Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 09:23
General
- Target 2026-11-01_c3c0046b9b37af13e3d92a3a55c3ba7e_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_vidar.exe
- Size 35.5MB
- Sample261102-lchj8astbs
- SHA256 c6d930895028a26fe6f90f2dffa831c889b1ddc7bd3775b9a01f3b33910067aa
Malware Config
Signatures
- Checks system information in the registry 2 TTPs 1 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in Program Files directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_c3c0046b9b37af13e3d92a3a55c3ba7e_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_c3c0046b9b37af13e3d92a3a55c3ba7e_cobalt-strike_glassworm_hijackloader_icedid_njrat_satacom_vidar.exe"1⤵
- Checks system information in the registry
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /TN "AMD RELAUNCHER" /F2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0287568f6b75a8de2d21278106c373f2fd10f5ab.qmlc
035bd1961fc0b56401f844ac7f27000b2e5c267e.qmlc
0604b8b0c1778521b35b8ddf211e84b132df14c3.qmlc
0bd5cf23c1a78fdd98ccbf96a05645392c65305c.qmlc
1052e95a6ea8140c0585142920e375367353c47f.qmlc
24bff65040f0a3d2afc097e7412218471af841dc.qmlc
2957889c4d99155aef8c1588bac9d45b5885decc.qmlc
2bc317354f3bab1a3d2ed063c231dededb474d8e.qmlc
4cd559242ba6ab4e3f2efd54dd0bd171f3d0b67a.qmlc
55c4c6d475a74e252722e83e783f5859ee42abdd.qmlc
67fe1bb0e4d609f3d05ac383701251247239fa6d.qmlc
691457a2a48aad1e983134a987a9e6b552571b27.qmlc
764491f39a190ce4784fe9fb5f9321d6a83a6923.qmlc
766661093b5230384e728dc42d86b31da8abe632.qmlc
76aca5c7844b29e0362f70becc73c1f0b6cc503b.qmlc
95a8b5eb4b9d209a46517148d3490ca93123bfc6.qmlc
aa40874ce2418635a6077d8b3fddbd3b9ca68cdc.qmlc
bfb7d8a31ef675ad7899af4197a9266a736dc41d.qmlc
cb5435919f4ea4b19e444b5070c3785a14f1e6c4.qmlc
error_codes.json
memory/1624-51-0x000001B173400000-0x000001B173401000-memory.dmp
memory/1624-96-0x000001B174140000-0x000001B174141000-memory.dmp
memory/1624-74-0x000001B173440000-0x000001B173441000-memory.dmp
memory/1624-73-0x000001B173440000-0x000001B173441000-memory.dmp
memory/1624-72-0x000001B173440000-0x000001B173441000-memory.dmp
memory/1624-71-0x000001B173440000-0x000001B173441000-memory.dmp
memory/1624-70-0x000001B173430000-0x000001B173431000-memory.dmp
memory/1624-69-0x000001B173440000-0x000001B173441000-memory.dmp
memory/1624-67-0x000001B173430000-0x000001B173431000-memory.dmp
memory/1624-66-0x000001B173430000-0x000001B173431000-memory.dmp
memory/1624-65-0x000001B173420000-0x000001B173421000-memory.dmp
memory/1624-64-0x000001B173430000-0x000001B173431000-memory.dmp
memory/1624-63-0x000001B173430000-0x000001B173431000-memory.dmp
memory/1624-62-0x000001B173430000-0x000001B173431000-memory.dmp
memory/1624-61-0x000001B173430000-0x000001B173431000-memory.dmp
memory/1624-59-0x000001B173420000-0x000001B173421000-memory.dmp
memory/1624-58-0x000001B173420000-0x000001B173421000-memory.dmp
memory/1624-57-0x000001B173420000-0x000001B173421000-memory.dmp
memory/1624-56-0x000001B173420000-0x000001B173421000-memory.dmp
memory/1624-55-0x000001B173420000-0x000001B173421000-memory.dmp
memory/1624-54-0x000001B173420000-0x000001B173421000-memory.dmp
memory/1624-52-0x000001B173400000-0x000001B173401000-memory.dmp
memory/1624-76-0x000001B173440000-0x000001B173441000-memory.dmp
memory/1624-50-0x000001B173400000-0x000001B173401000-memory.dmp
memory/1624-49-0x000001B173400000-0x000001B173401000-memory.dmp
memory/1624-48-0x000001B173400000-0x000001B173401000-memory.dmp
memory/1624-101-0x000001B174150000-0x000001B174151000-memory.dmp
memory/1624-102-0x000001B174150000-0x000001B174151000-memory.dmp
memory/1624-99-0x000001B174140000-0x000001B174141000-memory.dmp
memory/1624-98-0x000001B174140000-0x000001B174141000-memory.dmp
memory/1624-97-0x000001B174140000-0x000001B174141000-memory.dmp
memory/1624-75-0x000001B173430000-0x000001B173431000-memory.dmp
memory/1624-95-0x000001B174140000-0x000001B174141000-memory.dmp
memory/1624-94-0x000001B173450000-0x000001B173451000-memory.dmp
memory/1624-93-0x000001B173450000-0x000001B173451000-memory.dmp
memory/1624-92-0x000001B174140000-0x000001B174141000-memory.dmp
memory/1624-118-0x000001B174170000-0x000001B174171000-memory.dmp
memory/1624-117-0x000001B174170000-0x000001B174171000-memory.dmp
memory/1624-115-0x000001B174160000-0x000001B174161000-memory.dmp
memory/1624-114-0x000001B174160000-0x000001B174161000-memory.dmp
memory/1624-113-0x000001B174160000-0x000001B174161000-memory.dmp
memory/1624-112-0x000001B174160000-0x000001B174161000-memory.dmp
memory/1624-111-0x000001B174160000-0x000001B174161000-memory.dmp
memory/1624-110-0x000001B174150000-0x000001B174151000-memory.dmp
memory/1624-109-0x000001B173450000-0x000001B173451000-memory.dmp
memory/1624-108-0x000001B174160000-0x000001B174161000-memory.dmp
memory/1624-106-0x000001B174150000-0x000001B174151000-memory.dmp
memory/1624-105-0x000001B174150000-0x000001B174151000-memory.dmp
memory/1624-104-0x000001B173450000-0x000001B173451000-memory.dmp
memory/1624-103-0x000001B174150000-0x000001B174151000-memory.dmp
memory/1624-77-0x000001B173440000-0x000001B173441000-memory.dmp
memory/1624-78-0x000001B173440000-0x000001B173441000-memory.dmp
memory/1624-79-0x000001B173440000-0x000001B173441000-memory.dmp
memory/1624-81-0x000001B173450000-0x000001B173451000-memory.dmp
memory/1624-82-0x000001B173450000-0x000001B173451000-memory.dmp
memory/1624-83-0x000001B173450000-0x000001B173451000-memory.dmp
memory/1624-84-0x000001B173450000-0x000001B173451000-memory.dmp
memory/1624-155-0x000001B174150000-0x000001B174151000-memory.dmp
memory/1624-154-0x000001B174170000-0x000001B174171000-memory.dmp
memory/1624-153-0x000001B174160000-0x000001B174161000-memory.dmp
memory/1624-152-0x000001B174160000-0x000001B174161000-memory.dmp
memory/1624-151-0x000001B173440000-0x000001B173441000-memory.dmp
memory/1624-0-0x000001B170900000-0x000001B170D40000-memory.dmp
memory/1624-2-0x000001B170D40000-0x000001B170F40000-memory.dmp