Overview

overview

10

Static

static

10

2026-11-02...om.exe

windows10-2004-x64

9

2026-11-02...om.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 23:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-02_be1ca72267c20ee620e359d6dd272990_cobalt-strike_glassworm_icedid_satacom.exe
  • Size 40.6MB
  • Sample261102-3115xage87
  • SHA256 5db1bfeb4a0e698df944973650cc1cf9d4257b8ecbb8c4cacc66879d4df67009
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryexecution

Malware Config

Signatures

  • Detects executables containing URLs to raw contents of a Github gist 3 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-02_be1ca72267c20ee620e359d6dd272990_cobalt-strike_glassworm_icedid_satacom.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-02_be1ca72267c20ee620e359d6dd272990_cobalt-strike_glassworm_icedid_satacom.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -Command "(Get-CimInstance Win32_Processor | Select-Object -First 1).MaxClockSpeed"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3704
    • C:\Users\Admin\AppData\Local\Temp\2026-11-02_be1ca72267c20ee620e359d6dd272990_cobalt-strike_glassworm_icedid_satacom.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-11-02_be1ca72267c20ee620e359d6dd272990_cobalt-strike_glassworm_icedid_satacom.exe" --version
      2⤵
        PID:6084
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -Command "(Get-CimInstance Win32_Processor | Measure-Object NumberOfCores -Sum).Sum"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2492
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" -NoProfile -Command "@(Get-CimInstance Win32_Battery).Count"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2640
      • C:\Windows\system32\reg.exe
        "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
        2⤵
          PID:5788
        • C:\Windows\system32\reg.exe
          "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR
          2⤵
            PID:3044
          • C:\Windows\system32\reg.exe
            "reg" query HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 /v ProcessorNameString
            2⤵
            • Checks processor information in registry
            • Modifies registry key
            PID:3220
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:5740
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -NoProfile -Command "(Get-CimInstance Win32_Battery | Select-Object -First 1).BatteryStatus"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            PID:4172
          • C:\Windows\system32\reg.exe
            "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuild
            2⤵
              PID:5080
            • C:\Windows\system32\reg.exe
              "reg" query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR
              2⤵
                PID:6112
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -NoProfile -Command "(Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:3860
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -NoProfile -Command "(Get-CimInstance Win32_Battery | Select-Object -First 1).BatteryStatus"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                PID:5920

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 6a586d51e7e2f7b7697d8dd340e85d7dd4e96e50bd1060fa9a9f06becced0c6c
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 689506311d85574f4979ff4a67499db98b0492919af443c7aac2a585b8ff2588
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 4f5a192ee7a093453ab6cd376ea03e565419e6274a42fbd78026e4eefe46b178
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 25d7e831bccd1d03fd027b8a7e8159bcc7e4062161f7f541052e5a635e4f4321
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 616a5f0ae7f26ba24b505902798ba7993f9f5543c8f3dfb81be80ecbcaef4ec6
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 0839dbbe57e94173e706666f9cac45725a43f9be671a4550afe91912724f9181
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  __PSScriptPolicyTest_ujygrggq.hpw.psm1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ujygrggq.hpw.psm1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  horizon-launcher.exe
                  • Path C:\Users\Admin\AppData\Roaming\horizon-launcher\.launcher-update\unpacked\horizon-launcher.exe
                  • Size 43.8MB
                  • SHA256 bf411c028eeab8fca3bf95de305c3fe17b23d232848fd402da7c383ea58d217f
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/1108-1122-0x00007FF711C20000-0x00007FF7144BE000-memory.dmp
                  Download

                  memory/1108-1154-0x00007FF711C20000-0x00007FF7144BE000-memory.dmp
                  Download

                  memory/3704-5-0x000001A97E5D0000-0x000001A97E5F2000-memory.dmp
                  Download

                  memory/3704-8-0x000001A97E650000-0x000001A97E66E000-memory.dmp
                  Download

                  memory/3704-9-0x000001A97E890000-0x000001A97E942000-memory.dmp
                  Download

                  memory/3704-11-0x000001A97EBD0000-0x000001A97EBFA000-memory.dmp
                  Download

                  memory/3704-12-0x000001A97EBD0000-0x000001A97EBF4000-memory.dmp
                  Download

                  memory/3704-10-0x000001A97E670000-0x000001A97E67A000-memory.dmp
                  Download