Overview

overview

7

Static

static

3

2026-09-08...ar.exe

windows10-2004-x64

7

2026-09-08...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 04:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-08_76424f7c1ef43fbe8febc11db969b2bd_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
  • Size 35.8MB
  • Sample260910-fgfnjagm2x
  • SHA256 25db8542d1a80309ab651fe6270d30715a837a8958bd3b88042eab82e5b4e75f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 33 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-08_76424f7c1ef43fbe8febc11db969b2bd_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-08_76424f7c1ef43fbe8febc11db969b2bd_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5648
    • C:\Users\Admin\AppData\Local\Temp\2026-09-08_76424f7c1ef43fbe8febc11db969b2bd_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-08_76424f7c1ef43fbe8febc11db969b2bd_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3592

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSVCP140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\MSVCP140.dll
        • Size 550KB
        • SHA256 254df96324d019a7c4213abd4178944b8bf2873d0c3edc1835d4c668f83d7c37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtCore.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\QtCore.pyd
        • Size 2.3MB
        • SHA256 0e9eda13cd8602bd971ff8703e0e15dbc8a4c5100405ee321bfc7af6f1321d90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtGui.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\QtGui.pyd
        • Size 2.3MB
        • SHA256 e581156f383f8a20c1a86b4df866500f630002e566fefe0545e6755d89645b96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        QtWidgets.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\QtWidgets.pyd
        • Size 4.6MB
        • SHA256 27cb9cf9092676b9d43cd67ec2ef2a48dbb0ca45db3463349a37ccfec27c43af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qsvgicon.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\Qt\plugins\iconengines\qsvgicon.dll
        • Size 40KB
        • SHA256 00933ee076dc78097e131bdaefc37ab6b5a9322893056c60978e0b807e55432a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qgif.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\Qt\plugins\imageformats\qgif.dll
        • Size 36KB
        • SHA256 2d114528d6efcc34deb74ea94ea0a23ba0fa0087ffcd44bc3ac305e7c46c1ea5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qicns.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\Qt\plugins\imageformats\qicns.dll
        • Size 44KB
        • SHA256 34b78a9cfb29e20736ea6da354dd48ec41034a420596c78eb79fbb173b3e82f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qico.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\Qt\plugins\imageformats\qico.dll
        • Size 37KB
        • SHA256 00d2a327000f743b60c60f67cb391becf332b46b8a367a41080875f849f6f0b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qjpeg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\Qt\plugins\imageformats\qjpeg.dll
        • Size 411KB
        • SHA256 fed0c6794e909680c163843849f37d84a7be5454396ba90acd49fb4072cb32f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qsvg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\Qt\plugins\imageformats\qsvg.dll
        • Size 30KB
        • SHA256 673bd68309713485d502dae4736c0662ed4989ffc27e885838a3240f56b9a8ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qtga.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\Qt\plugins\imageformats\qtga.dll
        • Size 29KB
        • SHA256 ccc38b17ee468ccfc804a7fa478fa788c139b4b2b75b9b4873cdc671a3f248ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qtiff.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\Qt\plugins\imageformats\qtiff.dll
        • Size 377KB
        • SHA256 604cf0793ccc68ec3b463584514c412b00777d4ec43058e26594891d5e1c45a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwbmp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\Qt\plugins\imageformats\qwbmp.dll
        • Size 28KB
        • SHA256 925910cc9082bd65dd987499a907e93e9d88112d2b846e7d29aa4081b11ffb7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwebp.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\Qt\plugins\imageformats\qwebp.dll
        • Size 526KB
        • SHA256 f48ed456addb637d335bcfec8c2cbde1787946a20c986d6e6d86f893efeed97a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qminimal.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\Qt\plugins\platforms\qminimal.dll
        • Size 814KB
        • SHA256 4fae8f032561b0ac38f6753f69873d63dc6a202a8b409db19602d507fe8cdf5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qoffscreen.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\Qt\plugins\platforms\qoffscreen.dll
        • Size 724KB
        • SHA256 d0d3be4d5427a356752ea26c264614ceda9dd0c45deeb6332f336e59eb3b6411
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwebgl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\Qt\plugins\platforms\qwebgl.dll
        • Size 549KB
        • SHA256 7e284cf1133e6ec1d2645f475f65a8e3a3bda0e02862251c2b03ca24840a438c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwindows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\Qt\plugins\platforms\qwindows.dll
        • Size 1.4MB
        • SHA256 3c1a33ca223965a82569e039582d14e9a4b6ae3c1128c0c0853fd0c03c1f60a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qxdgdesktopportal.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\Qt\plugins\platformthemes\qxdgdesktopportal.dll
        • Size 60KB
        • SHA256 ad11f3262536c59fee7c54ae3ffecad8335d688253ac434a24ff2077d3e34377
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        qwindowsvistastyle.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\Qt\plugins\styles\qwindowsvistastyle.dll
        • Size 137KB
        • SHA256 3d05dffbdde2516d02785eb8bf6d08927bd3cb65a29a8d2d3b4baac85dcfad76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sip.cp36-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\PyQt5\sip.cp36-win_amd64.pyd
        • Size 136KB
        • SHA256 9a23d8e85bc9d1fdd6c71c179b8f4b6fb27ce5393136def406a8561e3240e23f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\Qt5Core.dll
        • Size 5.9MB
        • SHA256 1e96f5193ab2a2a8dd30c8a887c94fcb56a9346b5a1a2364c3296d153746c464
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Gui.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\Qt5Gui.dll
        • Size 6.8MB
        • SHA256 570d73aef50807468c1701a9a3b8c7980d01b732f2eed63caf83972f03adb077
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Qt5Widgets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\Qt5Widgets.dll
        • Size 5.3MB
        • SHA256 db8c286e95cfc8076f2a7969218ab38949cb948021abe3a6f99b8b93a6d37e56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\VCRUNTIME140.dll
        • Size 85KB
        • SHA256 d89c7b863fc1ac3a179d45d5fe1b9fd35fb6fbd45171ca68d0d68ab1c1ad04fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\VCRUNTIME140_1.dll
        • Size 35KB
        • SHA256 922124ba0821aa864a0261ed88bd25f8e40f94c24d00d389e23cd9ab2bfc6ba4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\_bz2.pyd
        • Size 92KB
        • SHA256 58563fb8798c878bbb19221d8c6c9a3cc243d6dbc9bf5d7f73ba62834c5e4614
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\_hashlib.pyd
        • Size 1.4MB
        • SHA256 ab3d09c879b395631d8a4f89f6855d98d315675e9607248eed7bc07317260168
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\_lzma.pyd
        • Size 248KB
        • SHA256 42aafcd7e1050b3307c06874fa1e72eecfb5554bd631097e7af0506a3a200144
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\_socket.pyd
        • Size 70KB
        • SHA256 77b3597eef6eb044fbec7b2229772495cd632033bec03badad4e4d268748b760
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\_ssl.pyd
        • Size 1.7MB
        • SHA256 ea7cf863090d7f61daae9c6cc679608239e622f4485514dc705d09c1311657c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\base_library.zip
        • Size 766KB
        • SHA256 e2f2fe96274f4b27951f10ba36c2b6be2e0c5cafc455be5e2c98a98d232d3d23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        config.ini
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\config.ini
        • Size 227B
        • SHA256 8c57fc85c8709776d7e080aee7e1dc38697315ccfa556a5d07984dbf519a7a9c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\python3.dll
        • Size 51KB
        • SHA256 1c5ed2b473eab205a0c20506b8db0b22f0c1f3980e8d0fe7304b9eebd5065c51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python36.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\python36.dll
        • Size 3.4MB
        • SHA256 dd4bba32bf57165371822f5966617f475198764a91f39dc6ef86552457ac795d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\select.pyd
        • Size 26KB
        • SHA256 df8acaf83e5c861f1d0ad694b087ff0a451f01191602617307a93c9dec893ecd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\ucrtbase.dll
        • Size 961KB
        • SHA256 4918f2e631ef1ae34c7863fa4f3bd7663b2fdf0fa160c0de507ed343484ac806
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI56482\unicodedata.pyd
        • Size 884KB
        • SHA256 7c115398f9975004b436c70cfa5d5d08e9f3f1d0f1c8a9e07eeeac96affe6625
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3592-150-0x00007FFC47C70000-0x00007FFC47EC1000-memory.dmp
        Download

        memory/3592-163-0x00000182AB960000-0x00000182AB970000-memory.dmp
        Download

        memory/3592-139-0x00007FFC4B170000-0x00007FFC4B3B6000-memory.dmp
        Download

        memory/3592-156-0x00000182AB420000-0x00000182AB8C1000-memory.dmp
        Download

        memory/3592-157-0x00007FFC44EB0000-0x00007FFC4540B000-memory.dmp
        Download

        memory/3592-181-0x00000182AB420000-0x00000182AB8C1000-memory.dmp
        Download