b5d4d5b6da675376bd3b2824d9cda957b55fe3d8596d5675381922ef0e64a0f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI49002\win32api.pyd
        • Size 136KB
        • SHA256 bf5147f4fffbffa77d9169b65af13d983e2fcccdbca8151d72814c55939bb2c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/708-185-0x000000006ED80000-0x0000000070C08000-memory.dmp
        Download