65209dd9351149dd9273b9ec6c28527a049b93a9a1711b1f240d39c68d4b9593

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 11:21

Target
2026-09-28_d8b645756db34bcb3aaf91893e48a491_cobalt-strike_coinminer_glassworm_megazord_njrat_satacom_vidar.exe
Size 11.9MB
Sample260928-nf32faad99
SHA256 65209dd9351149dd9273b9ec6c28527a049b93a9a1711b1f240d39c68d4b9593
MD5 d8b645756db34bcb3aaf91893e48a491
SHA1 00e218a343b41bbe1a7872e739650859e98557a0
SHA512 2fbbe1059a8168954494548c7aa6962175203538d3829932959040dcd646bd2702155352a93e7632dd438211c41b216b9b38f582dd5193d2c1c213d2e76900a7
SSDEEP 196608:En2g4J2RybiRHEy7u3GX5HJkNWHxABwR:ER4J2Rybih37u3GX5ZHqCR
TLSH
T147C67C5763F510D8D1BBD2788A3B8112DAB27C590734A7DF06A089662F63FE09E7D321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5048 set thread context of 5200	5048	2026-09-28_d8b645756db34bcb3aaf91893e48a491_cobalt-strike_coinminer_glassworm_megazord_njrat_satacom_vidar.exe	90

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 5200	5048	2026-09-28_d8b645756db34bcb3aaf91893e48a491_cobalt-strike_coinminer_glassworm_megazord_njrat_satacom_vidar.exe	90
PID 5048 wrote to memory of 5200	5048	2026-09-28_d8b645756db34bcb3aaf91893e48a491_cobalt-strike_coinminer_glassworm_megazord_njrat_satacom_vidar.exe	90
PID 5048 wrote to memory of 5200	5048	2026-09-28_d8b645756db34bcb3aaf91893e48a491_cobalt-strike_coinminer_glassworm_megazord_njrat_satacom_vidar.exe	90
PID 5048 wrote to memory of 5200	5048	2026-09-28_d8b645756db34bcb3aaf91893e48a491_cobalt-strike_coinminer_glassworm_megazord_njrat_satacom_vidar.exe	90
PID 5048 wrote to memory of 5200	5048	2026-09-28_d8b645756db34bcb3aaf91893e48a491_cobalt-strike_coinminer_glassworm_megazord_njrat_satacom_vidar.exe	90
PID 5048 wrote to memory of 5200	5048	2026-09-28_d8b645756db34bcb3aaf91893e48a491_cobalt-strike_coinminer_glassworm_megazord_njrat_satacom_vidar.exe	90
PID 5048 wrote to memory of 5200	5048	2026-09-28_d8b645756db34bcb3aaf91893e48a491_cobalt-strike_coinminer_glassworm_megazord_njrat_satacom_vidar.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-09-28_d8b645756db34bcb3aaf91893e48a491_cobalt-strike_coinminer_glassworm_megazord_njrat_satacom_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-28_d8b645756db34bcb3aaf91893e48a491_cobalt-strike_coinminer_glassworm_megazord_njrat_satacom_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\2026-09-28_d8b645756db34bcb3aaf91893e48a491_cobalt-strike_coinminer_glassworm_megazord_njrat_satacom_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-28_d8b645756db34bcb3aaf91893e48a491_cobalt-strike_coinminer_glassworm_megazord_njrat_satacom_vidar.exe"
  2⤵
  PID:5200

memory/5048-0-0x0000000140000000-0x0000000140D6E000-memory.dmp

Download

memory/5048-3-0x0000000140000000-0x0000000140D6E000-memory.dmp

Download

memory/5200-1-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/5200-2-0x0000000140000000-0x0000000140050000-memory.dmp

Download