Overview

overview

7

Static

static

3

2026-08-28...ar.exe

windows10-2004-x64

7

2026-08-28...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/08/2026, 16:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-28_5c28848839fdd9d876a5b7ecac1bc51a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 34.1MB
  • Sample260828-thttfadf32
  • SHA256 867b24ed6142d43a0c43fa9332cf8c18611b240c9b62170e9684a111207fb169
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-28_5c28848839fdd9d876a5b7ecac1bc51a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-28_5c28848839fdd9d876a5b7ecac1bc51a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Users\Admin\AppData\Local\Temp\2026-08-28_5c28848839fdd9d876a5b7ecac1bc51a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-28_5c28848839fdd9d876a5b7ecac1bc51a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:4924

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\_asyncio.pyd
        • Size 69KB
        • SHA256 3b46fa8f966288ead65465468c8e300b9179f5d7b39aa25d7231ff3702ca7887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\_bz2.pyd
        • Size 83KB
        • SHA256 cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\_cffi_backend.cp312-win_amd64.pyd
        • Size 175KB
        • SHA256 86f136553ba301c70e7bada8416b77eb4a07f76ccb02f7d73c2999a38fa5fa5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\_ctypes.pyd
        • Size 122KB
        • SHA256 6c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\_hashlib.pyd
        • Size 64KB
        • SHA256 43acecdc00dd5f9a19b48ff251106c63c975c732b9a2a7b91714642f76be074d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\_lzma.pyd
        • Size 156KB
        • SHA256 a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\_overlapped.pyd
        • Size 54KB
        • SHA256 2187281a097025c03991cd8eb2c9ca416278b898bd640a8732421b91ada607e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\_queue.pyd
        • Size 31KB
        • SHA256 0a6acfd24dfbaa777460c6d003f71af473d5415607807973a382512f77d075fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\_socket.pyd
        • Size 81KB
        • SHA256 67aca001d36f2fce6d88dbf46863f60c0b291395b6777c22b642198f98184ba3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\_ssl.pyd
        • Size 174KB
        • SHA256 fa5e6fe9545f83704f78316e27446a0026fbebb9c0c3c63faed73a12d89784d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\_uuid.pyd
        • Size 25KB
        • SHA256 8ae23bfa84ce64c3240c61bedb06172bfd76be2ad30788d4499cb24047fce09f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\_wmi.pyd
        • Size 36KB
        • SHA256 73b7ee3156ef63d6eb7df9900ef3d200a276df61a70d08bd96f5906c39a3ac32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _helpers.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\aiohttp\_helpers.cp312-win_amd64.pyd
        • Size 54KB
        • SHA256 ee325848cf143df67c63153bbafd9e72e33f0b57e025079875a2a7b0cb919792
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_parser.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\aiohttp\_http_parser.cp312-win_amd64.pyd
        • Size 259KB
        • SHA256 cf70c494ec7087114a84412b8bd4e9ee7f60a2716df8d73252bf56b24a72fd9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _http_writer.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\aiohttp\_http_writer.cp312-win_amd64.pyd
        • Size 49KB
        • SHA256 8a13b94b85d917d25cb8a6ea5d99cc82a39e9dd1618cb71e6a9219aadb76c5c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _websocket.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\aiohttp\_websocket.cp312-win_amd64.pyd
        • Size 36KB
        • SHA256 6c9338d5fe59ed8721209fd58c6caf7eb38f8695f1448914664e63e489d63958
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\base_library.zip
        • Size 1.3MB
        • SHA256 5917fec725cd012df8449911c7d96610fe211f4b875e2c77929a1d4409a84a3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _frozenlist.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\frozenlist\_frozenlist.cp312-win_amd64.pyd
        • Size 84KB
        • SHA256 886375bc6f0ff2bbd1e8280f8f1cb29c93f94b8e25b5076043cd796654c3a193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multidict.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\multidict\_multidict.cp312-win_amd64.pyd
        • Size 45KB
        • SHA256 1ef9e6eaff88cdcc0a32346b7b266a0e1d19716ecac07f16a189a7057ce971f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sodium.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\nacl\_sodium.pyd
        • Size 340KB
        • SHA256 d733c23c6a4b21625a4ff07f6562ba882bcbdb0f50826269419d8de0574f88cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\pyexpat.pyd
        • Size 197KB
        • SHA256 d32d7722d6ed2b2780c039d63af044554c0ba9cf6e6efef28ebc79cb443d2da0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\python3.DLL
        • Size 66KB
        • SHA256 25a39e721c26e53bec292395d093211bba70465280acfa2059fa52957ec975b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\python312.dll
        • Size 6.6MB
        • SHA256 c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\select.pyd
        • Size 30KB
        • SHA256 00bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        INSTALLER
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\setuptools\_vendor\importlib_resources-6.4.0.dist-info\INSTALLER
        • Size 4B
        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
        • MD5 SHA1 SHA512
        Submit Download

        LICENSE
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\setuptools\_vendor\jaraco.text-3.12.1.dist-info\LICENSE
        • Size 1023B
        • SHA256 86da0f01aeae46348a3c3d465195dc1ceccde79f79e87769a64b8da04b2a4741
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        WHEEL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\setuptools\_vendor\jaraco.text-3.12.1.dist-info\WHEEL
        • Size 92B
        • SHA256 189eedfe4581172c1b6a02b97a8f48a14c0b5baa3239e4ca990fbd8871553714
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\ucrtbase.dll
        • Size 992KB
        • SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\unicodedata.pyd
        • Size 1.1MB
        • SHA256 bf669344d1b1c607d10304be47d2a2fb572e043109181e2c5c1038485af0c3d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _quoting_c.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI16402\yarl\_quoting_c.cp312-win_amd64.pyd
        • Size 94KB
        • SHA256 f306e375e186c011585dea2bc875530fb7d734861db388764a2aa307b1b68df3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4924-1251-0x00007FFDCBAF0000-0x00007FFDCCE4D000-memory.dmp
        Download