Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
24/10/2026, 01:13
General
- Target 2026-10-22_a9f9d82935f9af6b4c8d06212da290cf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
- Size 578KB
- Sample261024-bllywswt8p
- SHA256 6ba844355f7929c02c53b8839be885579f1a0d4841134c7eda79d0d0d8f32c72
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-22_a9f9d82935f9af6b4c8d06212da290cf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-22_a9f9d82935f9af6b4c8d06212da290cf_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1272-10-0x00007FF96E96E000-0x00007FF96E96F000-memory.dmp
memory/1272-9-0x000001CDC7DF0000-0x000001CDC7E4A000-memory.dmp
memory/1272-0-0x00007FF96E8D0000-0x00007FF96EAC5000-memory.dmp
memory/1272-1-0x000001CDC7DF0000-0x000001CDC7E4A000-memory.dmp
memory/1272-12-0x000001CDC7DF0000-0x000001CDC7E4A000-memory.dmp
memory/1272-11-0x000001CDC7DF0000-0x000001CDC7E4A000-memory.dmp
memory/1272-13-0x00007FF96E8D0000-0x00007FF96EAC5000-memory.dmp
memory/1272-14-0x000001CDC7ED0000-0x000001CDC7EE6000-memory.dmp
memory/1272-16-0x00007FF96E8D0000-0x00007FF96EAC5000-memory.dmp
memory/1272-15-0x000001CDC82B0000-0x000001CDC8326000-memory.dmp
memory/1272-17-0x000001CDC81B0000-0x000001CDC81CE000-memory.dmp
memory/1272-18-0x00007FF96E8D0000-0x00007FF96EAC5000-memory.dmp
memory/1272-22-0x000001CDC7DF0000-0x000001CDC7E4A000-memory.dmp
memory/1272-25-0x00007FF96E8D0000-0x00007FF96EAC5000-memory.dmp