Overview

overview

9

Static

static

3

2026-11-01...ar.exe

windows10-2004-x64

9

2026-11-01...ar.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    151s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 14:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_961d408942f8cbb6e60e8b8230a93538_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 54.5MB
  • Sample261102-rnxfeafd25
  • SHA256 e800292eb445a430a5b9b7c82a6d47993a007a89e0b30d26a841e1239ca1474a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoveryexecutionspywarestealer

Malware Config

Signatures

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables Discord URL observed in first stage droppers 1 IoCs
  • Loads dropped DLL 47 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_961d408942f8cbb6e60e8b8230a93538_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_961d408942f8cbb6e60e8b8230a93538_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4944
    • C:\Users\Admin\AppData\Local\Temp\2026-11-01_961d408942f8cbb6e60e8b8230a93538_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
      C:\Users\Admin\AppData\Local\Temp\2026-11-01_961d408942f8cbb6e60e8b8230a93538_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar.exe
      2⤵
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3416
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:5088
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:5116

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          _raw_aes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Cipher\_raw_aes.pyd
          • Size 34KB
          • SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _imaging.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\PIL\_imaging.pyd
          • Size 2.4MB
          • SHA256 676e119107b4787c79532c97a0aaa7fbfc891bd267fdbaf5b2888e3b68f0f29f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          VCRUNTIME140_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\VCRUNTIME140_1.dll
          • Size 37KB
          • SHA256 1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
          • Size 81KB
          • SHA256 5843872d5e2b08f138a71fe9ba94813afee59c8b48166d4a8eb0f606107a7e80
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cffi_backend.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_cffi_backend.pyd
          • Size 174KB
          • SHA256 207ac9896b3fd951c978747c2a7492afe128dd1075e129919fa5720de482b1d8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd
          • Size 154KB
          • SHA256 613de58e4a9a80eff8f8bc45c350a6eaebf89f85ffd2d7e3b0b266bf0888a60a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _queue.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_queue.pyd
          • Size 30KB
          • SHA256 2f71046891ba279b00b70eb031fe90b379dbe84559cf49ce5d1297ea6bf47a78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
          • Size 76KB
          • SHA256 39715ef8d043354f0ab15f62878530a38518fb6192bc48da6a098498e8d35769
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _sqlite3.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_sqlite3.pyd
          • Size 115KB
          • SHA256 ddbed9d48b17c54fd3005f5a868dd63cb8f3efe2c22c1821cebb2fe72836e446
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          cacert.pem
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem
          • Size 284KB
          • SHA256 488ba960602bf07cc63f4ef7aec108692fec41820fc3328a8e3f3de038149aee
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          md__mypyc.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md__mypyc.pyd
          • Size 116KB
          • SHA256 3d9893aa79efd13d81fcd614e9ef5fb6aad90569beeded5112de5ed5ac3cf753
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-1_1.dll
          • Size 3.3MB
          • SHA256 976ce72efd0a8aeeb6e21ad441aa9138434314ea07f777432205947cdb149541
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libssl-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-1_1.dll
          • Size 686KB
          • SHA256 2aebb73530d21a2273692a5a3d57235b770daf1c35f60c74e01754a5dac05071
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy.libs\libopenblas64__v0.3.23-293-gc2f4bdbb-gcc_10_3_0-2bde3a66a51006b2b53eb373ff767a3f.dll
          • Size 36.4MB
          • SHA256 57b87772bf676b5c2d718c79dddc9f039d79ec3319fee1398cc305adff7b69e5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multiarray_umath.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy\core\_multiarray_umath.pyd
          • Size 2.7MB
          • SHA256 c76d812fa5131fe21c8bf9ffbd910f27df80856f910fa61698f23f60cfd9d13e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _umath_linalg.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\numpy\linalg\_umath_linalg.pyd
          • Size 104KB
          • SHA256 05922a2be823ec2e4d2378a73b05bb37f2816aeea86b613a9c80e25764ac8736
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          pywintypes311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pywintypes311.dll
          • Size 132KB
          • SHA256 f33290cafcf91b6bd5b12b808198cbf816b68529e00e1b3563f63916529a0657
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          sqlite3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\sqlite3.dll
          • Size 1.4MB
          • SHA256 8d58db3067899c997c2db13baf13cd4136f3072874b3ca1f375937e37e33d800
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          win32crypt.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32crypt.pyd
          • Size 120KB
          • SHA256 fc5a93faa4b353a5e11efad460b6e552efeb040a8e44eca64d8d49bff655fdb6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          backend_c.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\zstandard\backend_c.pyd
          • Size 507KB
          • SHA256 6ab611c4a24406d9d97f09d49d50142ab2734b69a2b0d9ea6489e4af90c4a2a4
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _raw_aesni.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4944_134381028759358395\Crypto\Cipher\_raw_aesni.pyd
          • Size 15KB
          • SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _cpuid_c.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4944_134381028759358395\Crypto\Util\_cpuid_c.pyd
          • Size 10KB
          • SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4944_134381028759358395\_ctypes.pyd
          • Size 120KB
          • SHA256 e662d2b35bb48c5f3432bde79c0d20313238af800968ba0faa6ea7e7e5ef4535
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4944_134381028759358395\_hashlib.pyd
          • Size 62KB
          • SHA256 39bc615842a176db72d4e0558f3cdcae23ab0623ad132f815d21dcfbfd4b110e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ssl.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4944_134381028759358395\_ssl.pyd
          • Size 155KB
          • SHA256 cb42e8598e3fa53eeebf63f2af1730b9ec64614bda276ab2cd1f1c196b3d7e32
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          md.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4944_134381028759358395\charset_normalizer\md.pyd
          • Size 10KB
          • SHA256 790a11aa270523c2efa6021ce4f994c3c5a67e8eaaaf02074d5308420b68bd94
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-8.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4944_134381028759358395\libffi-8.dll
          • Size 34KB
          • SHA256 128a583e821e52b595eb4b3dda17697d3ca456ee72945f7ecce48ededad0e93c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _multiarray_tests.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4944_134381028759358395\numpy\core\_multiarray_tests.pyd
          • Size 63KB
          • SHA256 c31d1abe635e9006caa9fedda260dd4e4fdba31fbdcc8ac0969ab0396a0c6c4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          psww.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4944_134381028759358395\psww.dll
          • Size 27.9MB
          • SHA256 a9d924dd4c54eada8ad45b16359a7211433946e15b8dac37e8ec7bfff12895ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python311.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4944_134381028759358395\python311.dll
          • Size 5.5MB
          • SHA256 a0cf640e756875c25c12b4a38ba5f2772e8e512036e2ac59eb8567bf05ffbfb7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4944_134381028759358395\select.pyd
          • Size 28KB
          • SHA256 0046eb32f873cde62cf29af02687b1dd43154e9fd10e0aa3d8353d3debb38790
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4944_134381028759358395\unicodedata.pyd
          • Size 1.1MB
          • SHA256 ecf7836aa0d36b5880eb6f799ec402b1f2e999f78bfff6fb9a942d1d8d0b9baa
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          vcruntime140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\onefile_4944_134381028759358395\vcruntime140.dll
          • Size 96KB
          • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          temp_login_db_5456615312269624716.db
          • Path C:\Users\Admin\AppData\Local\Temp\temp_login_db_5456615312269624716.db
          • Size 50KB
          • SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          temp_login_db_8115872671727800638.db
          • Path C:\Users\Admin\AppData\Local\Temp\temp_login_db_8115872671727800638.db
          • Size 40KB
          • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/3416-160-0x00007FFE25FC0000-0x00007FFE28076000-memory.dmp
          Download