Overview

overview

7

Static

static

3

2026-08-31...ar.exe

windows10-2004-x64

7

2026-08-31...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/08/2026, 18:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-31_7015254b2fcb6abbfbf211882da599d9_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 41.5MB
  • Sample260831-xdncmsab42
  • SHA256 4e69ed0ec8eb64688370183d758d15a5cc82fcf336a8cfe58e241f23ffb6930b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 32 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-31_7015254b2fcb6abbfbf211882da599d9_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-31_7015254b2fcb6abbfbf211882da599d9_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5220
    • C:\Users\Admin\AppData\Local\Temp\onefile_5220_134326754765791529\iidgkrdogbwu.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-31_7015254b2fcb6abbfbf211882da599d9_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:1884

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
        • Size 123KB
        • SHA256 c1e3e9548243ca523f1941990477723f57a1052965fccc8f10c2cfae414a6b8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_decimal.pyd
        • Size 265KB
        • SHA256 17f43bf9552fcf8194f4b32909beffa4238b76866f7dd50f4b70de799362f66c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_queue.pyd
        • Size 28KB
        • SHA256 a7cdedaa58c7ba9aba98193fce599598d2cd35ed9c80d1ad7fc9e6182c9a25d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
        • Size 78KB
        • SHA256 09ab789238120df329956278f68a683210692c9bcccb8cd548c771e7f9711869
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        opencv_videoio_ffmpeg490_64.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\cv2\opencv_videoio_ffmpeg490_64.dll
        • Size 25.1MB
        • SHA256 969a3219854b6b654a7e5a89ccdb87f3cc143af5e43858eea0ad9275237ea406
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _dearpygui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\dearpygui\_dearpygui.pyd
        • Size 3.7MB
        • SHA256 123c36fd293f077da424e91d902969f85b6967c399def86dd55475007ee2716b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-1_1.dll
        • Size 3.2MB
        • SHA256 594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy.libs\libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll
        • Size 36.4MB
        • SHA256 57b87772bf676b5c2d718c79dddc9f039d79ec3319fee1398cc305adff7b69e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiarray_tests.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy\core\_multiarray_tests.pyd
        • Size 63KB
        • SHA256 7dff04e2a5bf5ea15535b897db792bf3b7ad1591fea919c15b4e9dbd4c5f67c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiarray_umath.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy\core\_multiarray_umath.pyd
        • Size 2.7MB
        • SHA256 174fa7b850775f0224764bb754d4c0ca5515885480aac14a08a2ea8c305aac16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _pocketfft_internal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy\fft\_pocketfft_internal.pyd
        • Size 107KB
        • SHA256 2f2049f9ee05aecdfc59be6ef059c5f97b2b6bdebe5e27fdd431ad67f788d8d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _umath_linalg.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy\linalg\_umath_linalg.pyd
        • Size 104KB
        • SHA256 3327e82005d1259bbece28122c75a4e83bb508ee0cd62114adc285f21ae89365
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _generator.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy\random\_generator.pyd
        • Size 678KB
        • SHA256 99f57f0ec077f5cf3aef47aa2ef5291964f74be5d73851f63c7fd15b87c31cbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _mt19937.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy\random\_mt19937.pyd
        • Size 75KB
        • SHA256 b7b81ef1df9952651c3473fd7d640d79b0524192050ae9bb8e2ab71e8eed3212
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        bit_generator.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy\random\bit_generator.pyd
        • Size 160KB
        • SHA256 8b7b29f63f051f93ab7be369e7fd22cab1385e3aaa83d7beb3267df4f39154ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        mtrand.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy\random\mtrand.pyd
        • Size 583KB
        • SHA256 f2206738b19668bc5718d0e684890ab9a6d420aac35d5c784d4cc35a6d520493
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pywintypes39.dll
        • Size 131KB
        • SHA256 20bde8e50e42f7aabf59106eea238fcc0dece0c6e362c0a7feeb004ab981db8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd
        • Size 27KB
        • SHA256 b26b6631d433af5d63b8e7cda221b578e7236c8b34b3cffcf7630f2e83fc8434
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32gui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32gui.pyd
        • Size 212KB
        • SHA256 8fe4d4e5b7ecdc791f54f009e17c516d43bc6abd4cd3a3108a6a1f29768ac8fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5220_134326754765791529\VCRUNTIME140.dll
        • Size 91KB
        • SHA256 8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5220_134326754765791529\_hashlib.pyd
        • Size 64KB
        • SHA256 8aa7abe0a92a89adf821e4eb783ad254a19858e62d99f80eb5872d81e8b3541c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        iidgkrdogbwu.exe
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5220_134326754765791529\iidgkrdogbwu.exe
        • Size 20.0MB
        • SHA256 269d7190d27015b6eb3d596d7e4eca68329122d320809b899aa4c3ab04885d50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bounded_integers.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5220_134326754765791529\numpy\random\_bounded_integers.pyd
        • Size 251KB
        • SHA256 1d5c98f95abc2c87533237b1200e14539b7c5d8f1bf90870c15cfc00d51097ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _common.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5220_134326754765791529\numpy\random\_common.pyd
        • Size 170KB
        • SHA256 48bf0e11f32dc18d4ae4bba02f952a21a167573326ae6da1a87dddd9349ec86c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _pcg64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5220_134326754765791529\numpy\random\_pcg64.pyd
        • Size 82KB
        • SHA256 c67705d6d3843a3656a8cd6eedac62c2b4209d3f801a92f3b2b5000a75600b8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _philox.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5220_134326754765791529\numpy\random\_philox.pyd
        • Size 69KB
        • SHA256 73e35656e4e26137f771fddadb1b7a806fa8399bfa8abb66b63e1a9ede809d18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sfc64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5220_134326754765791529\numpy\random\_sfc64.pyd
        • Size 50KB
        • SHA256 5f778438d9bfc32b4ad3cb0ef7182af098504a081aa5e17db077cf424dae8d42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5220_134326754765791529\python3.DLL
        • Size 58KB
        • SHA256 e9e4a9b271b692c331dc091825ac1ff51b01cd159f2e5c2553756c79ff272fa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python39.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5220_134326754765791529\python39.dll
        • Size 4.2MB
        • SHA256 53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_5220_134326754765791529\vcruntime140_1.dll
        • Size 35KB
        • SHA256 f8bc270449ca6bb6345e88be3632d465c0a7595197c7954357dc5066ed50ae44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1884-105-0x00000216DD150000-0x00000216DF206000-memory.dmp
        Download