Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/10/2026, 20:18
General
- Target 2026-10-11_6105e79d2cd3489eb93940d64f098807_amadey_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_vidar.exe
- Size 3.0MB
- Sample261012-y3l2jszyft
- SHA256 ae8a5572399b724ac253dff6fe94b5e3333acbdf6ce4feba02b1120eadc6378b
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-11_6105e79d2cd3489eb93940d64f098807_amadey_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-11_6105e79d2cd3489eb93940d64f098807_amadey_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_vidar.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken