dfc85cbb3d90cdb6012ed16ce85b26d8b90dc10b78b8e6fbb56a28ef30941d9c

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c540-558.dat	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c540-558.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c540-558.dat	INDICATOR_SUSPICIOUS_References_SecTools

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1344	powershell.exe
3484	powershell.exe
5112	powershell.exe
3160	powershell.exe
1536	powershell.exe
792	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

pid	Process
792	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4056	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

Windows security modification 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

Enumerates connected drives 3 TTPs 8 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_330920801\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_330920801\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_1604033578\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_1475086161\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_330920801\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_330920801\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_1667426773\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_1667426773\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping480_1475086161\manifest.json	msedge.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2528	powershell.exe
4388	powershell.exe
792	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5708	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4940	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5444	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{7418424F-0424-4C63-95D3-5C495267371A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
3304	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
3304	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
3304	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
3304	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
2528	powershell.exe
2528	powershell.exe
2528	powershell.exe
2528	powershell.exe
4388	powershell.exe
4388	powershell.exe
4388	powershell.exe
1536	powershell.exe
1536	powershell.exe
1536	powershell.exe
1344	powershell.exe
1344	powershell.exe
1344	powershell.exe
792	powershell.exe
792	powershell.exe
792	powershell.exe
3484	powershell.exe
3484	powershell.exe
3484	powershell.exe
4056	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
4056	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
4056	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
4056	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
5112	powershell.exe
5112	powershell.exe
5112	powershell.exe
3160	powershell.exe
3160	powershell.exe
3160	powershell.exe
3828	msedge.exe
3828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe
480	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2528	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeIncreaseQuotaPrivilege	4388	powershell.exe
Token: SeSecurityPrivilege	4388	powershell.exe
Token: SeTakeOwnershipPrivilege	4388	powershell.exe
Token: SeLoadDriverPrivilege	4388	powershell.exe
Token: SeSystemProfilePrivilege	4388	powershell.exe
Token: SeSystemtimePrivilege	4388	powershell.exe
Token: SeProfSingleProcessPrivilege	4388	powershell.exe
Token: SeIncBasePriorityPrivilege	4388	powershell.exe
Token: SeCreatePagefilePrivilege	4388	powershell.exe
Token: SeBackupPrivilege	4388	powershell.exe
Token: SeRestorePrivilege	4388	powershell.exe
Token: SeShutdownPrivilege	4388	powershell.exe
Token: SeDebugPrivilege	4388	powershell.exe
Token: SeSystemEnvironmentPrivilege	4388	powershell.exe
Token: SeRemoteShutdownPrivilege	4388	powershell.exe
Token: SeUndockPrivilege	4388	powershell.exe
Token: SeManageVolumePrivilege	4388	powershell.exe
Token: 33	4388	powershell.exe
Token: 34	4388	powershell.exe
Token: 35	4388	powershell.exe
Token: 36	4388	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	792	powershell.exe
Token: SeIncreaseQuotaPrivilege	1344	powershell.exe
Token: SeSecurityPrivilege	1344	powershell.exe
Token: SeTakeOwnershipPrivilege	1344	powershell.exe
Token: SeLoadDriverPrivilege	1344	powershell.exe
Token: SeSystemProfilePrivilege	1344	powershell.exe
Token: SeSystemtimePrivilege	1344	powershell.exe
Token: SeProfSingleProcessPrivilege	1344	powershell.exe
Token: SeIncBasePriorityPrivilege	1344	powershell.exe
Token: SeCreatePagefilePrivilege	1344	powershell.exe
Token: SeBackupPrivilege	1344	powershell.exe
Token: SeRestorePrivilege	1344	powershell.exe
Token: SeShutdownPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeSystemEnvironmentPrivilege	1344	powershell.exe
Token: SeRemoteShutdownPrivilege	1344	powershell.exe
Token: SeUndockPrivilege	1344	powershell.exe
Token: SeManageVolumePrivilege	1344	powershell.exe
Token: 33	1344	powershell.exe
Token: 34	1344	powershell.exe
Token: 35	1344	powershell.exe
Token: 36	1344	powershell.exe
Token: SeDebugPrivilege	3484	powershell.exe
Token: SeIncreaseQuotaPrivilege	792	powershell.exe
Token: SeSecurityPrivilege	792	powershell.exe
Token: SeTakeOwnershipPrivilege	792	powershell.exe
Token: SeLoadDriverPrivilege	792	powershell.exe
Token: SeSystemProfilePrivilege	792	powershell.exe
Token: SeSystemtimePrivilege	792	powershell.exe
Token: SeProfSingleProcessPrivilege	792	powershell.exe
Token: SeIncBasePriorityPrivilege	792	powershell.exe
Token: SeCreatePagefilePrivilege	792	powershell.exe
Token: SeBackupPrivilege	792	powershell.exe
Token: SeRestorePrivilege	792	powershell.exe
Token: SeShutdownPrivilege	792	powershell.exe
Token: SeDebugPrivilege	792	powershell.exe
Token: SeSystemEnvironmentPrivilege	792	powershell.exe
Token: SeRemoteShutdownPrivilege	792	powershell.exe
Token: SeUndockPrivilege	792	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 2528	3304	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	89
PID 3304 wrote to memory of 4960	3304	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	91
PID 3304 wrote to memory of 480	3304	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	92
PID 480 wrote to memory of 4224	480	msedge.exe	93
PID 480 wrote to memory of 4940	480	msedge.exe	94
PID 480 wrote to memory of 2592	480	msedge.exe	95
PID 480 wrote to memory of 2592	480	msedge.exe	95
PID 480 wrote to memory of 2592	480	msedge.exe	95
PID 480 wrote to memory of 3920	480	msedge.exe	96
PID 480 wrote to memory of 3920	480	msedge.exe	96
PID 480 wrote to memory of 2332	480	msedge.exe	97
PID 480 wrote to memory of 2332	480	msedge.exe	97
PID 480 wrote to memory of 2332	480	msedge.exe	97
PID 480 wrote to memory of 1052	480	msedge.exe	136
PID 480 wrote to memory of 1052	480	msedge.exe	136
PID 480 wrote to memory of 1052	480	msedge.exe	136
PID 480 wrote to memory of 1340	480	msedge.exe	99
PID 480 wrote to memory of 6044	480	msedge.exe	100
PID 480 wrote to memory of 3000	480	msedge.exe	101
PID 480 wrote to memory of 1340	480	msedge.exe	99
PID 480 wrote to memory of 1340	480	msedge.exe	99
PID 480 wrote to memory of 6044	480	msedge.exe	100
PID 480 wrote to memory of 6044	480	msedge.exe	100
PID 480 wrote to memory of 3000	480	msedge.exe	101
PID 480 wrote to memory of 3000	480	msedge.exe	101
PID 480 wrote to memory of 3096	480	msedge.exe	103
PID 480 wrote to memory of 3096	480	msedge.exe	103
PID 480 wrote to memory of 5744	480	msedge.exe	104
PID 480 wrote to memory of 5744	480	msedge.exe	104
PID 480 wrote to memory of 5744	480	msedge.exe	104
PID 480 wrote to memory of 1124	480	msedge.exe	106
PID 480 wrote to memory of 1124	480	msedge.exe	106
PID 480 wrote to memory of 1124	480	msedge.exe	106
PID 3304 wrote to memory of 4388	3304	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	107
PID 480 wrote to memory of 6040	480	msedge.exe	110
PID 3304 wrote to memory of 1536	3304	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	114
PID 3304 wrote to memory of 1344	3304	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	116
PID 3304 wrote to memory of 792	3304	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	118
PID 3304 wrote to memory of 5708	3304	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	120
PID 3304 wrote to memory of 3484	3304	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	122
PID 480 wrote to memory of 5424	480	msedge.exe	124
PID 480 wrote to memory of 2476	480	msedge.exe	125
PID 480 wrote to memory of 1044	480	msedge.exe	126
PID 480 wrote to memory of 3676	480	msedge.exe	127
PID 5708 wrote to memory of 5444	5708	cmd.exe	128
PID 5708 wrote to memory of 4056	5708	cmd.exe	130
PID 480 wrote to memory of 5424	480	msedge.exe	124
PID 480 wrote to memory of 2476	480	msedge.exe	125
PID 480 wrote to memory of 1044	480	msedge.exe	126
PID 480 wrote to memory of 3676	480	msedge.exe	127
PID 480 wrote to memory of 2564	480	msedge.exe	132
PID 480 wrote to memory of 2564	480	msedge.exe	132
PID 4056 wrote to memory of 5112	4056	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	133
PID 4056 wrote to memory of 3160	4056	2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	135
PID 480 wrote to memory of 1472	480	msedge.exe	137
PID 480 wrote to memory of 4748	480	msedge.exe	138
PID 480 wrote to memory of 4928	480	msedge.exe	139
PID 480 wrote to memory of 4528	480	msedge.exe	140
PID 480 wrote to memory of 4528	480	msedge.exe	140
PID 480 wrote to memory of 6000	480	msedge.exe	144
PID 480 wrote to memory of 6000	480	msedge.exe	144
PID 480 wrote to memory of 5588	480	msedge.exe	145
PID 480 wrote to memory of 5588	480	msedge.exe	145
PID 480 wrote to memory of 4176	480	msedge.exe	146

C:\Users\Admin\AppData\Local\Temp\2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "try { $ev = Get-WinEvent -FilterHashtable @{LogName='Application';Level=2; StartTime=(Get-Date).AddDays(-3)} -MaxEvents 200 -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'Borneo' -or ($_.ProviderName -eq 'Application Error' -and $_.Message -match 'Borneo') }; if ($ev) { $ev | Select-Object -First 3 | ForEach-Object { Write-Output ('BORNEO-EVENT: ' + $_.TimeCreated + ' | ' + $_.Message.SubString(0,[Math]::Min(300,$_.Message.Length))) }} else { Write-Output 'BORNEO-EVENT: No recent crash events found' }} catch { Write-Output 'BORNEO-EVENT: Event log read failed' }"
  2⤵
  - Enumerates connected drives
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/borneoschematic
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/borneoschematic
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ff821bfc188,0x7ff821bfc194,0x7ff821bfc1a0
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,1335859666560470043,12703504182807533898,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1944,i,10966033553612552133,6379576882701669162,262144 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:2
    3⤵
    PID:2592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,1707090941296136871,15571464691622345524,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:13
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,5183587834872492326,8071779291422897286,2097152 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,17409562728042613231,9963626555792702294,2097152 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
    3⤵
    PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,5558402606272024267,15003140934706205347,2097152 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:9
    3⤵
    PID:1340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4400,i,15693389425224238542,4571926226452869189,2097152 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,12084933245893773515,12628196692848713294,2097152 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3888,i,5072358701748821770,3600199728758019605,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:14
    3⤵
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5592,i,3288810029999576409,2253198179355592224,2097152 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:1
    3⤵
    PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5724,i,6992796403209070490,4224240439697157815,2097152 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,15133870019617466643,10804861934342548950,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,15133870019617466643,10804861934342548950,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
    3⤵
    PID:6040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,3234267416038259753,2263094196584565787,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:14
    3⤵
    PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,10984354994263741761,10718229620209803237,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:12
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,9725810200749127624,1996282701400968137,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,4897502361398554828,6694131394419474915,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,3749706233755437650,17307334052787392438,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,5528212505082377089,9043579997655642999,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,8217077550642082976,902043487448717824,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=1432 /prefetch:14
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,9678974110215551067,1927987601386253269,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,6392705677286654143,7111249817872516123,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,9441487461500215949,8668851290869255527,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:14
    3⤵
    PID:6000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,7213779764627075900,14747265260998409661,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=948 /prefetch:14
    3⤵
    PID:5588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7136,i,19553129240420105,13169077816620635014,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:14
    3⤵
    PID:4176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4404,i,16602257238792438081,13163078809257838716,262144 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=7136 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,15540136792704273377,17076899016910396513,524288 --field-trial-handle=2492,i,4794675663517243728,16553871974543769973,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
    3⤵
    PID:1876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "try { $t = Get-MpThreatDetection -ErrorAction SilentlyContinue | Where-Object { $_.Resources -match 'Borneo' -or $_.Resources -match 'borneo' }; if ($t) { $t | ForEach-Object { Write-Output ('DEFENDER-QUARANTINE: ' + $_.ThreatName + ' | ' + $_.Resources) }} else { Write-Output 'DEFENDER-QUARANTINE: No Borneo items in quarantine' }} catch { Write-Output 'DEFENDER-QUARANTINE: Check failed' }"
  2⤵
  - Enumerates connected drives
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(Get-WinUserLanguageList | ForEach-Object { $_.LanguageTag }) -join ', '"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe','C:\Users\Admin\Desktop','C:\Users\Admin\Downloads' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1344
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "try { Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Enumerates connected drives
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\borneo_update_swap.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5708
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5444
- - C:\Users\Admin\AppData\Local\Temp\2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe" --updated
    3⤵
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "try { Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe','C:\Users\Admin\Desktop','C:\Users\Admin\Downloads' -ErrorAction SilentlyContinue } catch {}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:5112
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "try { Add-MpPreference -ExclusionProcess '2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe','FixedSupportTool.exe' -ErrorAction SilentlyContinue } catch {}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Enumerates connected drives
      Suspicious behavior: EnumeratesProcesses
      PID:3160
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "try { Add-MpPreference -ExclusionProcess '2026-10-02_30c6fe616b94e669895a22d125b60303_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe','FixedSupportTool.exe' -ErrorAction SilentlyContinue } catch {}"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery