Analysis
- max time kernel
149s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
01/09/2026, 22:59
General
- Target 2026-08-31_fa6774a1f93274d18d2616d92617c14d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 25.9MB
- Sample260901-2ych4acm3x
- SHA256 f721706cd23ad07480264ecd9f915e8c9cedc2e78f1e409890b5b15e45c6aca5
Malware Config
Signatures
- Family: LunaStealer
LunaStealer is an infostealer written in Python and packaged with Pyinstaller.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Loads dropped DLL 47 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-31_fa6774a1f93274d18d2616d92617c14d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-31_fa6774a1f93274d18d2616d92617c14d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-31_fa6774a1f93274d18d2616d92617c14d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-31_fa6774a1f93274d18d2616d92617c14d_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "copy C:\Users\Admin\AppData\Local\Temp\_MEI48802\YezzyTool.py "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start-up""3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend4⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_raw_cbc.pyd
_raw_cfb.pyd
_raw_ctr.pyd
_raw_ecb.pyd
_raw_ofb.pyd
_strxor.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_wmi.pyd
base_library.zip
cacert.pem
md.cp312-win_amd64.pyd
md__mypyc.cp312-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
_psutil_windows.pyd
pyexpat.pyd
python3.DLL
python312.dll
select.pyd
sqlite3.dll
unicodedata.pyd
memory/2396-152-0x00007FFA8E250000-0x00007FFA8E286000-memory.dmp
memory/2396-347-0x00007FFA81760000-0x00007FFA8176C000-memory.dmp
memory/2396-149-0x00007FFA8E2A0000-0x00007FFA8E2AF000-memory.dmp
memory/2396-145-0x00007FFA81E10000-0x00007FFA81EDD000-memory.dmp
memory/2396-153-0x00007FFA89E90000-0x00007FFA89EA2000-memory.dmp
memory/2396-139-0x00007FFA76490000-0x00007FFA769B9000-memory.dmp
memory/2396-151-0x00007FFA89EB0000-0x00007FFA89EC6000-memory.dmp
memory/2396-134-0x00007FFA769C0000-0x00007FFA77084000-memory.dmp
memory/2396-135-0x00007FFA8A1F0000-0x00007FFA8A1FD000-memory.dmp
memory/2396-159-0x00007FFA7DCA0000-0x00007FFA7DE1F000-memory.dmp
memory/2396-158-0x00007FFA89D50000-0x00007FFA89D74000-memory.dmp
memory/2396-138-0x00007FFA8E390000-0x00007FFA8E3B5000-memory.dmp
memory/2396-162-0x00007FFA89D10000-0x00007FFA89D28000-memory.dmp
memory/2396-136-0x00007FFA89F90000-0x00007FFA89FA4000-memory.dmp
memory/2396-165-0x00007FFA89F90000-0x00007FFA89FA4000-memory.dmp
memory/2396-167-0x00007FFA89F80000-0x00007FFA89F8B000-memory.dmp
memory/2396-128-0x00007FFA8A200000-0x00007FFA8A20D000-memory.dmp
memory/2396-171-0x00007FFA81D20000-0x00007FFA81D47000-memory.dmp
memory/2396-170-0x00007FFA76490000-0x00007FFA769B9000-memory.dmp
memory/2396-126-0x00007FFA8E230000-0x00007FFA8E249000-memory.dmp
memory/2396-113-0x00007FFA8E310000-0x00007FFA8E32A000-memory.dmp
memory/2396-175-0x00007FFA7D990000-0x00007FFA7DAAB000-memory.dmp
memory/2396-174-0x00007FFA81E10000-0x00007FFA81EDD000-memory.dmp
memory/2396-173-0x00007FFA89ED0000-0x00007FFA89F03000-memory.dmp
memory/2396-213-0x00007FFA7FAC0000-0x00007FFA7FAEE000-memory.dmp
memory/2396-212-0x00007FFA7FBC0000-0x00007FFA7FBE9000-memory.dmp
memory/2396-211-0x00007FFA75FE0000-0x00007FFA76229000-memory.dmp
memory/2396-210-0x00007FFA81760000-0x00007FFA8176C000-memory.dmp
memory/2396-209-0x00007FFA81770000-0x00007FFA81782000-memory.dmp
memory/2396-208-0x00007FFA81790000-0x00007FFA8179D000-memory.dmp
memory/2396-207-0x00007FFA817A0000-0x00007FFA817AC000-memory.dmp
memory/2396-206-0x00007FFA81D00000-0x00007FFA81D0C000-memory.dmp
memory/2396-205-0x00007FFA81D10000-0x00007FFA81D1B000-memory.dmp
memory/2396-204-0x00007FFA83F40000-0x00007FFA83F4B000-memory.dmp
memory/2396-203-0x00007FFA83F50000-0x00007FFA83F5C000-memory.dmp
memory/2396-202-0x00007FFA7D990000-0x00007FFA7DAAB000-memory.dmp
memory/2396-201-0x00007FFA81D20000-0x00007FFA81D47000-memory.dmp
memory/2396-200-0x00007FFA843E0000-0x00007FFA843EE000-memory.dmp
memory/2396-199-0x00007FFA88BC0000-0x00007FFA88BCC000-memory.dmp
memory/2396-198-0x00007FFA88D30000-0x00007FFA88D3C000-memory.dmp
memory/2396-197-0x00007FFA89D10000-0x00007FFA89D28000-memory.dmp
memory/2396-196-0x00007FFA88D70000-0x00007FFA88D7B000-memory.dmp
memory/2396-195-0x00007FFA7DCA0000-0x00007FFA7DE1F000-memory.dmp
memory/2396-194-0x00007FFA88D80000-0x00007FFA88D8C000-memory.dmp
memory/2396-122-0x00007FFA8E250000-0x00007FFA8E286000-memory.dmp
memory/2396-118-0x00007FFA8E2A0000-0x00007FFA8E2AF000-memory.dmp
memory/2396-191-0x00007FFA89D50000-0x00007FFA89D74000-memory.dmp
memory/2396-190-0x00007FFA89E90000-0x00007FFA89EA2000-memory.dmp
memory/2396-189-0x00007FFA88F20000-0x00007FFA88F2B000-memory.dmp
memory/2396-188-0x00007FFA891A0000-0x00007FFA891AC000-memory.dmp
memory/2396-114-0x00007FFA8E2B0000-0x00007FFA8E2DD000-memory.dmp
memory/2396-108-0x00007FFA8E380000-0x00007FFA8E38F000-memory.dmp
memory/2396-183-0x00007FFA89D00000-0x00007FFA89D0B000-memory.dmp
memory/2396-106-0x00007FFA8E390000-0x00007FFA8E3B5000-memory.dmp
memory/2396-180-0x00007FFA89E80000-0x00007FFA89E8B000-memory.dmp
memory/2396-97-0x00007FFA769C0000-0x00007FFA77084000-memory.dmp
memory/2396-316-0x00007FFA89ED0000-0x00007FFA89F03000-memory.dmp
memory/2396-304-0x00007FFA769C0000-0x00007FFA77084000-memory.dmp
memory/2396-318-0x00007FFA89EB0000-0x00007FFA89EC6000-memory.dmp
memory/2396-319-0x00007FFA89E90000-0x00007FFA89EA2000-memory.dmp
memory/2396-320-0x00007FFA89D50000-0x00007FFA89D74000-memory.dmp
memory/2396-322-0x00007FFA89D10000-0x00007FFA89D28000-memory.dmp
memory/2396-323-0x00007FFA89F80000-0x00007FFA89F8B000-memory.dmp
memory/2396-324-0x00007FFA81D20000-0x00007FFA81D47000-memory.dmp
memory/2396-326-0x00007FFA89E80000-0x00007FFA89E8B000-memory.dmp
memory/2396-327-0x00007FFA89D00000-0x00007FFA89D0B000-memory.dmp
memory/2396-328-0x00007FFA891A0000-0x00007FFA891AC000-memory.dmp
memory/2396-329-0x00007FFA88F20000-0x00007FFA88F2B000-memory.dmp
memory/2396-330-0x00007FFA88D80000-0x00007FFA88D8C000-memory.dmp
memory/2396-331-0x00007FFA88D70000-0x00007FFA88D7B000-memory.dmp
memory/2396-332-0x00007FFA8E2B0000-0x00007FFA8E2DD000-memory.dmp
memory/2396-333-0x00007FFA8E380000-0x00007FFA8E38F000-memory.dmp
memory/2396-334-0x00007FFA8E310000-0x00007FFA8E32A000-memory.dmp
memory/2396-335-0x00007FFA89F90000-0x00007FFA89FA4000-memory.dmp
memory/2396-253-0x00007FFA81E10000-0x00007FFA81EDD000-memory.dmp
memory/2396-251-0x00007FFA76490000-0x00007FFA769B9000-memory.dmp
memory/2396-240-0x00007FFA769C0000-0x00007FFA77084000-memory.dmp
memory/2396-241-0x00007FFA8E390000-0x00007FFA8E3B5000-memory.dmp
memory/2396-273-0x00007FFA75FE0000-0x00007FFA76229000-memory.dmp
memory/2396-274-0x00007FFA7FBC0000-0x00007FFA7FBE9000-memory.dmp
memory/2396-303-0x00007FFA7FAC0000-0x00007FFA7FAEE000-memory.dmp
memory/2396-275-0x00007FFA769C0000-0x00007FFA77084000-memory.dmp
memory/2396-311-0x00007FFA8E230000-0x00007FFA8E249000-memory.dmp
memory/2396-305-0x00007FFA8E390000-0x00007FFA8E3B5000-memory.dmp
memory/2396-313-0x00007FFA8A1F0000-0x00007FFA8A1FD000-memory.dmp
memory/2396-312-0x00007FFA8A200000-0x00007FFA8A20D000-memory.dmp
memory/2396-310-0x00007FFA8E250000-0x00007FFA8E286000-memory.dmp
memory/2396-317-0x00007FFA81E10000-0x00007FFA81EDD000-memory.dmp
memory/2396-350-0x00007FFA7FAC0000-0x00007FFA7FAEE000-memory.dmp
memory/2396-349-0x00007FFA7FBC0000-0x00007FFA7FBE9000-memory.dmp
memory/2396-348-0x00007FFA75FE0000-0x00007FFA76229000-memory.dmp
memory/2396-144-0x00007FFA89ED0000-0x00007FFA89F03000-memory.dmp
memory/2396-346-0x00007FFA81770000-0x00007FFA81782000-memory.dmp
memory/2396-345-0x00007FFA81790000-0x00007FFA8179D000-memory.dmp
memory/2396-344-0x00007FFA817A0000-0x00007FFA817AC000-memory.dmp
memory/2396-343-0x00007FFA81D00000-0x00007FFA81D0C000-memory.dmp
memory/2396-342-0x00007FFA81D10000-0x00007FFA81D1B000-memory.dmp
memory/2396-341-0x00007FFA83F40000-0x00007FFA83F4B000-memory.dmp
memory/2396-340-0x00007FFA83F50000-0x00007FFA83F5C000-memory.dmp
memory/2396-339-0x00007FFA843E0000-0x00007FFA843EE000-memory.dmp
memory/2396-338-0x00007FFA88BC0000-0x00007FFA88BCC000-memory.dmp
memory/2396-337-0x00007FFA88D30000-0x00007FFA88D3C000-memory.dmp
memory/2396-336-0x00007FFA8E2A0000-0x00007FFA8E2AF000-memory.dmp
memory/2396-325-0x00007FFA7D990000-0x00007FFA7DAAB000-memory.dmp
memory/2396-321-0x00007FFA7DCA0000-0x00007FFA7DE1F000-memory.dmp
memory/2396-315-0x00007FFA76490000-0x00007FFA769B9000-memory.dmp
memory/5832-230-0x00007FFA75630000-0x00007FFA75FD4000-memory.dmp
memory/5832-228-0x00000206707B0000-0x00000206707BA000-memory.dmp
memory/5832-236-0x00007FFA75630000-0x00007FFA75FD4000-memory.dmp
memory/5832-235-0x00007FFA75630000-0x00007FFA75FD4000-memory.dmp
memory/5832-234-0x00007FFA75630000-0x00007FFA75FD4000-memory.dmp
memory/5832-233-0x00007FFA75630000-0x00007FFA75FD4000-memory.dmp
memory/5832-232-0x00007FFA75630000-0x00007FFA75FD4000-memory.dmp
memory/5832-231-0x00007FFA75630000-0x00007FFA75FD4000-memory.dmp
memory/5832-237-0x00007FFA75630000-0x00007FFA75FD4000-memory.dmp
memory/5832-239-0x00007FFA75630000-0x00007FFA75FD4000-memory.dmp
memory/5832-229-0x00007FFA75630000-0x00007FFA75FD4000-memory.dmp
memory/5832-225-0x00000206706D0000-0x00000206706EE000-memory.dmp
memory/5832-226-0x00000206706F0000-0x00000206707A2000-memory.dmp
memory/5832-227-0x00007FFA75630000-0x00007FFA75FD4000-memory.dmp
memory/5832-222-0x00007FFA75630000-0x00007FFA75FD4000-memory.dmp
memory/5832-221-0x00007FFA75630000-0x00007FFA75FD4000-memory.dmp
memory/5832-220-0x0000020670630000-0x0000020670652000-memory.dmp
memory/5832-217-0x00007FFA757BF000-0x00007FFA757C0000-memory.dmp