c72a2d944dc90711795953d3cd48db9539c53c42594ad27834d24ec99f2dc356

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 07:34

Target
2026-10-26_c2188b2f0e0ad143542e721aaf0fa2a9_cobalt-strike_glassworm_icedid_njrat_remcos_satacom_stealc.exe
Size 6.1MB
Sample261027-jd51sscs6l
SHA256 c72a2d944dc90711795953d3cd48db9539c53c42594ad27834d24ec99f2dc356
MD5 c2188b2f0e0ad143542e721aaf0fa2a9
SHA1 e089e3156056886a5d04465e7df55c02c388468d
SHA512 c564acda1831137d692b3ee3f91ccc78115d87fd408914a2ae0b46132253cb206ed34a461074bf06f4f705e842806cde06ef01c777afd2e76b5d7cce8ee73921
SSDEEP 98304:GDItmz5aBrGDM2omI6jK3SHPNJ9CooU2stqN+V8EUEZjHwIpiEklj9cz8wP:kwmzYByDMwK3SH9ot+VVUqQIpi9h+z8
TLSH
T145560211A3E406ACD1B7D3B89A675906DB77B80603309AEB22C485571F23AD4CE7FB31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3484	2026-10-26_c2188b2f0e0ad143542e721aaf0fa2a9_cobalt-strike_glassworm_icedid_njrat_remcos_satacom_stealc.exe
3484	2026-10-26_c2188b2f0e0ad143542e721aaf0fa2a9_cobalt-strike_glassworm_icedid_njrat_remcos_satacom_stealc.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-26_c2188b2f0e0ad143542e721aaf0fa2a9_cobalt-strike_glassworm_icedid_njrat_remcos_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_c2188b2f0e0ad143542e721aaf0fa2a9_cobalt-strike_glassworm_icedid_njrat_remcos_satacom_stealc.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:3484