Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 17:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
General
- Target 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 3.2MB
- Sample260831-vs3d1axcnd
- SHA256 6722ec1d989b1ca27f90a7e452df7b497515ba2486a46148d1920c0fb8d4aa28
- MD5 8ee6389592dd6e136e3bcfa42682e2e1
- SHA1 e82f37cb1fa1d7cb165b43b4a6c5d2949ca168d0
- SHA512 cbe1d844cfdc9b364ff3f2ee273948a9e3ae4ac2bbef7907e80ec6367d4f83f608c1da93fb67f3942184d3fc8bba6c3b4728b8c375ea56eae98720d36aca3d2c
- SSDEEP 49152:WCxNI5Ruvdoogy6gebfHcQnOswgjlPBqKP1x1yeTQjDkdWj6Zk20NosWSP3gLa+:S31xuD8RvZ
- TLSH T1E5F57D03A2E740E9D4B7C2B48667C522EA713C5517369BFF01A0D5692FB3EE18E39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeIncBasePriorityPrivilege 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe Token: 33 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeLoadDriverPrivilege 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeProfSingleProcessPrivilege 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeBackupPrivilege 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeRestorePrivilege 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeShutdownPrivilege 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeTakeOwnershipPrivilege 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe Token: SeSecurityPrivilege 3396 2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-31_8ee6389592dd6e136e3bcfa42682e2e1_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396