Overview

overview

9

Static

static

3

2026-09-30...ar.exe

windows10-2004-x64

8

2026-09-30...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/10/2026, 14:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-30_58da2608cd2d8d0e0d7c496202ea2477_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 12.1MB
  • Sample261001-rbkk3stses
  • SHA256 55317deaff572e877f05ec29b9286accbda249155f8e2a01e0a833b6900fdb05
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscovery

Malware Config

Signatures

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 25 IoCs
  • Drops file in System32 directory 17 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 48 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_58da2608cd2d8d0e0d7c496202ea2477_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_58da2608cd2d8d0e0d7c496202ea2477_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_58da2608cd2d8d0e0d7c496202ea2477_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-09-30_58da2608cd2d8d0e0d7c496202ea2477_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:624
      • C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\wireguard.exe
        C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\wireguard.exe /uninstalltunnelservice tw-tai
        3⤵
        • Executes dropped EXE
        PID:4388
      • C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\wireguard.exe
        C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\wireguard.exe /uninstalltunnelservice hk-hkg
        3⤵
        • Executes dropped EXE
        PID:5372
      • C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\wireguard.exe
        C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\wireguard.exe /uninstalltunnelservice jp-tok
        3⤵
        • Executes dropped EXE
        PID:4748
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM wireguard.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4148
      • C:\Windows\SYSTEM32\taskkill.exe
        taskkill /F /IM wireguard.exe /T
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2220
      • C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\wireguard.exe
        C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\wireguard.exe /installtunnelservice C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tw-tai.conf
        3⤵
        • Executes dropped EXE
        PID:1096
  • C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\wireguard.exe
    C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\wireguard.exe /tunnelservice C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tw-tai.conf
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    PID:992
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "9" "C:\Windows\Temp\8447aaab8dc768a35555bdd834d8332727b1f0004b2f4b5d4a505bbca7ba0599\wireguard.inf" "9" "4121bf993" "000000000000014C" "Service-0x0-3e7$\Default" "0000000000000178" "208" "C:\Windows\Temp\8447aaab8dc768a35555bdd834d8332727b1f0004b2f4b5d4a505bbca7ba0599"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:956
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "0" "SWD\WireGuard\{0E2F34DB-4132-8461-5B03-9E10FCE6586D}" "" "" "43ee97943" "0000000000000000" "206c"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:1496

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\_asyncio.pyd
        • Size 69KB
        • SHA256 7a5c88ce496bafdf31a94ae6d70b017070703bc0a7da1dfae7c12b21bb61030d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\_bz2.pyd
        • Size 83KB
        • SHA256 324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\_ctypes.pyd
        • Size 122KB
        • SHA256 8978972cf341ccd0edf8435d63909a739df7ef29ec7dd57ed5cab64b342891f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\_lzma.pyd
        • Size 156KB
        • SHA256 6d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\_overlapped.pyd
        • Size 54KB
        • SHA256 46dec978ec8cb2146854739bfeddea93335dcc92a25d719352b94f9517855032
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\_queue.pyd
        • Size 31KB
        • SHA256 76bba42b1392dc57a867aef385b990fa302a4f1dcf453705ac119c9c98a36e8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\_socket.pyd
        • Size 81KB
        • SHA256 2c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\_ssl.pyd
        • Size 174KB
        • SHA256 68dad60ff6fb36c88ef1c47d1855517bfe8de0f5ddea0f630b65b622a645d53a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\_tkinter.pyd
        • Size 64KB
        • SHA256 f0ebdf2ca7b33c26b8938efa59678068d3840957ee79d2b3c576437f8f913f20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\_wmi.pyd
        • Size 36KB
        • SHA256 5818679010bb536a3d463eeee8ce203e880a8cd1c06bf1cb6c416ab0dc024d94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\libssl-3.dll
        • Size 768KB
        • SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _psutil_windows.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\psutil\_psutil_windows.pyd
        • Size 69KB
        • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\python3.dll
        • Size 66KB
        • SHA256 29f173e0147390a99f541ba0c0231fdd7dfbca84d0e2e561ef352bf1ec72f5db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\python312.dll
        • Size 6.6MB
        • SHA256 8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\select.pyd
        • Size 30KB
        • SHA256 678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tcl86t.dll
        • Size 1.7MB
        • SHA256 fe62ca2b01b0ec8a609b48f165ca9c6a91653d3966239243ad352dd4c8961760
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msgcat-1.6.1.tm
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tcl8\8.5\msgcat-1.6.1.tm
        • Size 34KB
        • SHA256 6774519f179872ec5292523f2788b77b2b839e15665037e097a0d4edddd1c6fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        auto.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tcl\auto.tcl
        • Size 21KB
        • SHA256 517204ee436d08efc287abc97433c3bffcaf42ec6592a3009b9fd3b985ad772c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tcl\encoding\cp1252.enc
        • Size 1KB
        • SHA256 741859cf238c3a63bbb20ec6ed51e46451372bb221cfff438297d261d0561c2e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        pkgIndex.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tcl\http1.0\pkgIndex.tcl
        • Size 746B
        • SHA256 77265723959c092897c2449c5b7768ca72d0efcd8c505bddbb7a84f6aa401339
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        init.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tcl\init.tcl
        • Size 25KB
        • SHA256 7a103a85413988456c2ad615c879bbcb4d91435bcfbbe23393e0eb52b56af6e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pkgIndex.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tcl\opt0.4\pkgIndex.tcl
        • Size 620B
        • SHA256 6a4abd2c519a745325c26fb23be7bbf95252d653a24806eb37fd4aa6a6479afe
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        package.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tcl\package.tcl
        • Size 23KB
        • SHA256 f46ab61cdebe3aa45fa7e61a48930d64a0d0e7e94d04d6bf244f48c36cafe948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tclIndex
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tcl\tclIndex
        • Size 5KB
        • SHA256 ddf7e42def37888ad0a564aa4f8ca95f4eec942cebebfca851d35515104d5c89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tm.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tcl\tm.tcl
        • Size 11KB
        • SHA256 4b7ed9fd2363d6876092db3f720cbddf97e72b86b519403539ba96e1c815ed8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tk86t.dll
        • Size 1.5MB
        • SHA256 afc13fce0690c0a4b449ec7ed4fb0233a8359911c1c0ba26a285f32895dbb3d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        button.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tk\button.tcl
        • Size 21KB
        • SHA256 1f5dd8d81b26f16e772e92fd2a22accb785004d0ed3447e54f87005d9c6a07a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        entry.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tk\entry.tcl
        • Size 18KB
        • SHA256 65ba33a1e0b21e8e074780a51189cee6fd9926c85273e9e7633987fc212a17b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icons.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tk\icons.tcl
        • Size 10KB
        • SHA256 1264940e62b9a37967925418e9d0dc0befd369e8c181b9bab3d1607e3cc14b85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        listbox.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tk\listbox.tcl
        • Size 14KB
        • SHA256 47c75f9f8348bf8f2c086c57b97b73741218100ca38d10b8abdf2051c95b9801
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        menu.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tk\menu.tcl
        • Size 38KB
        • SHA256 312af944a276cdbf1ee00757ef141595670984f7f13e19922c25643a040f5339
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pkgIndex.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tk\pkgIndex.tcl
        • Size 376B
        • SHA256 a5d208887a94832328c3a33928a80f3b46aa205c20db4f050a47d940e94071b4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        tk.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\tk\tk.tcl
        • Size 23KB
        • SHA256 1d5e7518afc1382e36bf13fc5196c8a7cd93a4e9d24acf445522564245a489b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        twms_helper.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\twms_helper.dll
        • Size 12.6MB
        • SHA256 3a8a375803d90cc0fd6ca58102fe14cbe3e1201330fa22189e3b52c2fdbe4126
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\vcruntime140_1.dll
        • Size 48KB
        • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wireguard.exe
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\wireguard.exe
        • Size 7.8MB
        • SHA256 32717d15b57965adf78b33f61db32cb26e11759dd78d441a218dd349c731a160
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        zlib1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_4212_928769_5JcNWIOCQ4U\zlib1.dll
        • Size 143KB
        • SHA256 28484bcea1e387c4a41564af8f62c040fe203fe2491e415ce90f3d7f5c7ab013
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wireguard.inf_amd64_bd22474b85ad1b6f.ini
        • Path C:\Windows\System32\DriverStore\FileRepository\wireguard.inf_amd64_bd22474b85ad1b6f.ini
        • Size 428B
        • SHA256 d0fbcabc4352821146a10d01cddf5a1ecc343fceb514dde1d0ce4a7f8c0dc858
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        wireguard.inf
        • Path C:\Windows\Temp\8447aaab8dc768a35555bdd834d8332727b1f0004b2f4b5d4a505bbca7ba0599\wireguard.inf
        • Size 2KB
        • SHA256 079e58e9b00de894557bae8feb40cc578070376a52971bd733d74e8955b3b126
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/624-1125-0x00007FF9FED40000-0x00007FF9FED6A000-memory.dmp
        Download

        memory/992-1029-0x0000000180000000-0x0000000180148000-memory.dmp
        Download

        memory/992-1027-0x0000000180000000-0x0000000180148000-memory.dmp
        Download

        memory/992-1025-0x0000000180000000-0x0000000180148000-memory.dmp
        Download

        memory/992-1024-0x0000000180000000-0x0000000180148000-memory.dmp
        Download

        memory/992-1028-0x0000000180000000-0x0000000180148000-memory.dmp
        Download

        memory/992-1030-0x0000000180000000-0x0000000180148000-memory.dmp
        Download

        memory/992-1026-0x0000000180000000-0x0000000180148000-memory.dmp
        Download