Overview

overview

7

Static

static

1

2026-10-28...om.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/10/2026, 22:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-28_9ea3b0ac1d0eb4cc9ae5d42fe1d2910c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
  • Size 9.2MB
  • Sample261029-2ekelatvav
  • SHA256 fa1023f728eaaf0fa53b6b75813295bc376bc6a96c3ecf7829861bf4bc1dea59
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryspywarestealertrojan

Malware Config

Signatures

  • Writes a Windows system DLL name to a user directory 2 TTPs 1 IoCs

    A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.

    defense_evasion
  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-28_9ea3b0ac1d0eb4cc9ae5d42fe1d2910c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-28_9ea3b0ac1d0eb4cc9ae5d42fe1d2910c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe"
    1⤵
    • Downloads MZ/PE file
    • Enumerates connected drives
    • Reads the TCP/IP host and domain name from the registry
    • Enumerates system info in registry
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4892
    • C:\Users\Admin\AppData\Local\Temp\2026-10-28_9ea3b0ac1d0eb4cc9ae5d42fe1d2910c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
      C:\Users\Admin\AppData\Local\Temp\2026-10-28_9ea3b0ac1d0eb4cc9ae5d42fe1d2910c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.45 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff6fe0702d8,0x7ff6fe0702e8,0x7ff6fe0702f8
      2⤵
        PID:2428
      • C:\Users\Admin\AppData\Local\Temp\.opera\4d8078cb-9f74-45ae-86ea-8e30587f047a Opera GX Installer Temp\2026-10-28_9ea3b0ac1d0eb4cc9ae5d42fe1d2910c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\4d8078cb-9f74-45ae-86ea-8e30587f047a Opera GX Installer Temp\2026-10-28_9ea3b0ac1d0eb4cc9ae5d42fe1d2910c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe" --version
        2⤵
        • Executes dropped EXE
        PID:5308
      • C:\Users\Admin\AppData\Local\Temp\.opera\4d8078cb-9f74-45ae-86ea-8e30587f047a Opera GX Installer Temp\opera_package_202610292229491\assistant\Opera_GX_assistant_138.0.6044.65_Setup.exe_sfx.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\4d8078cb-9f74-45ae-86ea-8e30587f047a Opera GX Installer Temp\opera_package_202610292229491\assistant\Opera_GX_assistant_138.0.6044.65_Setup.exe_sfx.exe"
        2⤵
        • Writes a Windows system DLL name to a user directory
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4884
      • C:\Users\Admin\AppData\Local\Temp\.opera\4d8078cb-9f74-45ae-86ea-8e30587f047a Opera GX Installer Temp\opera_package_202610292229491\assistant\assistant_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\.opera\4d8078cb-9f74-45ae-86ea-8e30587f047a Opera GX Installer Temp\opera_package_202610292229491\assistant\assistant_installer.exe" --version
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:4024
        • C:\Users\Admin\AppData\Local\Temp\.opera\4d8078cb-9f74-45ae-86ea-8e30587f047a Opera GX Installer Temp\opera_package_202610292229491\assistant\assistant_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\.opera\4d8078cb-9f74-45ae-86ea-8e30587f047a Opera GX Installer Temp\opera_package_202610292229491\assistant\assistant_installer.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=138.0.6044.65 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x11cb558,0x11cb564,0x11cb570
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:3064

    Network

          MITRE ATT&CK Enterprise v16

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Persistence

          Hijack Execution Flow

          1
          T1574

          DLL Search Order Hijacking

          1
          T1574.001

          Privilege Escalation

          Hijack Execution Flow

          1
          T1574

          DLL Search Order Hijacking

          1
          T1574.001

          Defense Evasion

          Hijack Execution Flow

          1
          T1574

          DLL Search Order Hijacking

          1
          T1574.001

          Masquerading

          1
          T1036

          Match Legitimate Name or Location

          1
          T1036.005

          Modify Registry

          1
          T1112

          Subvert Trust Controls

          1
          T1553

          Install Root Certificate

          1
          T1553.004

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          2
          T1012

          System Information Discovery

          2
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          2026-10-28_9ea3b0ac1d0eb4cc9ae5d42fe1d2910c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
          • Path C:\Users\Admin\AppData\Local\Temp\.opera\4d8078cb-9f74-45ae-86ea-8e30587f047a Opera GX Installer Temp\2026-10-28_9ea3b0ac1d0eb4cc9ae5d42fe1d2910c_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom.exe
          • Size 9.2MB
          • SHA256 fa1023f728eaaf0fa53b6b75813295bc376bc6a96c3ecf7829861bf4bc1dea59
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          additional_file0.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\.opera\4d8078cb-9f74-45ae-86ea-8e30587f047a Opera GX Installer Temp\opera_package_202610292229491\additional_file0.tmp
          • Size 3.2MB
          • SHA256 8d1e4a8a13191d403e17a993896355662aa334be3bc865e16aa7286096ae7ee2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          assistant_installer.exe
          • Path C:\Users\Admin\AppData\Local\Temp\.opera\4d8078cb-9f74-45ae-86ea-8e30587f047a Opera GX Installer Temp\opera_package_202610292229491\assistant\assistant_installer.exe
          • Size 2.5MB
          • SHA256 47022db9ccfec3e7e2d7e370c634f8ecd709a52c998d50a182108b0ef98cc0be
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          browser_assistant.exe
          • Path C:\Users\Admin\AppData\Local\Temp\.opera\4d8078cb-9f74-45ae-86ea-8e30587f047a Opera GX Installer Temp\opera_package_202610292229491\assistant\browser_assistant.exe
          • Size 5.3MB
          • SHA256 a1d64e1b9eb0e98e9803d6532cf04032f58cec0e32620b1f154e6be088834c4d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dbgcore.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.opera\4d8078cb-9f74-45ae-86ea-8e30587f047a Opera GX Installer Temp\opera_package_202610292229491\assistant\dbgcore.dll
          • Size 238KB
          • SHA256 e4e5cbdd1d1da29cd7bfa36379824041111c9f820c1737614fd677e0ca38623e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          dbghelp.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.opera\4d8078cb-9f74-45ae-86ea-8e30587f047a Opera GX Installer Temp\opera_package_202610292229491\assistant\dbghelp.dll
          • Size 589KB
          • SHA256 5ae4f4925678573357af66ad2eb5b99e1cd84d33a98aa909af9683fb902277f0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          files_list
          • Path C:\Users\Admin\AppData\Local\Temp\.opera\4d8078cb-9f74-45ae-86ea-8e30587f047a Opera GX Installer Temp\opera_package_202610292229491\assistant\files_list
          • Size 86B
          • SHA256 403b9075eb28634cb9000e1029fbfb968274642e3a2356d9fbc18c2ab3c60eaa
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          msdia140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\.opera\4d8078cb-9f74-45ae-86ea-8e30587f047a Opera GX Installer Temp\opera_package_202610292229491\assistant\msdia140.dll
          • Size 2.5MB
          • SHA256 b719a8d47ac39ccaa6c4bd2fe148b8e6c4f3592b369b10f1a34f6dde92e9f112
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          settings.dat
          • Path C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports\settings.dat
          • Size 40B
          • SHA256 c8196e922cff106298fc35bcc5fc0670bd6db4487da2400e6739694f83a3df48
          • MD5 SHA1 SHA512
          Submit Download