fe3847f3f2578bea51ec26ec2bb1c8bb1e4ebe9a2a2d8640dce518b33ed5f41b

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 21:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_0cb039c1833a137ca185d17837beabef_cobalt-strike_darkgate_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom.exe
Size 11.3MB
Sample261024-1wh3esxtby
SHA256 fe3847f3f2578bea51ec26ec2bb1c8bb1e4ebe9a2a2d8640dce518b33ed5f41b
MD5 0cb039c1833a137ca185d17837beabef
SHA1 a33bdcd0f47bdab34b6359b7b3ab77ac4cf79c34
SHA512 336e4126326f7bf1c467c95daf7fa0bb90267d73afe69638e3c53123c08690d5fa2991db53ead573ca44c0054fc658267ae621f48c3e669ebdf555a0488941c5
SSDEEP 196608:p8hqVAmLaXzTAhV0I3UMhD0hpMVuBsKLRLRkR:puqVAmIu+I3qWu2Kz
TLSH
T168C67D06EBAA49D5D073963489669667F3B2BC500BB4C7CF3298560E1FB37E04D39B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4056	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4328	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4056	powershell.exe
4056	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1092	2026-10-22_0cb039c1833a137ca185d17837beabef_cobalt-strike_darkgate_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeIncreaseQuotaPrivilege	4056	powershell.exe
Token: SeSecurityPrivilege	4056	powershell.exe
Token: SeTakeOwnershipPrivilege	4056	powershell.exe
Token: SeLoadDriverPrivilege	4056	powershell.exe
Token: SeSystemProfilePrivilege	4056	powershell.exe
Token: SeSystemtimePrivilege	4056	powershell.exe
Token: SeProfSingleProcessPrivilege	4056	powershell.exe
Token: SeIncBasePriorityPrivilege	4056	powershell.exe
Token: SeCreatePagefilePrivilege	4056	powershell.exe
Token: SeBackupPrivilege	4056	powershell.exe
Token: SeRestorePrivilege	4056	powershell.exe
Token: SeShutdownPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeSystemEnvironmentPrivilege	4056	powershell.exe
Token: SeRemoteShutdownPrivilege	4056	powershell.exe
Token: SeUndockPrivilege	4056	powershell.exe
Token: SeManageVolumePrivilege	4056	powershell.exe
Token: 33	4056	powershell.exe
Token: 34	4056	powershell.exe
Token: 35	4056	powershell.exe
Token: 36	4056	powershell.exe
Token: SeIncreaseQuotaPrivilege	4056	powershell.exe
Token: SeSecurityPrivilege	4056	powershell.exe
Token: SeTakeOwnershipPrivilege	4056	powershell.exe
Token: SeLoadDriverPrivilege	4056	powershell.exe
Token: SeSystemProfilePrivilege	4056	powershell.exe
Token: SeSystemtimePrivilege	4056	powershell.exe
Token: SeProfSingleProcessPrivilege	4056	powershell.exe
Token: SeIncBasePriorityPrivilege	4056	powershell.exe
Token: SeCreatePagefilePrivilege	4056	powershell.exe
Token: SeBackupPrivilege	4056	powershell.exe
Token: SeRestorePrivilege	4056	powershell.exe
Token: SeShutdownPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeSystemEnvironmentPrivilege	4056	powershell.exe
Token: SeRemoteShutdownPrivilege	4056	powershell.exe
Token: SeUndockPrivilege	4056	powershell.exe
Token: SeManageVolumePrivilege	4056	powershell.exe
Token: 33	4056	powershell.exe
Token: 34	4056	powershell.exe
Token: 35	4056	powershell.exe
Token: 36	4056	powershell.exe
Token: SeIncreaseQuotaPrivilege	4056	powershell.exe
Token: SeSecurityPrivilege	4056	powershell.exe
Token: SeTakeOwnershipPrivilege	4056	powershell.exe
Token: SeLoadDriverPrivilege	4056	powershell.exe
Token: SeSystemProfilePrivilege	4056	powershell.exe
Token: SeSystemtimePrivilege	4056	powershell.exe
Token: SeProfSingleProcessPrivilege	4056	powershell.exe
Token: SeIncBasePriorityPrivilege	4056	powershell.exe
Token: SeCreatePagefilePrivilege	4056	powershell.exe
Token: SeBackupPrivilege	4056	powershell.exe
Token: SeRestorePrivilege	4056	powershell.exe
Token: SeShutdownPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeSystemEnvironmentPrivilege	4056	powershell.exe
Token: SeRemoteShutdownPrivilege	4056	powershell.exe
Token: SeUndockPrivilege	4056	powershell.exe
Token: SeManageVolumePrivilege	4056	powershell.exe
Token: 33	4056	powershell.exe
Token: 34	4056	powershell.exe
Token: 35	4056	powershell.exe
Token: 36	4056	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1092	2026-10-22_0cb039c1833a137ca185d17837beabef_cobalt-strike_darkgate_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 4328	1092	2026-10-22_0cb039c1833a137ca185d17837beabef_cobalt-strike_darkgate_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom.exe	90
PID 4328 wrote to memory of 4056	4328	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-10-22_0cb039c1833a137ca185d17837beabef_cobalt-strike_darkgate_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_0cb039c1833a137ca185d17837beabef_cobalt-strike_darkgate_glassworm_hijackloader_icedid_luca-stealer_njrat_satacom.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\3la2-wmi.ps1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\3la2-wmi.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3la2-wmi.ps1

Path C:\Users\Admin\AppData\Local\Temp\3la2-wmi.ps1
Size 1KB
SHA256 4426a66bc19e0a41b2719aa54daac2a2cd422e5237bfd0dcbe85167bb757d966
MD5 9306ffa52101da97fb87719a27bf8c90
SHA1 7069bc160a8db0aa5156b82b81b034eccb494a6f
SHA512 a4f754fe4f32708169af5d6fa1d15a5606e96144332cc537bc09f5c8f3d73a93d02d05d0866babaada3cf59b1ca1e6cb9df5a4ae83c886fffcccdbb091cb8b4a
TLSH
T1B131BE3473598F70808998B69721AB5B55E40231D102DBCD75ECC684BF6B36C97F06AE
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_l1skkr5h.4mr.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l1skkr5h.4mr.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4056-16-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download

memory/4056-18-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download

memory/4056-5-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download

memory/4056-8-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download

memory/4056-9-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download

memory/4056-4-0x000001D4EC510000-0x000001D4EC532000-memory.dmp

Download

memory/4056-13-0x000001D4EC7F0000-0x000001D4EC8A2000-memory.dmp

Download

memory/4056-14-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download

memory/4056-12-0x000001D4EC7D0000-0x000001D4EC7EE000-memory.dmp

Download

memory/4056-19-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download

memory/4056-6-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download

memory/4056-1-0x00007FFB0212F000-0x00007FFB02130000-memory.dmp

Download

memory/4056-15-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download

memory/4056-21-0x000001D4ECA30000-0x000001D4ECA54000-memory.dmp

Download

memory/4056-20-0x000001D4ECA30000-0x000001D4ECA5A000-memory.dmp

Download

memory/4056-17-0x000001D4EC5B0000-0x000001D4EC5BA000-memory.dmp

Download

memory/4056-22-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download

memory/4056-23-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download

memory/4056-24-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download

memory/4056-25-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download

memory/4056-26-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download

memory/4056-28-0x00007FFB01FA0000-0x00007FFB02944000-memory.dmp

Download