5ef1884589ff53368d95d8b7de2260bcaa676663fe9e06e67e1d13140ec00ab7

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_2c557afcf8b7280cc2e35e00c261674f_cobalt-strike_glassworm_icedid_ryuk_satacom.exe
Size 2.8MB
Sample260925-p3b2xaec45
SHA256 5ef1884589ff53368d95d8b7de2260bcaa676663fe9e06e67e1d13140ec00ab7
MD5 2c557afcf8b7280cc2e35e00c261674f
SHA1 93c8524577812ce3f843c2b73d333c55f2923ffd
SHA512 502aa6b0e33e279adb3e03ef4fedb2e41da97d66f9341e2a2342137eb0cccfc25749435959d1f0e882df3c90d6b8832f8d04bd289fab40ba0763bcea444c14a4
SSDEEP 49152:dq98gD9Nh0j4++QW7jUuPwrtfnKe+V6oGgoji5Br9W16VkrFrk+SbKhBV3x/Y:dq9pjQRnb0ZW16Pmn
TLSH
T147D5AF425ED510A4D2E3A13851D75652C237BD100F34AEFB32DC72A93FB3A89A47AB17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	2026-09-24_2c557afcf8b7280cc2e35e00c261674f_cobalt-strike_glassworm_icedid_ryuk_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	2026-09-24_2c557afcf8b7280cc2e35e00c261674f_cobalt-strike_glassworm_icedid_ryuk_satacom.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-24_2c557afcf8b7280cc2e35e00c261674f_cobalt-strike_glassworm_icedid_ryuk_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_2c557afcf8b7280cc2e35e00c261674f_cobalt-strike_glassworm_icedid_ryuk_satacom.exe"
1⤵
- Maps connected drives based on registry
PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads