Overview

overview

7

Static

static

3

2026-10-23...ar.exe

windows10-2004-x64

7

2026-10-23...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/10/2026, 08:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-23_a549e2695e72a07e092ab8da8b6eabba_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 11.2MB
  • Sample261023-kwlkjsce64
  • SHA256 22bba9e8035cd1515536528481bc31458c26eeb1a811c522fba4d787b511fdb4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 28 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-23_a549e2695e72a07e092ab8da8b6eabba_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-23_a549e2695e72a07e092ab8da8b6eabba_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:720
    • C:\Users\Admin\AppData\Local\Temp\2026-10-23_a549e2695e72a07e092ab8da8b6eabba_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-23_a549e2695e72a07e092ab8da8b6eabba_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:4996

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _raw_aes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\Crypto\Cipher\_raw_aes.pyd
        • Size 36KB
        • SHA256 122538e845c945d8efd86a092dd78727fc18e2d74ea1b2a00a9f1b8e8cefd2ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_aesni.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\Crypto\Cipher\_raw_aesni.pyd
        • Size 15KB
        • SHA256 2f43949960c3c05666fc7331d2aad383a32eb0d95caad2e074f9bf496bc95c52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cpuid_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\Crypto\Util\_cpuid_c.pyd
        • Size 10KB
        • SHA256 95dd43cac1261e71dbd411cb2c08cc01a81b746009ef2cadcacb4018fea79e81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\VCRUNTIME140.dll
        • Size 85KB
        • SHA256 3096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_bz2.pyd
        • Size 92KB
        • SHA256 8bce02e8d44003c5301608b1722f7e26aada2a03d731fa92a48c124db40e2e41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_ctypes.pyd
        • Size 129KB
        • SHA256 430f1886caf059f05cde6eb2e8d96feb25982749a151231e471e4b8d7f54f173
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_hashlib.pyd
        • Size 38KB
        • SHA256 ca4f433a68c3921526f31f46d8a45709b946bbd40f04a4cfc6c245cb9ee0eab5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_lzma.pyd
        • Size 172KB
        • SHA256 f9bc6036d9e4d57d08848418367743fb608434c04434ab07da9dabe4725f9a9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_queue.pyd
        • Size 27KB
        • SHA256 e499824d58570c3130ba8ef1ac2d503e71f916c634b2708cc22e95c223f83d0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_socket.pyd
        • Size 75KB
        • SHA256 9822c258a9d25062e51eafc45d62ed19722e0450a212668f6737eb3bfe3a41c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_sqlite3.pyd
        • Size 86KB
        • SHA256 709fc7baf15d179cc2ee533b1fce7402a9486d34bda2edae64eade54d17cf9ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_ssl.pyd
        • Size 118KB
        • SHA256 b6593b3af0e993fd5043a7eab327409f4bf8cdcd8336aca97dbe6325aefdb047
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _tkinter.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\_tkinter.pyd
        • Size 68KB
        • SHA256 34d89fe378fc10351d127fb85427449f31595eccf9f5d17760b36709dd1449b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\base_library.zip
        • Size 1000KB
        • SHA256 2eea4b6202a6a6f61cb4d75c78be5ec2e1052897f54973797885f2c3b24d202c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\charset_normalizer\cd.pyd
        • Size 106KB
        • SHA256 a1a19d46229c75dca12760fea43709a45699df1af70edb33bed289bf6b0cb899
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\charset_normalizer\md.pyd
        • Size 191KB
        • SHA256 ead879822b052e43681d2bfb45bcfbec8b714e3edad598e1878c019cc24ecdf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\libcrypto-1_1.dll
        • Size 3.2MB
        • SHA256 594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\libssl-1_1.dll
        • Size 673KB
        • SHA256 9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\python3.dll
        • Size 57KB
        • SHA256 d21eb0fd1b2883e9e0b736b43cbbef9dfa89e31fee4d32af9ad52c3f0484987b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python37.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\python37.dll
        • Size 3.6MB
        • SHA256 ca8e39f2b1d277b0a24a43b5b8eada5baf2de97488f7ef2484014df6e270b3f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes37.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\pywin32_system32\pywintypes37.dll
        • Size 129KB
        • SHA256 2d2801a95351d9d1a68302f5a55c7c45427fd63fe2b6cbe4bf45e2236a435110
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\select.pyd
        • Size 26KB
        • SHA256 65a3c8806d456e9df2211051ed808a087a96c94d38e23d43121ac120b4d36429
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\sqlite3.dll
        • Size 1.2MB
        • SHA256 709ec8f1aad74855bd38e384243427ed4f63bd4cae08a0caf4ad2fe5032362dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tcl86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\tcl86t.dll
        • Size 1.6MB
        • SHA256 f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msgcat-1.6.1.tm
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\tcl8\8.5\msgcat-1.6.1.tm
        • Size 33KB
        • SHA256 4fdf70fdcedef97aa8bd82a02669b066b5dfe7630c92494a130fc7c627b52b55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        auto.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\tcl\auto.tcl
        • Size 20KB
        • SHA256 f385515658832feb75ee4dce5bd53f7f67f2629077b7d049b86a730a49bd0840
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cp1252.enc
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\tcl\encoding\cp1252.enc
        • Size 1KB
        • SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        init.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\tcl\init.tcl
        • Size 23KB
        • SHA256 bc492b19308bc011cfcd321f1e6e65e6239d4eeb620cc02f7e9bf89002511d4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tclIndex
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\tcl\tclIndex
        • Size 5KB
        • SHA256 abf7d9d1e86de931096c21820bfa4fd70db1f55005d2db4aa674d86200867806
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tm.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\tcl\tm.tcl
        • Size 11KB
        • SHA256 6437bd7040206d3f2db734fa482b6e79c68bcc950fba80c544c7f390ba158f9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk86t.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\tk86t.dll
        • Size 1.4MB
        • SHA256 1a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tk.tcl
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\tk\tk.tcl
        • Size 22KB
        • SHA256 e1067a0668debb2d8e8ec3b7bc1aec3723627649832b20333f9369f28e4dfdbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\ucrtbase.dll
        • Size 1.3MB
        • SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\unicodedata.pyd
        • Size 1.0MB
        • SHA256 016d962782beae0ea8417a17e67956b27610f4565cff71dd35a6e52ab187c095
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32crypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI7202\win32\win32crypt.pyd
        • Size 120KB
        • SHA256 59024e214e394dcb502ce00e0b35339c0756f00ad1d1452504cf9fc633c0102d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ck_1792745837.db
        • Path C:\Users\Admin\AppData\Local\Temp\ck_1792745837.db
        • Size 20KB
        • SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download