abf15ba5ef7b7cc5f0e929cfcd1de11748d7179dcdc35c73d06aa6d1f1b6a55d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 06:27

Target
2026-10-23_e4cf87c42053e43eec00850bb2c332a1_cobalt-strike_glassworm_icedid_njrat_satacom.exe
Size 40.3MB
Sample261023-g71bascc88
SHA256 abf15ba5ef7b7cc5f0e929cfcd1de11748d7179dcdc35c73d06aa6d1f1b6a55d
MD5 e4cf87c42053e43eec00850bb2c332a1
SHA1 36fe4b687cb3adf5bf6fc6626a2487f34a7b99cc
SHA512 dc2d2177f351b88fd4dc066b08b4bd33cb7bf7814ce01c685f48edfdc5e10099b0b16695f943bf15713005ceb65768d005adab4ef32f537457df77c3f4d74791
SSDEEP 786432:0pcJXZ58ZVWJ0xO40P7SJX5y5VpNove+H4g4B/vHf6tVB0hkboMvdCO3yoBA6tz:ww5YA0E40OJUV1gwvitVB0haoiBUgz
TLSH
T1B3973343E3E65299E06B8938D5316327B672BC521B3187CF239041996FB33E45E77B82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
5188	ac19fdf2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5188	ac19fdf2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5188	ac19fdf2.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5244 wrote to memory of 5188	5244	2026-10-23_e4cf87c42053e43eec00850bb2c332a1_cobalt-strike_glassworm_icedid_njrat_satacom.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-23_e4cf87c42053e43eec00850bb2c332a1_cobalt-strike_glassworm_icedid_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-23_e4cf87c42053e43eec00850bb2c332a1_cobalt-strike_glassworm_icedid_njrat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5244
- C:\Users\Admin\AppData\Local\Temp\ac19fdf2.exe
  "C:\Users\Admin\AppData\Local\Temp\ac19fdf2.exe" --launcher
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5188

ac19fdf2.exe

Path C:\Users\Admin\AppData\Local\Temp\ac19fdf2.exe
Size 11.1MB
SHA256 4a5a7f05ab6bc82640a17df8b5669dea6d4fbe0f2f5645c4fbd10636302145e0
MD5 55f2cf9694e99ddf9945e276dab07bc3
SHA1 7336fc9f3547751222d935e69fc234d49e11253a
SHA512 7d391c6da868cf206a54ae760687232b8d1c88d9d982e359fc7a3146c6f0a8794215673cf5182b72282b853044604a791f33b69f541f91cd4dbe1b86ca05cb29
SSDEEP 196608:+gICq0Ql1KXARnSiNej1LfXArt7Z3A2ex/Akz4q0QwZDDZJAovnLli7g6qEES5NZ:+t0QbTej1TCVRil0QwJDAFES5N2FESVu
TLSH
T12AC62302F3E6419CD06B5534C231A36BA2767C125B3187DF238451986FBB2E49EB7BD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download