8cfdfa20c1ff0a28a7ccac6092e0ad7db945970dfba065d040558c10750256bb

General

Target
2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Size 60.9MB
Sample260905-a62peabb48
SHA256 8cfdfa20c1ff0a28a7ccac6092e0ad7db945970dfba065d040558c10750256bb
MD5 aa42fe3e261c51f9f86b0c9c91f2c78f
SHA1 2e3b7f5a95a30976dba73557fcfd399edbc91030
SHA512 e8dfb7bcb729ba0e9c07889721218787d905277be263e9affe5ddfe21309b7ed089a83ead2fc58c181d1f4ff69c078858b743dada9dc51e580f17b3b94840f60
SSDEEP 393216:zsqGxqsktO5GG02US1P+/U7q7K0mAb5ZUjcDUND3usyBvaRRMV+o33irYVI31BLN:z4lmOIUMFCrYVKAGmjvK
TLSH
T148E74A46A6EA0481FDFBDA358AF65113C533BC166F3085DF610C1B2A1F776E08976B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery execution

Malware Config

Signatures

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2220	tasklist.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3972	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	tasklist.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 3972	4068	2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe	88
PID 3972 wrote to memory of 2220	3972	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_aa42fe3e261c51f9f86b0c9c91f2c78f_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_vidar_zxxz.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2220