Analysis
- max time kernel
149s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
13/09/2026, 01:53
General
- Target 2026-09-12_510b708135bcf4fe4e3c8798c92d84fa_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 84.7MB
- Sample260913-cbc4nsde89
- SHA256 379a1752955de62caa0bfd85ceef3a1226d15c22ca364be65f481613f72c9663
Malware Config
Signatures
- Loads dropped DLL 64 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_510b708135bcf4fe4e3c8798c92d84fa_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_510b708135bcf4fe4e3c8798c92d84fa_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_510b708135bcf4fe4e3c8798c92d84fa_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_510b708135bcf4fe4e3c8798c92d84fa_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SDL2.dll
SDL2_image.dll
SDL2_mixer.dll
SDL2_ttf.dll
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp311-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_tkinter.pyd
_uuid.pyd
_zoneinfo.pyd
base_library.zip
freetype.dll
libcrypto-3.dll
libffi-8.dll
libjpeg-9.dll
libmodplug-1.dll
libogg-0.dll
libopus-0.dll
libopusfile-0.dll
libpng16-16.dll
libssl-3.dll
libtiff-5.dll
libwebp-7.dll
portmidi.dll
pyexpat.pyd
python3.dll
python311.dll
pythoncom311.dll
pywintypes311.dll
select.pyd
sqlite3.dll
tcl86t.dll
tk86t.dll
unicodedata.pyd
win32api.pyd
zlib1.dll
memory/1848-1439-0x00007FF9F2EA0000-0x00007FF9F2EAB000-memory.dmp
memory/1848-1345-0x00007FFA0CF70000-0x00007FFA0CF7D000-memory.dmp
memory/1848-1429-0x00007FF9F2FB0000-0x00007FF9F2FBE000-memory.dmp
memory/1848-1428-0x00007FF9F2FC0000-0x00007FF9F2FFF000-memory.dmp
memory/1848-1427-0x00007FF9F3000000-0x00007FF9F3015000-memory.dmp
memory/1848-1426-0x00007FF9F3020000-0x00007FF9F3032000-memory.dmp
memory/1848-1425-0x00007FF9F3040000-0x00007FF9F305B000-memory.dmp
memory/1848-1424-0x00007FF9F3060000-0x00007FF9F317C000-memory.dmp
memory/1848-1423-0x00007FF9F3180000-0x00007FF9F3194000-memory.dmp
memory/1848-1402-0x00007FFA02F30000-0x00007FFA031A8000-memory.dmp
memory/1848-1401-0x00007FFA03990000-0x00007FFA039A1000-memory.dmp
memory/1848-1399-0x00007FF9F5E90000-0x00007FF9F6016000-memory.dmp
memory/1848-1398-0x00007FFA02B50000-0x00007FFA02B5F000-memory.dmp
memory/1848-1397-0x00007FFA05C50000-0x00007FFA05C65000-memory.dmp
memory/1848-1396-0x00007FFA026E0000-0x00007FFA026F5000-memory.dmp
memory/1848-1395-0x00007FFA02E80000-0x00007FFA02E90000-memory.dmp
memory/1848-1394-0x00007FFA035F0000-0x00007FFA03605000-memory.dmp
memory/1848-1393-0x00007FF9FC340000-0x00007FF9FC357000-memory.dmp
memory/1848-1392-0x00007FFA02700000-0x00007FFA02716000-memory.dmp
memory/1848-1391-0x00007FFA02E90000-0x00007FFA02E9E000-memory.dmp
memory/1848-1390-0x00007FFA02EF0000-0x00007FFA02EFE000-memory.dmp
memory/1848-1389-0x00007FFA02F00000-0x00007FFA02F0F000-memory.dmp
memory/1848-1388-0x00007FFA03480000-0x00007FFA0348E000-memory.dmp
memory/1848-1387-0x0000000062E80000-0x0000000062EA8000-memory.dmp
memory/1848-1386-0x000000006A880000-0x000000006A8AB000-memory.dmp
memory/1848-1385-0x0000000068B40000-0x0000000068B81000-memory.dmp
memory/1848-1384-0x00007FFA035C0000-0x00007FFA035CE000-memory.dmp
memory/1848-1383-0x00007FFA02F10000-0x00007FFA02F21000-memory.dmp
memory/1848-1382-0x00007FFA03490000-0x00007FFA034A4000-memory.dmp
memory/1848-1381-0x00007FFA034B0000-0x00007FFA034C6000-memory.dmp
memory/1848-1380-0x00007FFA034D0000-0x00007FFA03514000-memory.dmp
memory/1848-1379-0x00007FF9F6020000-0x00007FF9F6540000-memory.dmp
memory/1848-1377-0x00007FFA03D60000-0x00007FFA03D93000-memory.dmp
memory/1848-1376-0x00007FFA03630000-0x00007FFA03641000-memory.dmp
memory/1848-1375-0x00007FFA046C0000-0x00007FFA046CE000-memory.dmp
memory/1848-1374-0x00007FFA07980000-0x00007FFA0798C000-memory.dmp
memory/1848-1373-0x00007FFA079C0000-0x00007FFA079CF000-memory.dmp
memory/1848-1371-0x00007FFA03970000-0x00007FFA03986000-memory.dmp
memory/1848-1370-0x00007FFA03650000-0x00007FFA03665000-memory.dmp
memory/1848-1369-0x00007FFA02F30000-0x00007FFA031A8000-memory.dmp
memory/1848-1368-0x00007FFA03990000-0x00007FFA039A1000-memory.dmp
memory/1848-1367-0x00007FFA039B0000-0x00007FFA039C2000-memory.dmp
memory/1848-1365-0x00007FFA09980000-0x00007FFA09999000-memory.dmp
memory/1848-1364-0x00007FFA031B0000-0x00007FFA0327D000-memory.dmp
memory/1848-1363-0x00007FF9F6020000-0x00007FF9F6540000-memory.dmp
memory/1848-1360-0x00007FFA079E0000-0x00007FFA07A03000-memory.dmp
memory/1848-1431-0x00007FF9F2F70000-0x00007FF9F2F7B000-memory.dmp
memory/1848-1357-0x00007FFA03280000-0x00007FFA0333C000-memory.dmp
memory/1848-1432-0x00007FF9F2F40000-0x00007FF9F2F66000-memory.dmp
memory/1848-1355-0x00007FFA03E20000-0x00007FFA03E4E000-memory.dmp
memory/1848-1354-0x00007FF9F6540000-0x00007FF9F6B29000-memory.dmp
memory/1848-1433-0x00007FF9F2F00000-0x00007FF9F2F38000-memory.dmp
memory/1848-1434-0x00007FF9F2EF0000-0x00007FF9F2EFB000-memory.dmp
memory/1848-1350-0x00007FFA08490000-0x00007FFA0849D000-memory.dmp
memory/1848-1435-0x00007FF9F2EE0000-0x00007FF9F2EEB000-memory.dmp
memory/1848-1347-0x00007FFA03E50000-0x00007FFA03E86000-memory.dmp
memory/1848-1436-0x00007FF9F2ED0000-0x00007FF9F2EDC000-memory.dmp
memory/1848-1430-0x00007FF9F2F80000-0x00007FF9F2F9C000-memory.dmp
memory/1848-1437-0x00007FF9F2EC0000-0x00007FF9F2ECB000-memory.dmp
memory/1848-1340-0x00007FFA09BA0000-0x00007FFA09BB9000-memory.dmp
memory/1848-1438-0x00007FF9F2EB0000-0x00007FF9F2EBC000-memory.dmp
memory/1848-1440-0x00007FF9F2E90000-0x00007FF9F2E9C000-memory.dmp
memory/1848-1441-0x00007FF9F2E80000-0x00007FF9F2E8D000-memory.dmp
memory/1848-1442-0x00007FF9F2E70000-0x00007FF9F2E7E000-memory.dmp
memory/1848-1443-0x00007FF9F2E60000-0x00007FF9F2E6C000-memory.dmp
memory/1848-1422-0x00007FF9F3AB0000-0x00007FF9F5BA3000-memory.dmp
memory/1848-1403-0x00007FF9F6C00000-0x00007FF9F6C54000-memory.dmp
memory/1848-1410-0x00007FF9F6BB0000-0x00007FF9F6BD1000-memory.dmp
memory/1848-1411-0x00007FF9F6B80000-0x00007FF9F6BA2000-memory.dmp
memory/1848-1412-0x00007FF9F3A10000-0x00007FF9F3AAC000-memory.dmp
memory/1848-1413-0x00007FF9F39E0000-0x00007FF9F3A10000-memory.dmp
memory/1848-1415-0x00007FF9F38F0000-0x00007FF9F390D000-memory.dmp
memory/1848-1416-0x00007FF9F38D0000-0x00007FF9F38E3000-memory.dmp
memory/1848-1417-0x00007FF9F39A0000-0x00007FF9F39D3000-memory.dmp
memory/1848-1418-0x00007FF9F6B60000-0x00007FF9F6B74000-memory.dmp
memory/1848-1419-0x00007FF9F3930000-0x00007FF9F394A000-memory.dmp
memory/1848-1420-0x00007FF9F3910000-0x00007FF9F3929000-memory.dmp
memory/1848-1421-0x00007FF9F3810000-0x00007FF9F38C4000-memory.dmp
memory/1848-1414-0x00007FF9F3950000-0x00007FF9F3997000-memory.dmp
memory/1848-1409-0x00007FF9F6BE0000-0x00007FF9F6BF7000-memory.dmp
memory/1848-1404-0x00007FF9FC2F0000-0x00007FF9FC2FE000-memory.dmp
memory/1848-1408-0x00007FF9F3AB0000-0x00007FF9F5BA3000-memory.dmp
memory/1848-1405-0x00007FFA03650000-0x00007FFA03665000-memory.dmp
memory/1848-1406-0x00007FF9FC300000-0x00007FF9FC314000-memory.dmp
memory/1848-1407-0x00007FF9F5BB0000-0x00007FF9F5E8F000-memory.dmp
memory/1848-1400-0x00007FF9FECC0000-0x00007FF9FECCF000-memory.dmp
memory/1848-1378-0x00007FFA03610000-0x00007FFA0362B000-memory.dmp
memory/1848-1372-0x00007FFA03280000-0x00007FFA0333C000-memory.dmp
memory/1848-1366-0x00007FFA05C50000-0x00007FFA05C65000-memory.dmp
memory/1848-1362-0x00007FFA03D60000-0x00007FFA03D93000-memory.dmp
memory/1848-1361-0x00007FFA03DA0000-0x00007FFA03DCB000-memory.dmp
memory/1848-1343-0x00007FFA09980000-0x00007FFA09999000-memory.dmp
memory/1848-1341-0x00007FFA03E90000-0x00007FFA03EBD000-memory.dmp
memory/1848-1295-0x00007FFA079E0000-0x00007FFA07A03000-memory.dmp
memory/1848-1298-0x00007FFA0D580000-0x00007FFA0D58F000-memory.dmp
memory/1848-1287-0x00007FF9F6540000-0x00007FF9F6B29000-memory.dmp
memory/1848-1472-0x00007FFA031B0000-0x00007FFA0327D000-memory.dmp
memory/1848-1480-0x00007FFA07980000-0x00007FFA0798C000-memory.dmp
memory/1848-1476-0x00007FFA02F30000-0x00007FFA031A8000-memory.dmp
memory/1848-1479-0x00007FFA079C0000-0x00007FFA079CF000-memory.dmp
memory/1848-1478-0x00007FFA03650000-0x00007FFA03665000-memory.dmp
memory/1848-1477-0x00007FFA03970000-0x00007FFA03986000-memory.dmp
memory/1848-1475-0x00007FFA03990000-0x00007FFA039A1000-memory.dmp
memory/1848-1474-0x00007FFA039B0000-0x00007FFA039C2000-memory.dmp
memory/1848-1473-0x00007FFA05C50000-0x00007FFA05C65000-memory.dmp
memory/1848-1471-0x00007FF9F6020000-0x00007FF9F6540000-memory.dmp
memory/1848-1470-0x00007FFA03D60000-0x00007FFA03D93000-memory.dmp
memory/1848-1468-0x00007FFA03280000-0x00007FFA0333C000-memory.dmp
memory/1848-1467-0x00007FFA03E20000-0x00007FFA03E4E000-memory.dmp
memory/1848-1466-0x00007FFA08490000-0x00007FFA0849D000-memory.dmp
memory/1848-1465-0x00007FFA03E50000-0x00007FFA03E86000-memory.dmp
memory/1848-1464-0x00007FFA0CF70000-0x00007FFA0CF7D000-memory.dmp
memory/1848-1463-0x00007FFA09980000-0x00007FFA09999000-memory.dmp
memory/1848-1469-0x00007FFA03DA0000-0x00007FFA03DCB000-memory.dmp
memory/1848-1458-0x00007FF9F6540000-0x00007FF9F6B29000-memory.dmp