Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/09/2026, 22:21
General
- Target 2026-09-03_a56ef8aa14f36747ac4f9dee74996e3e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 62.1MB
- Sample260905-196ewatejd
- SHA256 a657a788a6cf0e69039aaa6d69ca78c10cf45fad1f6ccc5496cfdd0101d18a63
Malware Config
Signatures
- Family: LunaStealer
LunaStealer is an infostealer written in Python and packaged with Pyinstaller.
- Loads dropped DLL 64 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-03_a56ef8aa14f36747ac4f9dee74996e3e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-03_a56ef8aa14f36747ac4f9dee74996e3e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-03_a56ef8aa14f36747ac4f9dee74996e3e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-03_a56ef8aa14f36747ac4f9dee74996e3e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
_raw_ecb.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp311-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
base_library.zip
cacert.pem
md.cp311-win_amd64.pyd
md__mypyc.cp311-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
luna.aes
_psutil_windows.pyd
pyexpat.pyd
python3.DLL
python311.dll
pythoncom311.dll
pywintypes311.dll
select.pyd
unicodedata.pyd
win32api.pyd
backend_c.cp311-win_amd64.pyd
memory/5148-814-0x00007FFCF9400000-0x00007FFCF940C000-memory.dmp
memory/5148-837-0x00007FFCF3430000-0x00007FFCF3452000-memory.dmp
memory/5148-762-0x00007FFCFEDC0000-0x00007FFCFEDCD000-memory.dmp
memory/5148-770-0x0000021F2EE20000-0x0000021F2F412000-memory.dmp
memory/5148-774-0x00007FFCFD600000-0x00007FFCFD62E000-memory.dmp
memory/5148-773-0x00007FFCF6FD0000-0x00007FFCF6FFB000-memory.dmp
memory/5148-772-0x00007FFCF7C40000-0x00007FFCF7CFC000-memory.dmp
memory/5148-771-0x0000021F2EE20000-0x0000021F2F412000-memory.dmp
memory/5148-777-0x00007FFCF6F90000-0x00007FFCF6FC3000-memory.dmp
memory/5148-776-0x00007FFCFE310000-0x00007FFCFE334000-memory.dmp
memory/5148-781-0x00007FFCF6EC0000-0x00007FFCF6F8D000-memory.dmp
memory/5148-780-0x00007FFCEB7C0000-0x00007FFCEBCE9000-memory.dmp
memory/5148-783-0x00007FFCF6EA0000-0x00007FFCF6EB5000-memory.dmp
memory/5148-785-0x00007FFCF6E80000-0x00007FFCF6E92000-memory.dmp
memory/5148-788-0x00007FFCF2F10000-0x00007FFCF302C000-memory.dmp
memory/5148-787-0x00007FFCFD630000-0x00007FFCFD649000-memory.dmp
memory/5148-759-0x00007FFCFD630000-0x00007FFCFD649000-memory.dmp
memory/5148-791-0x00007FFCF6DF0000-0x00007FFCF6E77000-memory.dmp
memory/5148-756-0x00007FFCFDEB0000-0x00007FFCFDEE6000-memory.dmp
memory/5148-794-0x00007FFCF6DD0000-0x00007FFCF6DE4000-memory.dmp
memory/5148-797-0x00007FFCFD550000-0x00007FFCFD55B000-memory.dmp
memory/5148-754-0x00007FFCFDEF0000-0x00007FFCFDF1D000-memory.dmp
memory/5148-799-0x00007FFCF6DA0000-0x00007FFCF6DC6000-memory.dmp
memory/5148-735-0x00007FFCFE100000-0x00007FFCFE119000-memory.dmp
memory/5148-732-0x00007FFD02AB0000-0x00007FFD02ABF000-memory.dmp
memory/5148-805-0x00007FFCF6780000-0x00007FFCF6798000-memory.dmp
memory/5148-804-0x00007FFCF6F90000-0x00007FFCF6FC3000-memory.dmp
memory/5148-729-0x00007FFCFE310000-0x00007FFCFE334000-memory.dmp
memory/5148-808-0x00007FFCEB7C0000-0x00007FFCEBCE9000-memory.dmp
memory/5148-810-0x00007FFCF50A0000-0x00007FFCF50D8000-memory.dmp
memory/5148-809-0x00007FFCF6EC0000-0x00007FFCF6F8D000-memory.dmp
memory/5148-811-0x00007FFCFD240000-0x00007FFCFD24B000-memory.dmp
memory/5148-813-0x00007FFCFBE40000-0x00007FFCFBE4B000-memory.dmp
memory/5148-812-0x00007FFCF6EA0000-0x00007FFCF6EB5000-memory.dmp
memory/5148-816-0x00007FFCF2F10000-0x00007FFCF302C000-memory.dmp
memory/5148-815-0x00007FFCF7C30000-0x00007FFCF7C3B000-memory.dmp
memory/5148-817-0x00007FFCF6D90000-0x00007FFCF6D9C000-memory.dmp
memory/5148-818-0x00007FFCF6CB0000-0x00007FFCF6CBB000-memory.dmp
memory/5148-720-0x0000021F2EE20000-0x0000021F2F412000-memory.dmp
memory/5148-820-0x00007FFCF6760000-0x00007FFCF676C000-memory.dmp
memory/5148-822-0x00007FFCF6750000-0x00007FFCF675E000-memory.dmp
memory/5148-823-0x00007FFCF62E0000-0x00007FFCF62EC000-memory.dmp
memory/5148-824-0x00007FFCF62D0000-0x00007FFCF62DB000-memory.dmp
memory/5148-826-0x00007FFCF51C0000-0x00007FFCF51CC000-memory.dmp
memory/5148-828-0x00007FFCF4DF0000-0x00007FFCF4DFD000-memory.dmp
memory/5148-829-0x00007FFCF4DD0000-0x00007FFCF4DE2000-memory.dmp
memory/5148-830-0x00007FFCF4DC0000-0x00007FFCF4DCC000-memory.dmp
memory/5148-827-0x00007FFCF51B0000-0x00007FFCF51BC000-memory.dmp
memory/5148-825-0x00007FFCF51D0000-0x00007FFCF51DB000-memory.dmp
memory/5148-831-0x00007FFCEF2D0000-0x00007FFCEF515000-memory.dmp
memory/5148-821-0x00007FFCF6780000-0x00007FFCF6798000-memory.dmp
memory/5148-819-0x00007FFCF6770000-0x00007FFCF677C000-memory.dmp
memory/5148-832-0x00007FFCF4940000-0x00007FFCF4969000-memory.dmp
memory/5148-833-0x00007FFCEE670000-0x00007FFCEE94F000-memory.dmp
memory/5148-834-0x00007FFCE8FF0000-0x00007FFCEB0E3000-memory.dmp
memory/5148-835-0x00007FFCF3490000-0x00007FFCF34A7000-memory.dmp
memory/5148-836-0x00007FFCF3460000-0x00007FFCF3481000-memory.dmp
memory/5148-761-0x00007FFD02AA0000-0x00007FFD02AAD000-memory.dmp
memory/5148-838-0x00007FFCF2E70000-0x00007FFCF2F0C000-memory.dmp
memory/5148-840-0x00007FFCF2B20000-0x00007FFCF2B67000-memory.dmp
memory/5148-845-0x00007FFCF2B70000-0x00007FFCF2BA3000-memory.dmp
memory/5148-844-0x00007FFCF2B00000-0x00007FFCF2B13000-memory.dmp
memory/5148-843-0x00007FFCF2E50000-0x00007FFCF2E6D000-memory.dmp
memory/5148-847-0x00007FFCF2A40000-0x00007FFCF2AF4000-memory.dmp
memory/5148-846-0x00007FFCEF2D0000-0x00007FFCEF515000-memory.dmp
memory/5148-842-0x00007FFCF3310000-0x00007FFCF3329000-memory.dmp
memory/5148-841-0x00007FFCF3410000-0x00007FFCF342A000-memory.dmp
memory/5148-839-0x00007FFCF2BB0000-0x00007FFCF2BE0000-memory.dmp
memory/5148-848-0x00007FFCF4940000-0x00007FFCF4969000-memory.dmp
memory/5148-849-0x00007FFCEE670000-0x00007FFCEE94F000-memory.dmp
memory/5148-850-0x00007FFCE8FF0000-0x00007FFCEB0E3000-memory.dmp
memory/5148-852-0x00007FFCFE310000-0x00007FFCFE334000-memory.dmp
memory/5148-851-0x0000021F2EE20000-0x0000021F2F412000-memory.dmp
memory/5148-874-0x00007FFCF3490000-0x00007FFCF34A7000-memory.dmp
memory/5148-875-0x00007FFCF3430000-0x00007FFCF3452000-memory.dmp
memory/5148-888-0x00007FFCF6F90000-0x00007FFCF6FC3000-memory.dmp
memory/5148-877-0x00007FFCFE310000-0x00007FFCFE334000-memory.dmp
memory/5148-887-0x00007FFCF6FD0000-0x00007FFCF6FFB000-memory.dmp
memory/5148-886-0x00007FFCF7C40000-0x00007FFCF7CFC000-memory.dmp
memory/5148-893-0x00007FFCF2F10000-0x00007FFCF302C000-memory.dmp
memory/5148-889-0x00007FFCEB7C0000-0x00007FFCEBCE9000-memory.dmp
memory/5148-906-0x00007FFCFD600000-0x00007FFCFD62E000-memory.dmp
memory/5148-909-0x00007FFCF4940000-0x00007FFCF4969000-memory.dmp
memory/5148-921-0x00007FFCF2B00000-0x00007FFCF2B13000-memory.dmp
memory/5148-920-0x00007FFCF2E50000-0x00007FFCF2E6D000-memory.dmp
memory/5148-919-0x00007FFCF3310000-0x00007FFCF3329000-memory.dmp
memory/5148-918-0x00007FFCF3410000-0x00007FFCF342A000-memory.dmp
memory/5148-917-0x00007FFCF2B20000-0x00007FFCF2B67000-memory.dmp
memory/5148-916-0x00007FFCF2BB0000-0x00007FFCF2BE0000-memory.dmp
memory/5148-915-0x00007FFCF2E70000-0x00007FFCF2F0C000-memory.dmp
memory/5148-914-0x00007FFCF3430000-0x00007FFCF3452000-memory.dmp
memory/5148-913-0x00007FFCF3460000-0x00007FFCF3481000-memory.dmp
memory/5148-912-0x00007FFCF3490000-0x00007FFCF34A7000-memory.dmp
memory/5148-911-0x00007FFCF2B70000-0x00007FFCF2BA3000-memory.dmp
memory/5148-910-0x00007FFCEE670000-0x00007FFCEE94F000-memory.dmp
memory/5148-908-0x00007FFCEF2D0000-0x00007FFCEF515000-memory.dmp
memory/5148-907-0x00007FFCF50A0000-0x00007FFCF50D8000-memory.dmp
memory/5148-905-0x00007FFCFD630000-0x00007FFCFD649000-memory.dmp
memory/5148-904-0x00007FFCFDEB0000-0x00007FFCFDEE6000-memory.dmp
memory/5148-903-0x00007FFCFDEF0000-0x00007FFCFDF1D000-memory.dmp
memory/5148-902-0x00007FFCFE100000-0x00007FFCFE119000-memory.dmp
memory/5148-901-0x00007FFD02AB0000-0x00007FFD02ABF000-memory.dmp
memory/5148-900-0x00007FFD02AA0000-0x00007FFD02AAD000-memory.dmp
memory/5148-899-0x00007FFCFEDC0000-0x00007FFCFEDCD000-memory.dmp
memory/5148-898-0x00007FFCF6780000-0x00007FFCF6798000-memory.dmp
memory/5148-897-0x00007FFCF6DA0000-0x00007FFCF6DC6000-memory.dmp
memory/5148-896-0x00007FFCFD550000-0x00007FFCFD55B000-memory.dmp
memory/5148-894-0x00007FFCF6DF0000-0x00007FFCF6E77000-memory.dmp
memory/5148-890-0x00007FFCF6EC0000-0x00007FFCF6F8D000-memory.dmp
memory/5148-892-0x00007FFCF6E80000-0x00007FFCF6E92000-memory.dmp
memory/5148-891-0x00007FFCF6EA0000-0x00007FFCF6EB5000-memory.dmp
memory/5148-876-0x0000021F2EE20000-0x0000021F2F412000-memory.dmp
memory/5148-895-0x00007FFCF6DD0000-0x00007FFCF6DE4000-memory.dmp