4e16a07d350588ac97fbf84a87ffe415979e7296dc8fe4efcc1430ddbb3b55eb

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 21:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Size 2.0MB
Sample261102-1vmzzsdv3y
SHA256 4e16a07d350588ac97fbf84a87ffe415979e7296dc8fe4efcc1430ddbb3b55eb
MD5 d1bc408a25e7937ee5eafb0d64db612d
SHA1 475a02c5aa298d644d7bff6bb1380b3107e96a14
SHA512 dd5607c3c6ac845f3a30c665ac6074b3f604ab1e1c18175e539b38c25fe1f94b9a22d656090e40bc75b1fd12ee603ca00eca9f3f6da06ef519c5e4681b9964ee
SSDEEP 49152:lP0SwhbbPrdn8ybPGg9V1LWY5xedMahpJAFC:ZsoQInn
TLSH
T1B8A59E1AA27901FCD1E7C179CE475907EBB2B40903319BDB12D0DA661F23AE15F7A728
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/files/0x001000000001c4f2-42.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x001000000001c4f2-42.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x001000000001c4f2-42.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables containing possible sandbox analysis VM names 1 IoCs

resource	yara_rule
behavioral2/files/0x001000000001c4f2-42.dat	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
behavioral2/files/0x001000000001c4f2-42.dat	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
behavioral2/files/0x001000000001c4f2-42.dat	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Executes dropped EXE 1 IoCs

pid	Process
5016	msedge.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\svc\logs\Kg1Dp8.db	2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\svc\logs\Kg1Dp8.db-journal	2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\svc\logs\run_20261102_215828.log	2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\svc\logs\NC9LMt.db	msedge.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\svc\logs\NC9LMt.db-journal	msedge.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\svc\logs\run_20261102_215829.log	msedge.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\msedge.exe	2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5676	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 5016	3576	2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:2368

C:\Users\Admin\AppData\Local\Temp\2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe" -app-bound-decryption -service Admin
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files (x86)\Microsoft\Edge\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\msedge.exe" -app-bound-decryption -service Admin-exec
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cmd /C timeout /t 2 /nobreak > nul & del /f /q "C:\Program Files (x86)\Microsoft\Edge\msedge.exe"
  2⤵
  - Executes a command shell one-liner
  PID:5676

C:\Users\Admin\AppData\Local\Temp\2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
C:\Users\Admin\AppData\Local\Temp\2026-11-02_d1bc408a25e7937ee5eafb0d64db612d_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\msedge.exe
Size 2.0MB
SHA256 4e16a07d350588ac97fbf84a87ffe415979e7296dc8fe4efcc1430ddbb3b55eb
MD5 d1bc408a25e7937ee5eafb0d64db612d
SHA1 475a02c5aa298d644d7bff6bb1380b3107e96a14
SHA512 dd5607c3c6ac845f3a30c665ac6074b3f604ab1e1c18175e539b38c25fe1f94b9a22d656090e40bc75b1fd12ee603ca00eca9f3f6da06ef519c5e4681b9964ee
SSDEEP 49152:lP0SwhbbPrdn8ybPGg9V1LWY5xedMahpJAFC:ZsoQInn
TLSH
T1B8A59E1AA27901FCD1E7C179CE475907EBB2B40903319BDB12D0DA661F23AE15F7A728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

np_boot.log

Path C:\Users\Admin\AppData\Local\Temp\np_boot.log
Size 376B
SHA256 455d84c4a26d6f8d70b38098be67a795be9352183a60b6641893c0fd4f519e81
MD5 6ef0009c4eb21a5303148f6384c1f26a
SHA1 e0e4c0ed1a6cb3fd5f47a5b80eecf65aa496d38f
SHA512 426e7cb00144723b2b5bcc9a4338274abcb236410c5535b281982c743cc9ac4b36d8d4ee8041b9a21cc1d25bb861f71d114893081f36c409bea59d580706bcb2
TLSH
T1C4E0226084C38F1889A5B09B05BE889E0090A1A85A24626543D4CD2A20A580AAC90204
MD5 SHA1 SHA512 TLSH

Submit Download

rbx_240718531.db

Path C:\Users\Admin\AppData\Local\Temp\rbx_240718531.db
Size 20KB
SHA256 a07cda8b3e8d0165b63b2df8dfe30ed1062684518e8fafa93ab5954064e673ac
MD5 57ca62588dfa6603e8c70aa3ec10c1e4
SHA1 c30399b2d3b49ec554c87ba65261b9ed8c4ff64c
SHA512 bf223c40a82b85daa6f067be2398575023446ac289a0e78d7886af24c2c303b0ab9111b06cecb2efa15b87952afcfc147a120e51505a52cda557a6a8c5532afc
SSDEEP 24:TLyW91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fBnwd5oXCjn3PfjrJKlUzj:TeW9aw/aHLopFMavU1iBwHVrXJnf
TLSH
T19092008F1F303214C4F4CA37E8C24A572E7C226C93177A89EE5454F38CD28ABB50A5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rbx_240718531.db

Path C:\Users\Admin\AppData\Local\Temp\rbx_240718531.db
Size 24KB
SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
MD5 f20c4b926daf368f14b347d55a16cb41
SHA1 aedbb95b2328494e27a76d02ac5409154865d9c3
SHA512 8ec39bf908f1781a50fd054587a2b64f9051fc79ed1482674be1936f614d20bbc49dcef5033e1ecf2f219345414230b4421305de76ba25b28c49d3521d953885
SSDEEP 24:TL8z/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ61:TQz/LopFMaty423w/a9NUuT
TLSH
T140B2594D1F307220C0F44B36EDD189572F7C211CD3A326599E1810F3DE925ABF61956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rbxg_240718531.db

Path C:\Users\Admin\AppData\Local\Temp\rbxg_240718531.db
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hqp22N.db

Path C:\Users\Admin\AppData\Roaming\svc\logs\Hqp22N.db
Size 40KB
SHA256 10feecad49c990f5f4aabf723215e0a6a95feff28b93fd3c520cb1878868fbc4
MD5 465e90b8e9e5145facc540a7e15004c6
SHA1 02ab4e24fd60000957290b7fab4e23281b850dde
SHA512 c05cc139e3a3033880cb4b8045a0be5a80f6464fc20df7c892ef462c0b80200fd4a019610670d897c776865b9e7cb8a0982b728a8d5ceaded5ffef637225cfa5
SSDEEP 48:T2ytg5M+Fmpse+QvIt09X/twc15PwUMbw/5v3O2iZntH+TY:iytgO7tdvIa9ycfVMmvYZ1+T
TLSH
T16003BFDF4F192714CCE94672DA5220578BBC4E1E86535FD43EE410A1CC97BD184715BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hqp22N.db

Path C:\Users\Admin\AppData\Roaming\svc\logs\Hqp22N.db
Size 1020KB
SHA256 f411a99b74b4357694a01f787480af7029f2f91de5ad5ad2499153eaeb20d8a8
MD5 eefb6e04a9b2cabc6cc3086b6c41bd61
SHA1 9d0dea045728a505af1a37e5c080aaa1afad2ffd
SHA512 96ed509ed25f457315bc46718e5b0732587f1ca40ac44fe3d5850a11bd3f2d30d767d1f0ae36484e0d4f21ef6f40fb36a6039f048cea924cbd84b05208557fee
SSDEEP 24576:D6DOo1Av8JTkNSZjvJAAp7tv/zpZYlHpiwEsEX:gd+UZjJA6/tiAhTX
TLSH
T1B82533344DA63553FDAEF6F9C30813D6336E363E94A58C276A6E61521C5F8102D2F2E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kg1Dp8.db

Path C:\Users\Admin\AppData\Roaming\svc\logs\Kg1Dp8.db
Size 40KB
SHA256 ebe9efd763aef0679f1370f5cabdc3fdaada9e3508c23e467adedca2526448d7
MD5 fd8ebe060ec56b70e67617f9232fc29e
SHA1 885050a840b50bd1eb9f1f72faca095f7a89e424
SHA512 d707e0d96e591ad48a475c9df37d14f5b2e317583cc9ab4c0352a4fa97919ae9ac8ae79a535d7d1e13c7ab287aec09e05e1699851d8ece9724e4e4d9a6e08353
SSDEEP 48:Tt5tg5M+Fmpse+QvIt09X/twc15PwUMbw/5v3O2iZntH:btgO7tdvIa9ycfVMmvYZ1
TLSH
T1B5039BDF8B1D3718C8E95672DE5120678A7C5E1E86236FE83EF110A2CC87B81556187E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

np_boot.log

Path C:\Windows\TEMP\np_boot.log
Size 370B
SHA256 f368a7728ad2ce5e004da4045a41d73fc75c527a7ccbb21d2d9422a5ac392a65
MD5 4c34c0638cd8931730d9fd52211db6d0
SHA1 fb40bde7cb3f8f78d1ead5b358c1cbb439267e27
SHA512 6b2ac75f91a16d19e4c6274d35b9e28b8195699991013c7db24f0fc798d64031c150ec4d9133b83e8789b16c0bb4be80bea47768de7a0af57bff2d0b3b10c08e
TLSH
T132E0611085C3C71CD6D3B0972F7DDC1D4064357C65242721B391CE3B10914296EA8381
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2368-11-0x00007FFCE4120000-0x00007FFCE4383000-memory.dmp

Download

memory/2448-28-0x00007FFCE4120000-0x00007FFCE4383000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads