Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
13/09/2026, 01:53
General
- Target 2026-09-12_510b708135bcf4fe4e3c8798c92d84fa_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
- Size 84.7MB
- Sample260913-cbc4nsde89
- SHA256 379a1752955de62caa0bfd85ceef3a1226d15c22ca364be65f481613f72c9663
Malware Config
Signatures
- Loads dropped DLL 64 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_510b708135bcf4fe4e3c8798c92d84fa_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_510b708135bcf4fe4e3c8798c92d84fa_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_510b708135bcf4fe4e3c8798c92d84fa_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_510b708135bcf4fe4e3c8798c92d84fa_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
SDL2.dll
SDL2_image.dll
SDL2_mixer.dll
SDL2_ttf.dll
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_cffi_backend.cp311-win_amd64.pyd
_ctypes.pyd
_decimal.pyd
_elementtree.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_tkinter.pyd
_uuid.pyd
_zoneinfo.pyd
base_library.zip
freetype.dll
libcrypto-3.dll
libffi-8.dll
libjpeg-9.dll
libmodplug-1.dll
libogg-0.dll
libopus-0.dll
libopusfile-0.dll
libpng16-16.dll
libssl-3.dll
libtiff-5.dll
libwebp-7.dll
portmidi.dll
pyexpat.pyd
python3.DLL
python311.dll
pythoncom311.dll
pywintypes311.dll
select.pyd
sqlite3.dll
tcl86t.dll
tk86t.dll
unicodedata.pyd
win32api.pyd
zlib1.dll
memory/3564-1407-0x00007FFF45490000-0x00007FFF459B0000-memory.dmp
memory/3564-1286-0x00007FFF46E60000-0x00007FFF47449000-memory.dmp
memory/3564-1395-0x00007FFF50330000-0x00007FFF50345000-memory.dmp
memory/3564-1394-0x00007FFF50350000-0x00007FFF50360000-memory.dmp
memory/3564-1393-0x00007FFF50360000-0x00007FFF50376000-memory.dmp
memory/3564-1392-0x00007FFF524B0000-0x00007FFF524BE000-memory.dmp
memory/3564-1391-0x00007FFF52950000-0x00007FFF5295E000-memory.dmp
memory/3564-1390-0x00007FFF56570000-0x00007FFF5657F000-memory.dmp
memory/3564-1389-0x00007FFF57290000-0x00007FFF5729E000-memory.dmp
memory/3564-1388-0x0000000062E80000-0x0000000062EA8000-memory.dmp
memory/3564-1387-0x000000006A880000-0x000000006A8AB000-memory.dmp
memory/3564-1386-0x0000000068B40000-0x0000000068B81000-memory.dmp
memory/3564-1385-0x00007FFF57580000-0x00007FFF5758E000-memory.dmp
memory/3564-1384-0x00007FFF50380000-0x00007FFF50391000-memory.dmp
memory/3564-1383-0x00007FFF503A0000-0x00007FFF503B4000-memory.dmp
memory/3564-1382-0x00007FFF503C0000-0x00007FFF503D6000-memory.dmp
memory/3564-1381-0x00007FFF503E0000-0x00007FFF50424000-memory.dmp
memory/3564-1380-0x00007FFF50430000-0x00007FFF50445000-memory.dmp
memory/3564-1379-0x00007FFF524C0000-0x00007FFF524DB000-memory.dmp
memory/3564-1377-0x00007FFF540B0000-0x00007FFF540C1000-memory.dmp
memory/3564-1376-0x00007FFF583F0000-0x00007FFF583FC000-memory.dmp
memory/3564-1375-0x00007FFF58820000-0x00007FFF5882F000-memory.dmp
memory/3564-1374-0x00007FFF55FE0000-0x00007FFF55FF5000-memory.dmp
memory/3564-1373-0x00007FFF4AFD0000-0x00007FFF4B248000-memory.dmp
memory/3564-1357-0x00007FFF5C320000-0x00007FFF5C3DC000-memory.dmp
memory/3564-1398-0x00007FFF4AE40000-0x00007FFF4AFC6000-memory.dmp
memory/3564-1399-0x00007FFF5C320000-0x00007FFF5C3DC000-memory.dmp
memory/3564-1352-0x00007FFF5C3F0000-0x00007FFF5C41E000-memory.dmp
memory/3564-1401-0x00007FFF5C2A0000-0x00007FFF5C2CB000-memory.dmp
memory/3564-1402-0x00007FFF50250000-0x00007FFF5025F000-memory.dmp
memory/3564-1347-0x00007FFF5C430000-0x00007FFF5C466000-memory.dmp
memory/3564-1345-0x00007FFF5DAF0000-0x00007FFF5DAFD000-memory.dmp
memory/3564-1404-0x00007FFF4E1A0000-0x00007FFF4E1F4000-memory.dmp
memory/3564-1343-0x00007FFF5DCA0000-0x00007FFF5DCB9000-memory.dmp
memory/3564-1405-0x00007FFF512D0000-0x00007FFF5139D000-memory.dmp
memory/3564-1411-0x00007FFF5C300000-0x00007FFF5C315000-memory.dmp
memory/3564-1408-0x000002171EC10000-0x000002171F130000-memory.dmp
memory/3564-1410-0x00007FFF48740000-0x00007FFF48A1F000-memory.dmp
memory/3564-1409-0x00007FFF4FB60000-0x00007FFF4FB6E000-memory.dmp
memory/3564-1406-0x00007FFF50230000-0x00007FFF50244000-memory.dmp
memory/3564-1403-0x00007FFF5C260000-0x00007FFF5C293000-memory.dmp
memory/3564-1400-0x00007FFF5A400000-0x00007FFF5A416000-memory.dmp
memory/3564-1397-0x00007FFF50300000-0x00007FFF5030F000-memory.dmp
memory/3564-1378-0x00007FFF581B0000-0x00007FFF581BE000-memory.dmp
memory/3564-1359-0x00007FFF5DB30000-0x00007FFF5DB53000-memory.dmp
memory/3564-1363-0x00007FFF5DFA0000-0x00007FFF5DFB9000-memory.dmp
memory/3564-1366-0x00007FFF45490000-0x00007FFF459B0000-memory.dmp
memory/3564-1368-0x00007FFF5DCA0000-0x00007FFF5DCB9000-memory.dmp
memory/3564-1370-0x00007FFF5C240000-0x00007FFF5C252000-memory.dmp
memory/3564-1372-0x00007FFF5C3F0000-0x00007FFF5C41E000-memory.dmp
memory/3564-1371-0x00007FFF5C220000-0x00007FFF5C231000-memory.dmp
memory/3564-1369-0x00007FFF5C300000-0x00007FFF5C315000-memory.dmp
memory/3564-1367-0x000002171EC10000-0x000002171F130000-memory.dmp
memory/3564-1365-0x00007FFF5DB00000-0x00007FFF5DB2D000-memory.dmp
memory/3564-1364-0x00007FFF512D0000-0x00007FFF5139D000-memory.dmp
memory/3564-1362-0x00007FFF5C260000-0x00007FFF5C293000-memory.dmp
memory/3564-1360-0x00007FFF5C2A0000-0x00007FFF5C2CB000-memory.dmp
memory/3564-1356-0x00007FFF46E60000-0x00007FFF47449000-memory.dmp
memory/3564-1350-0x00007FFF5C420000-0x00007FFF5C42D000-memory.dmp
memory/3564-1300-0x00007FFF5DFA0000-0x00007FFF5DFB9000-memory.dmp
memory/3564-1298-0x00007FFF5FCB0000-0x00007FFF5FCBF000-memory.dmp
memory/3564-1303-0x00007FFF5DB00000-0x00007FFF5DB2D000-memory.dmp
memory/3564-1295-0x00007FFF5DB30000-0x00007FFF5DB53000-memory.dmp
memory/3564-1396-0x00007FFF50310000-0x00007FFF50327000-memory.dmp
memory/3564-1412-0x00007FFF43390000-0x00007FFF45483000-memory.dmp
memory/3564-1413-0x00007FFF4C180000-0x00007FFF4C197000-memory.dmp
memory/3564-1416-0x00007FFF4C150000-0x00007FFF4C171000-memory.dmp
memory/3564-1415-0x00007FFF4AFD0000-0x00007FFF4B248000-memory.dmp
memory/3564-1417-0x00007FFF4C120000-0x00007FFF4C142000-memory.dmp
memory/3564-1418-0x00007FFF49C20000-0x00007FFF49CBC000-memory.dmp
memory/3564-1420-0x00007FFF4AE10000-0x00007FFF4AE40000-memory.dmp
memory/3564-1421-0x00007FFF4ADD0000-0x00007FFF4AE03000-memory.dmp
memory/3564-1423-0x00007FFF49BD0000-0x00007FFF49C17000-memory.dmp
memory/3564-1425-0x00007FFF4A5E0000-0x00007FFF4A5FA000-memory.dmp
memory/3564-1424-0x00007FFF48740000-0x00007FFF48A1F000-memory.dmp
memory/3564-1422-0x00007FFF4C100000-0x00007FFF4C114000-memory.dmp
memory/3564-1431-0x00007FFF49B70000-0x00007FFF49B83000-memory.dmp
memory/3564-1433-0x00007FFF48680000-0x00007FFF48734000-memory.dmp
memory/3564-1435-0x00007FFF49B50000-0x00007FFF49B61000-memory.dmp
memory/3564-1439-0x00007FFF46B80000-0x00007FFF46C9C000-memory.dmp
memory/3564-1442-0x00007FFF48660000-0x00007FFF48672000-memory.dmp
memory/3564-1443-0x00007FFF4A5E0000-0x00007FFF4A5FA000-memory.dmp
memory/3564-1441-0x00007FFF49BD0000-0x00007FFF49C17000-memory.dmp
memory/3564-1440-0x00007FFF49500000-0x00007FFF4951B000-memory.dmp
memory/3564-1438-0x00007FFF4ADD0000-0x00007FFF4AE03000-memory.dmp
memory/3564-1437-0x00007FFF49B30000-0x00007FFF49B44000-memory.dmp
memory/3564-1436-0x00007FFF4AE10000-0x00007FFF4AE40000-memory.dmp
memory/3564-1434-0x00007FFF49C20000-0x00007FFF49CBC000-memory.dmp
memory/3564-1432-0x00007FFF4C120000-0x00007FFF4C142000-memory.dmp
memory/3564-1430-0x00007FFF4C150000-0x00007FFF4C171000-memory.dmp
memory/3564-1429-0x00007FFF49B90000-0x00007FFF49BAD000-memory.dmp
memory/3564-1428-0x00007FFF4C180000-0x00007FFF4C197000-memory.dmp
memory/3564-1427-0x00007FFF49BB0000-0x00007FFF49BC9000-memory.dmp
memory/3564-1426-0x00007FFF43390000-0x00007FFF45483000-memory.dmp
memory/3564-1419-0x00007FFF50250000-0x00007FFF5025F000-memory.dmp
memory/3564-1414-0x00007FFF5C220000-0x00007FFF5C231000-memory.dmp
memory/3564-1498-0x00007FFF55FE0000-0x00007FFF55FF5000-memory.dmp
memory/3564-1478-0x00007FFF46E60000-0x00007FFF47449000-memory.dmp
memory/3564-1491-0x00007FFF512D0000-0x00007FFF5139D000-memory.dmp
memory/3564-1490-0x00007FFF5C260000-0x00007FFF5C293000-memory.dmp
memory/3564-1483-0x00007FFF5DCA0000-0x00007FFF5DCB9000-memory.dmp
memory/3564-1479-0x00007FFF5DB30000-0x00007FFF5DB53000-memory.dmp
memory/3564-1492-0x00007FFF45490000-0x00007FFF459B0000-memory.dmp
memory/3564-1516-0x00007FFF5C300000-0x00007FFF5C315000-memory.dmp
memory/3564-1523-0x00007FFF583F0000-0x00007FFF583FC000-memory.dmp
memory/3564-1522-0x00007FFF58820000-0x00007FFF5882F000-memory.dmp
memory/3564-1521-0x00007FFF55FE0000-0x00007FFF55FF5000-memory.dmp
memory/3564-1520-0x00007FFF5A400000-0x00007FFF5A416000-memory.dmp
memory/3564-1518-0x00007FFF5C220000-0x00007FFF5C231000-memory.dmp
memory/3564-1517-0x00007FFF5C240000-0x00007FFF5C252000-memory.dmp
memory/3564-1514-0x00007FFF512D0000-0x00007FFF5139D000-memory.dmp
memory/3564-1512-0x00007FFF5C2A0000-0x00007FFF5C2CB000-memory.dmp
memory/3564-1510-0x00007FFF5C3F0000-0x00007FFF5C41E000-memory.dmp
memory/3564-1509-0x00007FFF5C420000-0x00007FFF5C42D000-memory.dmp
memory/3564-1508-0x00007FFF5C430000-0x00007FFF5C466000-memory.dmp
memory/3564-1507-0x00007FFF5DAF0000-0x00007FFF5DAFD000-memory.dmp
memory/3564-1501-0x00007FFF46E60000-0x00007FFF47449000-memory.dmp
memory/3564-1505-0x00007FFF5DB00000-0x00007FFF5DB2D000-memory.dmp
memory/3564-1502-0x00007FFF5DB30000-0x00007FFF5DB53000-memory.dmp
memory/3564-1513-0x00007FFF5C260000-0x00007FFF5C293000-memory.dmp
memory/3564-1506-0x00007FFF5DCA0000-0x00007FFF5DCB9000-memory.dmp
memory/3564-1519-0x00007FFF4AFD0000-0x00007FFF4B248000-memory.dmp
memory/3564-1515-0x00007FFF45490000-0x00007FFF459B0000-memory.dmp
memory/3564-1511-0x00007FFF5C320000-0x00007FFF5C3DC000-memory.dmp
memory/3564-1503-0x00007FFF5FCB0000-0x00007FFF5FCBF000-memory.dmp
memory/3564-1504-0x00007FFF5DFA0000-0x00007FFF5DFB9000-memory.dmp