Overview

overview

7

Static

static

3

2026-09-23...ar.exe

windows10-2004-x64

7

2026-09-23...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 01:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-23_c52012e72e4ab38ac6e9020e0204e0c9_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
  • Size 5.4MB
  • Sample260924-b37a6abd76
  • SHA256 b0ae81393fbb91a07db2fc75d01a72d95d3e2d92c20993b1e0c26e61fb4dd68a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_c52012e72e4ab38ac6e9020e0204e0c9_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_c52012e72e4ab38ac6e9020e0204e0c9_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4536
    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_c52012e72e4ab38ac6e9020e0204e0c9_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_c52012e72e4ab38ac6e9020e0204e0c9_cobalt-strike_glassworm_icedid_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:5992

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45362\VCRUNTIME140.dll
        • Size 87KB
        • SHA256 bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45362\_ctypes.pyd
        • Size 129KB
        • SHA256 6f46a4c9a31b4c7ee32fac923c5729fd7060d55388af183e0f25b7b3cd7fa9e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45362\base_library.zip
        • Size 768KB
        • SHA256 92f8adf2cdf4b38597c8c5608ec347d3cb756503590c95d753ad69cb42cb5d68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python37.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45362\python37.dll
        • Size 3.6MB
        • SHA256 08686f0e6e3c54d455d4a4801d5deccadedbafd1e010b3d18ade81180853db27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windows.exe.manifest
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI45362\windows.exe.manifest
        • Size 1KB
        • SHA256 b4c6d38bbcf77710a3cdf4870be2b31a1059850b84266cc167a9e5ceae578f73
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/5992-24-0x000001D1BB550000-0x000001D1BB551000-memory.dmp
        Download