Overview

overview

7

Static

static

3

2026-09-25...ar.exe

windows10-2004-x64

7

2026-09-25...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/09/2026, 17:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-25_e9988a9ad1f77cd9fc44c337aa9224ad_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 6.1MB
  • Sample260925-why49ssgkc
  • SHA256 30676faa250f81ad52a107ddba053799f93c6fb456e52d58d437c5c5c9a36c82
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Loads dropped DLL 15 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-25_e9988a9ad1f77cd9fc44c337aa9224ad_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-25_e9988a9ad1f77cd9fc44c337aa9224ad_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Users\Admin\AppData\Local\Temp\2026-09-25_e9988a9ad1f77cd9fc44c337aa9224ad_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-25_e9988a9ad1f77cd9fc44c337aa9224ad_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      PID:5032
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4180

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\VCRUNTIME140.dll
          • Size 93KB
          • SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_bz2.pyd
          • Size 85KB
          • SHA256 ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_ctypes.pyd
          • Size 124KB
          • SHA256 820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_hashlib.pyd
          • Size 46KB
          • SHA256 a30cf1a40e0b09610e34be187f1396ac5a44dcfb27bc7ff9b450d1318b694c1b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_lzma.pyd
          • Size 159KB
          • SHA256 9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_socket.pyd
          • Size 78KB
          • SHA256 87832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\_ssl.pyd
          • Size 152KB
          • SHA256 0a721fc230eca278a69a2006e13dfa00e698274281378d4df35227e1f68ea3e0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\base_library.zip
          • Size 1008KB
          • SHA256 6f0f43477d1fda625f853edece7bfad275906924eecd48a8549ac79b6f4785fa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\libcrypto-1_1.dll
          • Size 3.2MB
          • SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-7.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\libffi-7.dll
          • Size 32KB
          • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\libssl-1_1.dll
          • Size 674KB
          • SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python38.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\python38.dll
          • Size 4.0MB
          • SHA256 2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\select.pyd
          • Size 27KB
          • SHA256 fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          tinyaes.cp38-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\tinyaes.cp38-win_amd64.pyd
          • Size 31KB
          • SHA256 83c3532c4355dfe635df4462da7bd767d8c96bf85cb60f80072cec3cf1da24c1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ucrtbase.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\ucrtbase.dll
          • Size 987KB
          • SHA256 10521fe73fe05f2ba95d40757d9f676f2091e2ed578da9d5cdef352f986f3bcd
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI24682\unicodedata.pyd
          • Size 1.0MB
          • SHA256 d8091e62c74e1b2b648086f778c3c41ce01f09661a75ea207d3fea2cf26a8762
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download