Overview

overview

9

Static

static

3

2026-11-01...ar.exe

windows10-2004-x64

9

2026-11-01...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/11/2026, 14:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_961d408942f8cbb6e60e8b8230a93538_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 54.5MB
  • Sample261102-rnxfeafd25
  • SHA256 e800292eb445a430a5b9b7c82a6d47993a007a89e0b30d26a841e1239ca1474a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryexecutionspywarestealer

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Loads dropped DLL 47 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_961d408942f8cbb6e60e8b8230a93538_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_961d408942f8cbb6e60e8b8230a93538_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Users\Admin\AppData\Local\Temp\2026-11-01_961d408942f8cbb6e60e8b8230a93538_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-11-01_961d408942f8cbb6e60e8b8230a93538_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4156
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:3464

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
        • Size 120KB
        • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cacert.pem
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem
        • Size 284KB
        • SHA256 488ba960602bf07cc63f4ef7aec108692fec41820fc3328a8e3f3de038149aee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md.pyd
        • Size 10KB
        • SHA256 790a11aa270523c2efa6021ce4f994c3c5a67e8eaaaf02074d5308420b68bd94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiarray_umath.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy\core\_multiarray_umath.pyd
        • Size 2.7MB
        • SHA256 c76d812fa5131fe21c8bf9ffbd910f27df80856f910fa61698f23f60cfd9d13e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _umath_linalg.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy\linalg\_umath_linalg.pyd
        • Size 104KB
        • SHA256 05922a2be823ec2e4d2378a73b05bb37f2816aeea86b613a9c80e25764ac8736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\sqlite3.dll
        • Size 1.4MB
        • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        backend_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\zstandard\backend_c.pyd
        • Size 507KB
        • SHA256 6ab611c4a24406d9d97f09d49d50142ab2734b69a2b0d9ea6489e4af90c4a2a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_aes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\Crypto\Cipher\_raw_aes.pyd
        • Size 34KB
        • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _raw_aesni.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\Crypto\Cipher\_raw_aesni.pyd
        • Size 15KB
        • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cpuid_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\Crypto\Util\_cpuid_c.pyd
        • Size 10KB
        • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _imaging.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\PIL\_imaging.pyd
        • Size 2.4MB
        • SHA256 676e119107b4787c79532c97a0aaa7fbfc891bd267fdbaf5b2888e3b68f0f29f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\VCRUNTIME140.dll
        • Size 96KB
        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\_bz2.pyd
        • Size 81KB
        • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cffi_backend.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\_cffi_backend.pyd
        • Size 174KB
        • SHA256 207ac9896b3fd951c978747c2a7492afe128dd1075e129919fa5720de482b1d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\_hashlib.pyd
        • Size 62KB
        • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\_lzma.pyd
        • Size 154KB
        • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\_queue.pyd
        • Size 30KB
        • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\_socket.pyd
        • Size 76KB
        • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\_sqlite3.pyd
        • Size 115KB
        • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\_ssl.pyd
        • Size 155KB
        • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        md__mypyc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\charset_normalizer\md__mypyc.pyd
        • Size 116KB
        • SHA256 3d9893aa79efd13d81fcd614e9ef5fb6aad90569beeded5112de5ed5ac3cf753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\libcrypto-1_1.dll
        • Size 3.3MB
        • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\libffi-8.dll
        • Size 34KB
        • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\libssl-1_1.dll
        • Size 686KB
        • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\numpy.libs\libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll
        • Size 36.4MB
        • SHA256 57b87772bf676b5c2d718c79dddc9f039d79ec3319fee1398cc305adff7b69e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _multiarray_tests.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\numpy\core\_multiarray_tests.pyd
        • Size 63KB
        • SHA256 c31d1abe635e9006caa9fedda260dd4e4fdba31fbdcc8ac0969ab0396a0c6c4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        psww.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\psww.dll
        • Size 27.9MB
        • SHA256 a9d924dd4c54eada8ad45b16359a7211433946e15b8dac37e8ec7bfff12895ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\python311.dll
        • Size 5.5MB
        • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\pywintypes311.dll
        • Size 132KB
        • SHA256 f33290cafcf91b6bd5b12b808198cbf816b68529e00e1b3563f63916529a0657
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\select.pyd
        • Size 28KB
        • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\unicodedata.pyd
        • Size 1.1MB
        • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vcruntime140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\vcruntime140_1.dll
        • Size 37KB
        • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32crypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\onefile_1616_134381028735291436\win32crypt.pyd
        • Size 120KB
        • SHA256 fc5a93faa4b353a5e11efad460b6e552efeb040a8e44eca64d8d49bff655fdb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        temp_login_db_5941251478706887838.db
        • Path C:\Users\Admin\AppData\Local\Temp\temp_login_db_5941251478706887838.db
        • Size 40KB
        • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        temp_login_db_8384878299895120530.db
        • Path C:\Users\Admin\AppData\Local\Temp\temp_login_db_8384878299895120530.db
        • Size 56KB
        • SHA256 a36a4989ed48954499586d6551e61d6bccfc7bee269b4eab0bb836e394c24c7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4156-161-0x00007FF9BED10000-0x00007FF9C0DC6000-memory.dmp
        Download