23306d641c2baa060da8a85da47de8554b5fa5ec5e47233f10b5f5ac5129d8b9

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 03:15

Target
2026-09-04_937b1c4adbf1f98d554a62fba9199773_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 199KB
Sample260905-dr9cgsdq91
SHA256 23306d641c2baa060da8a85da47de8554b5fa5ec5e47233f10b5f5ac5129d8b9
MD5 937b1c4adbf1f98d554a62fba9199773
SHA1 b657c5f7e41ab0d6d989761bff2cfe65d3cc5097
SHA512 41fb16d45dcbf0ee47a9c0d7fc04d3505bfdaca4f2b0f0edd435bdafbb2199ad85bf434ad78e6ce288502a9f87904ddaa1349ae918d8e14fccb717def8aa7fa9
SSDEEP 3072:TePhMAfQmIapmKSljZG14SYgUoT/VIlTaOCoY/EbIg0Me8juM:iPhMAfhIaKlGeSMoZ0a1oWEbIRM
TLSH
T1CB146D4572E601E9E1738138CDA64652E673B81507209BEF4760467AEF237E1FD3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

flow	ioc
1	api.ipify.org
2	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

C:\Users\Admin\AppData\Local\Temp\2026-09-04_937b1c4adbf1f98d554a62fba9199773_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_937b1c4adbf1f98d554a62fba9199773_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
PID:8