Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/09/2026, 04:31
General
- Target 2026-09-07_d847a1e496536f0e05255936222a9619_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
- Size 9.5MB
- Sample260908-e5m7va1hmb
- SHA256 35ee6579b5d79d66b4531360cba9770453d5eaaf9793c9ebe1f42399d1e3ec8a
Malware Config
Signatures
- Loads dropped DLL 30 IoCs
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-07_d847a1e496536f0e05255936222a9619_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-07_d847a1e496536f0e05255936222a9619_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-07_d847a1e496536f0e05255936222a9619_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-07_d847a1e496536f0e05255936222a9619_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp310-win_amd64.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_overlapped.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_uuid.pyd
_helpers.cp310-win_amd64.pyd
_http_parser.cp310-win_amd64.pyd
_http_writer.cp310-win_amd64.pyd
_websocket.cp310-win_amd64.pyd
base_library.zip
_rust.pyd
_frozenlist.cp310-win_amd64.pyd
libcrypto-1_1.dll
libffi-7.dll
libssl-1_1.dll
_multidict.cp310-win_amd64.pyd
python3.DLL
python310.dll
select.pyd
sqlite3.dll
unicodedata.pyd
_quoting_c.cp310-win_amd64.pyd
memory/3956-118-0x00007FFB80720000-0x00007FFB80739000-memory.dmp
memory/3956-50-0x00007FFB80140000-0x00007FFB805AE000-memory.dmp
memory/3956-100-0x00007FFB7FFB0000-0x00007FFB7FFC5000-memory.dmp
memory/3956-99-0x00007FFB80E70000-0x00007FFB80E94000-memory.dmp
memory/3956-98-0x00007FFB741D0000-0x00007FFB74545000-memory.dmp
memory/3956-102-0x00007FFB7BE80000-0x00007FFB7BE94000-memory.dmp
memory/3956-103-0x00007FFB85290000-0x00007FFB852A0000-memory.dmp
memory/3956-92-0x000002BBAF180000-0x000002BBAF4F5000-memory.dmp
memory/3956-88-0x00007FFB7FFD0000-0x00007FFB80088000-memory.dmp
memory/3956-87-0x00007FFB80140000-0x00007FFB805AE000-memory.dmp
memory/3956-104-0x00007FFB80B20000-0x00007FFB80B39000-memory.dmp
memory/3956-107-0x00007FFB740B0000-0x00007FFB741C8000-memory.dmp
memory/3956-65-0x00007FFB80B20000-0x00007FFB80B39000-memory.dmp
memory/3956-110-0x00007FFB80760000-0x00007FFB80782000-memory.dmp
memory/3956-70-0x00007FFB80850000-0x00007FFB80869000-memory.dmp
memory/3956-114-0x00007FFB80740000-0x00007FFB80757000-memory.dmp
memory/3956-76-0x00007FFB80640000-0x00007FFB8065F000-memory.dmp
memory/3956-82-0x00007FFB80090000-0x00007FFB800BE000-memory.dmp
memory/3956-117-0x00007FFB80640000-0x00007FFB8065F000-memory.dmp
memory/3956-78-0x00007FFB748A0000-0x00007FFB74A11000-memory.dmp
memory/3956-73-0x00007FFB800C0000-0x00007FFB800ED000-memory.dmp
memory/3956-125-0x00007FFB80090000-0x00007FFB800BE000-memory.dmp
memory/3956-66-0x00007FFB85860000-0x00007FFB8586D000-memory.dmp
memory/3956-133-0x00007FFB7BE40000-0x00007FFB7BE5E000-memory.dmp
memory/3956-136-0x00007FFB739B0000-0x00007FFB740A4000-memory.dmp
memory/3956-132-0x00007FFB741D0000-0x00007FFB74545000-memory.dmp
memory/3956-58-0x00007FFB80E70000-0x00007FFB80E94000-memory.dmp
memory/3956-130-0x00007FFB83830000-0x00007FFB8383A000-memory.dmp
memory/3956-129-0x00007FFB7BE60000-0x00007FFB7BE71000-memory.dmp
memory/3956-127-0x000002BBAF180000-0x000002BBAF4F5000-memory.dmp
memory/3956-60-0x00007FFB85870000-0x00007FFB8587F000-memory.dmp
memory/3956-122-0x00007FFB806D0000-0x00007FFB80719000-memory.dmp
memory/3956-120-0x00007FFB748A0000-0x00007FFB74A11000-memory.dmp
memory/3956-101-0x00007FFB7FF90000-0x00007FFB7FFA4000-memory.dmp
memory/3956-140-0x00007FFB7BE00000-0x00007FFB7BE38000-memory.dmp
memory/3956-139-0x00007FFB740B0000-0x00007FFB741C8000-memory.dmp
memory/3956-141-0x00007FFB80760000-0x00007FFB80782000-memory.dmp
memory/3956-142-0x00007FFB80740000-0x00007FFB80757000-memory.dmp
memory/3956-143-0x00007FFB806D0000-0x00007FFB80719000-memory.dmp
memory/3956-164-0x00007FFB806D0000-0x00007FFB80719000-memory.dmp
memory/3956-177-0x00007FFB80640000-0x00007FFB8065F000-memory.dmp
memory/3956-168-0x00007FFB739B0000-0x00007FFB740A4000-memory.dmp
memory/3956-176-0x00007FFB800C0000-0x00007FFB800ED000-memory.dmp
memory/3956-175-0x00007FFB80850000-0x00007FFB80869000-memory.dmp
memory/3956-174-0x00007FFB80B20000-0x00007FFB80B39000-memory.dmp
memory/3956-173-0x00007FFB85860000-0x00007FFB8586D000-memory.dmp
memory/3956-172-0x00007FFB85870000-0x00007FFB8587F000-memory.dmp
memory/3956-171-0x00007FFB80E70000-0x00007FFB80E94000-memory.dmp
memory/3956-170-0x00007FFB85290000-0x00007FFB852A0000-memory.dmp
memory/3956-169-0x00007FFB7BE00000-0x00007FFB7BE38000-memory.dmp
memory/3956-167-0x00007FFB7BE40000-0x00007FFB7BE5E000-memory.dmp
memory/3956-166-0x00007FFB83830000-0x00007FFB8383A000-memory.dmp
memory/3956-165-0x00007FFB7BE60000-0x00007FFB7BE71000-memory.dmp
memory/3956-163-0x00007FFB80720000-0x00007FFB80739000-memory.dmp
memory/3956-162-0x00007FFB80740000-0x00007FFB80757000-memory.dmp
memory/3956-161-0x00007FFB80760000-0x00007FFB80782000-memory.dmp
memory/3956-160-0x00007FFB740B0000-0x00007FFB741C8000-memory.dmp
memory/3956-159-0x00007FFB7BE80000-0x00007FFB7BE94000-memory.dmp
memory/3956-158-0x00007FFB7FF90000-0x00007FFB7FFA4000-memory.dmp
memory/3956-156-0x00007FFB7FFB0000-0x00007FFB7FFC5000-memory.dmp
memory/3956-155-0x00007FFB741D0000-0x00007FFB74545000-memory.dmp
memory/3956-154-0x00007FFB7FFD0000-0x00007FFB80088000-memory.dmp
memory/3956-153-0x00007FFB80090000-0x00007FFB800BE000-memory.dmp
memory/3956-152-0x00007FFB748A0000-0x00007FFB74A11000-memory.dmp
memory/3956-144-0x00007FFB80140000-0x00007FFB805AE000-memory.dmp