9e36e6408a791caaf70a42f76bce0803d2556c947fefff69b8fc3e550c0b3e5a

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_4494207d19c28e2a14f8c5b4e4b6249f_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Size 263KB
Sample261027-xfztfsty5j
SHA256 9e36e6408a791caaf70a42f76bce0803d2556c947fefff69b8fc3e550c0b3e5a
MD5 4494207d19c28e2a14f8c5b4e4b6249f
SHA1 b93345127849de0fe93575802aa4b784ee728f1a
SHA512 52d7a86b0ea63c6ba627337951942fde44efdb9b68c5321d23cfd633077db0a190455f6c1ffe9e23f797b4c62340e3b45e77b1f2a2291fd5c640ea026c61cd0f
SSDEEP 3072:4XJ75raM7ICgpfYvCOlsLVl3UHtW2uiECjSMb8/hUaUPbXEXsaF1bNJE2KvCSsUa:4Z75raM7jyYvCOlecPl+PePrETorX6
TLSH
T1CB447C15B2A90CFAEE77857CCD534506EA737C460B60EADF03904AA71E23AD49E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (1595) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1128	2bfaeacca36bf513.exe
4560	fbdffaa3ec8d74a5.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysCache = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Themes\\2bfaeacca36bf513.exe"	2026-10-26_4494207d19c28e2a14f8c5b4e4b6249f_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysCache = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Themes\\fbdffaa3ec8d74a5.exe"	2bfaeacca36bf513.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

C:\Users\Admin\AppData\Local\Temp\2026-10-26_4494207d19c28e2a14f8c5b4e4b6249f_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_4494207d19c28e2a14f8c5b4e4b6249f_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"
1⤵
- Adds Run key to start application
PID:400

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\2bfaeacca36bf513.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\2bfaeacca36bf513.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1128

C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\fbdffaa3ec8d74a5.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\fbdffaa3ec8d74a5.exe
1⤵
- Executes dropped EXE
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

README_RESTORE.txt

Path C:\README_RESTORE.txt
Size 863B
SHA256 6955d06178f9b1ef898b986f38491f00cbec33809eab1cd88dd9ecb73195d319
MD5 1f671db181ecbc97a4508b61b0a61f5f
SHA1 2c2904cdee127c7f6fa77019a2f8256a62235182
SHA512 2d1d4d00f29cd0d3c22816f83da9868429b42129124a5ae2f721790717c18b10022feea11ebc01b9c6318e241e65711cdb3ba05e75d8767eba62d80eb195acae
TLSH
T17311522B7BC047B721EA54D4AD2E5087C62D902D73CB1B80B18E1161BB36BB5CE9AC5D
MD5 SHA1 SHA512 TLSH

Submit Download

data_2.ofx

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2.ofx
Size 8KB
SHA256 e660a8cb0af24de5e6ef4ff32c3b9bbce12fbcaa8b06d168d647ab79e4598d62
MD5 14ee6c5567a5dbf2a776fe556c563b86
SHA1 0599285dd145ffe8b1719ce21e95cdaaa1cf5fd1
SHA512 88bd5ed84c105493c86aa15b8d31ab2a4c12bf5c242e8423c2b05610fde14725480af628675c0b58c3c31cbaff1ded74fa3822500d45220ef0756be767e6f83f
SSDEEP 192:PVrWLIYZlS2LeRltQ/4cMxpOm+nb2FZOeUKhv/SAgRhl:PVyLIWS2iK/4dLunkZfhKXl
TLSH
T18802BE59F4FF218F7CD2374D9AF67B298130063B9F860A53991586152D06B8B1DB0E88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3.ofx

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_3.ofx
Size 8KB
SHA256 897a0a2db9b7f30f59008708b35140ab2552247c66aef309e24099751b89a038
MD5 92896e05e1104447ff19cb017b2cbeec
SHA1 9bd876024fe64b6f585135a017835317fb23c7a5
SHA512 ad554456481751335f9744d68f1889408ad43640ff31b13c8cbb71cf2088ca86b6c2854476fde0012a92e5e628f7ab1c3a1065d4d165c0a1ef03f1e56b1e47a9
SSDEEP 192:3VrWLIYZlS2LeRltQ/4cMxpOm+nb2FZOeUKhv/SAgRhl:3VyLIWS2iK/4dLunkZfhKXl
TLSH
T15802BE59F4FF258F7CD2374E9AF67B294130063B9F860A53991586152D06B8B0DF0D88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0.ofx

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_0.ofx
Size 8KB
SHA256 eb2d139b8c85bfaee6dbac3361611b255c31449bb4743a9e92d176f12bff5dbb
MD5 32b4b4133be73eecea80121ddc22b792
SHA1 7196b33f147b060efb51151a41ab590e94c6a2e3
SHA512 06ea0dbf97b92e3449158581724db8ab7504e7742e67878414736215b0e4121822a65038bf1c6c16f187ce89dec25bad6a29ad55d4d937041e1866b4e05ce97e
SSDEEP 192:CVrWLIYZlS2LeRltQ/4cMxpOm+nb2FZOeUKhv/SAgRhl:CVyLIWS2iK/4dLunkZfhKXl
TLSH
T1AF02AE59F4FF218F7CD2375DAAFA7B294130163B9F860A53991586152D07B8B1CB0D88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1.ofx

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1.ofx
Size 264KB
SHA256 b5166ccefcb1196631d24153b0c62a3fa590a4d03a5c6ac981ed1b49ebe5c06e
MD5 3817e3bf41329bd2b60c2109c494b62a
SHA1 34a8dd8f6324b87d20e7169f133369a7966dc28e
SHA512 02341a5bdc4a93bcd2069274efa6aa9786d9749628f051923df8f8dad9aa7551610489861581ae9b1303db427dbd0628b951646849cc54b9029ab499a1007c33
SSDEEP 6144:mPr7XkhFaLwxVW8hI/Oo0ttR8LJPTm8+CafcKl:tDaLwDW0NEJa8+C/I
TLSH
T18A44220D9C4A71F9E89994E1DACD9DC5F6008D003A82E1D8943B4E61E950F6F6D33BBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winword.exe.db.ofx

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db.ofx
Size 24KB
SHA256 ba3c7b5ffe52dc36bf046e879f89d6ffb40397ec2a40cb8e89b24716bba05e99
MD5 818e04ed447522683c1fad4a4ca89dce
SHA1 1965d0301b8d2fef71e90c5d66d9a3f49422abf5
SHA512 4fabe13443eb898d70f6876f59a06169b0a8a41a3b71482924e511a00daf95f04b3a5634889fa40e905aaf3bb5b54a10ea800b2601a8bca2ce9220365b77aac1
SSDEEP 768:gS29wfQE0rpDeIr/6oCKNxy2m5QJcnrB+:w91rJDNxZiQ
TLSH
T14AB2D04B785A257BADD562A88FEFEC788C306A3DA70492E3526563807D267CF4D72810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2bfaeacca36bf513.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Themes\2bfaeacca36bf513.exe
Size 263KB
SHA256 9e36e6408a791caaf70a42f76bce0803d2556c947fefff69b8fc3e550c0b3e5a
MD5 4494207d19c28e2a14f8c5b4e4b6249f
SHA1 b93345127849de0fe93575802aa4b784ee728f1a
SHA512 52d7a86b0ea63c6ba627337951942fde44efdb9b68c5321d23cfd633077db0a190455f6c1ffe9e23f797b4c62340e3b45e77b1f2a2291fd5c640ea026c61cd0f
SSDEEP 3072:4XJ75raM7ICgpfYvCOlsLVl3UHtW2uiECjSMb8/hUaUPbXEXsaF1bNJE2KvCSsUa:4Z75raM7jyYvCOlecPl+PePrETorX6
TLSH
T1CB447C15B2A90CFAEE77857CCD534506EA737C460B60EADF03904AA71E23AD49E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

V01res00002.jrs.ofx

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs.ofx
Size 512KB
SHA256 02e9e88c137c303ebf71b4881c2200bf653e1434dd0586bee2123411902b97a3
MD5 8046dc0fbfcd9b6797fe56b15ee33849
SHA1 0893e4f6b8cd6bee3635902813b2729d03fe7036
SHA512 bb86fbac299f7410f952e19d34f9c22948a166d7aab4964503bba4594d3bee616b90c5d211dba673aa2b6ab9d942948e6bbdd62f909d1195c2f2157aa69dc1eb
SSDEEP 12288:EDaLwDW0NEJa8+C/x8tgrPoFS3wocs5OB2cNXY:ENDTNEog/qTS3wc7cNI
TLSH
T11DB4231C585574E6DC4C74C4D6E9ECDBBB814E012E56F198C8320B6AEE10B9F2C66BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

places.sqlite-shm.ofx

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\q70bjwr6.default-release\places.sqlite-shm.ofx
Size 32KB
SHA256 d7b3c62d3faf4b84a1f8e3dbc8bba7b1420ab83741fd301e88774942db486357
MD5 342afc5dbcb46a18b0373458665423a2
SHA1 53160d837d3bd0901c7fe9751f900cfe74795780
SHA512 8611539c12ee38d78f83245d1ff1223235ec1b5916268cef00014638b05a456b470ff414c5e136e176fb9cad5eb15e16215c4e286f6934e12d16f89b15c1bd14
SSDEEP 768:3S29wAnQj0rpJeIr/6oXKNxc2m5QJcnrBs6zZpyW9rn:XPQQrJ6NxziK6zXNrn
TLSH
T15EE2F14B784A256B5DD9B3648DEFDD7898205D3AB39093F382562780BE2A2CF4E35C10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromBackup.avi.ofx

Path C:\Users\Admin\Downloads\ConvertFromBackup.avi.ofx
Size 410KB
SHA256 61f371100532a4edbe1388579fc870cb4794f52a0ab06287ced71860efad663b
MD5 71a8f7b54deaa9bfc1c2c98a1fe7632d
SHA1 7a2bf1efd845288f5c4ab7bed3ea52e69666e727
SHA512 88462bf9cad8757e3f67e56764ce5c7638114e0aea0d0916eeed23116dbfba8e58806d4e163d19f8c0be2d615b78d8f5eabb38c33f085870b2df22c003a18e10
SSDEEP 12288:kUETohnadVYcGM6D0yKDJgXqNMAAjzTcfn4Yg+:kUEMhn4TlAdWSGMJzTcfC+
TLSH
T11294232E4CB907F7727BBD2471E4E645F135CA9E920989ACFF6AF27C2553A4374A8004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertPush.ps1xml.ofx

Path C:\Users\Admin\Downloads\ConvertPush.ps1xml.ofx
Size 621KB
SHA256 e8480728ce10f663f4ff03d7abe37e52e983c1093989f3bf4464051fdb663c30
MD5 c771ffcd00010e45b222aa7a2f57e1c6
SHA1 aecc48bad08fd1994a9d8b196958ddc09ff12bb7
SHA512 7ad5977cc12ad614b3c948ab6941554dad75fb1bfcc5b8ce424668236f5d237c18d3fbaf924a379b00535c91b509c96a25e265378b059267f33d72eb4955c7d7
SSDEEP 12288:m3XwX+O5MI7bLBuiG7nkoezF+qwOwD2AbwpJHTBSA:mnwuONHLBur7nk7Lg2Kw3F9
TLSH
T1DCD42321E725BCCE669367FDC27BE2A0EC0D107D7ABC6B2FCC757792C9292584858490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DisableUnprotect.search-ms.ofx

Path C:\Users\Admin\Downloads\DisableUnprotect.search-ms.ofx
Size 504KB
SHA256 3e55450217d9bddddf4cc280882546c7b5cdf5e4df10190c8eb0c70608f31b88
MD5 b604a5c177636c1141b7957c593620be
SHA1 e2637dc07a50d9c246a9b50d1ac9f2947726fd10
SHA512 b34ace8f62becd669837d386f94addecca9d725022f259eeef1dcbe7310ff089e68f9c3c8c57a7beba8d9b692dc2e71936953711854888f5c6112fd44497ca50
SSDEEP 12288:4Psn4R/4gwKQociRrmZKK9r3wTLYxUaXN:4kn4R/4gwinmMkAHypN
TLSH
T1A5B4232AE81D2FA1055A086CBBC5F42DCCC81E6D95635FB9FB7320B7154778A924BC38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-1595-0x00007FF781100000-0x00007FF781148000-memory.dmp

Download

memory/400-0-0x0000020F627C0000-0x0000020F627C1000-memory.dmp

Download

memory/1128-1605-0x00007FF76F970000-0x00007FF76F9B8000-memory.dmp

Download

memory/4560-1608-0x00007FF62B550000-0x00007FF62B598000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads