Overview

overview

7

Static

static

3

2026-10-13...ar.exe

windows10-2004-x64

7

2026-10-13...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/10/2026, 10:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-13_7510af9031071255e6fd1a15758f4276_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 34.4MB
  • Sample261015-m1636asxe1
  • SHA256 507e3f6b0a76a695c832d2d06f397ccb0ae5db2b44b672b2bf5d851afe36d244
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
execution

Malware Config

Signatures

  • Loads dropped DLL 27 IoCs
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-13_7510af9031071255e6fd1a15758f4276_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-13_7510af9031071255e6fd1a15758f4276_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5744
    • C:\Users\Admin\AppData\Local\Temp\2026-10-13_7510af9031071255e6fd1a15758f4276_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-13_7510af9031071255e6fd1a15758f4276_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4548
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
        • Executes a command shell one-liner
        PID:1688

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\VCRUNTIME140.dll
        • Size 117KB
        • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 82a2f9ae1e6146ae3cb0f4bc5a62b7227e0384209d9b1aef86bbcc105912f7cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_asyncio.pyd
        • Size 72KB
        • SHA256 bac2870d61a72be50cabc968be924147132036185b3b538aa3b1b43d8c828a2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _brotli.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_brotli.cp312-win_amd64.pyd
        • Size 802KB
        • SHA256 788acbfd0edd6ca3ef3e97a9487eeaea86515642c71cb11bbcf25721e6573ec8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_bz2.pyd
        • Size 84KB
        • SHA256 178c6eeb30843e656cc407aaf53ae6d0f170966e4e0bdd2ee1bede73962275cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_ctypes.pyd
        • Size 124KB
        • SHA256 9ffdedd0f1f09f21870bd75c08d05c32994a1193be3955e367f260690a36cbd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _decimal.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_decimal.pyd
        • Size 251KB
        • SHA256 847e2b2c69ca623e0f96bbda0f421ca978fbb5925beec4cc5e4c5d9c966c4bbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_hashlib.pyd
        • Size 65KB
        • SHA256 823717926adce6b36f9c13b6555eaeaf5714c4756828f11cffc1ce0bef970a7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_lzma.pyd
        • Size 156KB
        • SHA256 f6e0c786395ccc7b22f4c435b19f7073eb5974eb29e09f4c91060cab10450e6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_overlapped.pyd
        • Size 55KB
        • SHA256 0e6081da5bbf8fcd756b02153ab7fca12bd0bc04842abe5765f7409af4987b17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_queue.pyd
        • Size 32KB
        • SHA256 37622ca591fb8e45a894db9c0da99bfcb18a820a48f028e4949d9256b69247e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_socket.pyd
        • Size 83KB
        • SHA256 0e2c1089974a2757426dac3295201a33c990c36f3c09593f8a2b6e07fd36b99c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_ssl.pyd
        • Size 175KB
        • SHA256 81344e3e16cf6f2d5b24cc0cf92e95c5fd0592e4a3859bb00c3f5891e2482128
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _uuid.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_uuid.pyd
        • Size 27KB
        • SHA256 20557961ac93ae00829b0865018bcc565e41b52b103d2aa58405a0208ada148f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\_wmi.pyd
        • Size 39KB
        • SHA256 af1077d6377d5a0aea123f0c324cc6d151ac4a29a84aae23a6936b6d1c64b70a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\base_library.zip
        • Size 1.3MB
        • SHA256 13e24b36c20b3da9914c67b61614b262f3fc1ca7b2ee205ded41acc57865bfef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\libssl-3.dll
        • Size 774KB
        • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multidict.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\multidict\_multidict.cp312-win_amd64.pyd
        • Size 45KB
        • SHA256 1ef9e6eaff88cdcc0a32346b7b266a0e1d19716ecac07f16a189a7057ce971f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\pyexpat.pyd
        • Size 198KB
        • SHA256 fb0be386ab5bc1695e47e49220f52beee99239bbe85c1749694a8a696054865f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\python3.DLL
        • Size 68KB
        • SHA256 7c3e2956271eff4949145d14635c0ca659db5ed19215201d2d8b3a4a3d3006f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\python312.dll
        • Size 6.6MB
        • SHA256 3b56fa10d3797c231468cee42caeaaaff40dbede7bc0d142ec4878493f48e07d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\select.pyd
        • Size 32KB
        • SHA256 fcac4646ff709ac07aee532c4612a19b7070f2dd6ef67ba09c743644e92f7376
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        INSTALLER
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\setuptools\_vendor\wheel-0.43.0.dist-info\INSTALLER
        • Size 4B
        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
        • MD5 SHA1 SHA512
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\ucrtbase.dll
        • Size 964KB
        • SHA256 1142120d03f3ba4e241e41a8ae8e61089e2e46ffe88a223fc39f9e638e5dde46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\unicodedata.pyd
        • Size 1.1MB
        • SHA256 e7fe7ae7342b1dec8dfe52a95d768039a46189209b9f42a21c4d2473faaa1753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _quoting_c.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI57442\yarl\_quoting_c.cp312-win_amd64.pyd
        • Size 94KB
        • SHA256 f306e375e186c011585dea2bc875530fb7d734861db388764a2aa307b1b68df3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download