c78217d529721a9dada0e92b6b1b3c212b1d67bce5593d2408054a483e5d9a62

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 15:13

Target
2026-09-30_46e9f925599b22f8c077f5ed19a5e5c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Size 884KB
Sample261001-sl3p3sty5m
SHA256 c78217d529721a9dada0e92b6b1b3c212b1d67bce5593d2408054a483e5d9a62
MD5 46e9f925599b22f8c077f5ed19a5e5c4
SHA1 2b0d335e7cdf0e5c63bf0bb62ecc4dfa33aec39f
SHA512 976109e92f432b0a0831ea295cb046f1c3a04b12edd4d5d1c0237e87f0ed6b76e2e9c864a73036d3bed9563c213a27021c70d6048d36c2f045304a67a7e1c640
SSDEEP 12288:U4RbIzhC8ay677u8I4Bpyyl6MOqI3DizBsHgfoZLhYDXAn6LpD/9W1qkfnj2vpfj:J0Ay6XTHyyADizpoLn6LpDcU+j29
TLSH
T17B156D16E66400BDD0B7C6B4CE665D43D772B84B0331AADB03D06AA63F277E45A3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-30_46e9f925599b22f8c077f5ed19a5e5c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-30_46e9f925599b22f8c077f5ed19a5e5c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-09-30_46e9f925599b22f8c077f5ed19a5e5c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-09-30_46e9f925599b22f8c077f5ed19a5e5c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 3880	2592	2026-09-30_46e9f925599b22f8c077f5ed19a5e5c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	89
PID 2592 wrote to memory of 3880	2592	2026-09-30_46e9f925599b22f8c077f5ed19a5e5c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	89
PID 2592 wrote to memory of 2792	2592	2026-09-30_46e9f925599b22f8c077f5ed19a5e5c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	91
PID 2592 wrote to memory of 2792	2592	2026-09-30_46e9f925599b22f8c077f5ed19a5e5c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-09-30_46e9f925599b22f8c077f5ed19a5e5c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_46e9f925599b22f8c077f5ed19a5e5c4_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --disable-gpu-sandbox --disable-dev-shm-usage
  2⤵
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --disable-gpu-sandbox --disable-dev-shm-usage
  2⤵
  PID:2792

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4712

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6036