Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
07/11/2026, 09:41
General
- Target 2026-11-07_d6a783a92f5cf86d8a9cf54de10b8435_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe
- Size 3.2MB
- Sample261107-ln94lsaz7t
- SHA256 0299967697ccf07dce963fe375c2dc139a4d49f1ddfe5899aded270f9b434074
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Program Files directory 1 IoCs
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-07_d6a783a92f5cf86d8a9cf54de10b8435_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-07_d6a783a92f5cf86d8a9cf54de10b8435_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_remcos_vidar.exe"1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5212-1-0x0000000000A60000-0x0000000000B27000-memory.dmp
memory/5212-3-0x0000000001150000-0x00000000011C4000-memory.dmp
memory/5212-4-0x00000000011D0000-0x0000000001393000-memory.dmp
memory/5212-5-0x0000000001500000-0x00000000015B2000-memory.dmp
memory/5212-2-0x0000000000B30000-0x0000000000ED1000-memory.dmp
memory/5212-6-0x0000000001670000-0x0000000001D66000-memory.dmp
memory/5212-9-0x0000000002140000-0x000000000219D000-memory.dmp
memory/5212-10-0x00000000021A0000-0x0000000002316000-memory.dmp
memory/5212-11-0x0000000002320000-0x000000000239A000-memory.dmp
memory/5212-12-0x00000000023A0000-0x0000000002630000-memory.dmp
memory/5212-14-0x0000000002670000-0x000000000267D000-memory.dmp
memory/5212-15-0x0000000002680000-0x00000000028C1000-memory.dmp
memory/5212-18-0x0000000001D70000-0x0000000001E86000-memory.dmp
memory/5212-26-0x00000000015F0000-0x0000000001638000-memory.dmp
memory/5212-32-0x0000000004C00000-0x0000000004CAD000-memory.dmp
memory/5212-34-0x0000000004CB0000-0x0000000004D83000-memory.dmp
memory/5212-41-0x00000000067D0000-0x00000000067EC000-memory.dmp
memory/5212-52-0x000000000DD30000-0x000000000DE55000-memory.dmp
memory/5212-58-0x0000000007210000-0x000000000743A000-memory.dmp
memory/5212-57-0x000000000EE50000-0x000000000EE7D000-memory.dmp
memory/5212-56-0x000000000EE00000-0x000000000EE3F000-memory.dmp
memory/5212-55-0x000000000EDC0000-0x000000000EDF0000-memory.dmp
memory/5212-54-0x000000000E950000-0x000000000EAB8000-memory.dmp
memory/5212-53-0x000000000E660000-0x000000000E943000-memory.dmp
memory/5212-51-0x000000000DAE0000-0x000000000DC24000-memory.dmp
memory/5212-50-0x000000000DA30000-0x000000000DADC000-memory.dmp
memory/5212-48-0x0000000007A00000-0x0000000007AC4000-memory.dmp
memory/5212-49-0x0000000007AD0000-0x0000000007ADD000-memory.dmp
memory/5212-47-0x0000000007840000-0x0000000007867000-memory.dmp
memory/5212-46-0x0000000007B70000-0x0000000007CC9000-memory.dmp
memory/5212-45-0x0000000006900000-0x000000000690B000-memory.dmp
memory/5212-44-0x0000000007710000-0x0000000007730000-memory.dmp
memory/5212-43-0x00000000068E0000-0x00000000068EC000-memory.dmp
memory/5212-42-0x00000000068A0000-0x00000000068D8000-memory.dmp
memory/5212-40-0x0000000006530000-0x000000000653A000-memory.dmp
memory/5212-39-0x0000000006790000-0x00000000067C2000-memory.dmp
memory/5212-38-0x0000000006660000-0x0000000006780000-memory.dmp
memory/5212-35-0x0000000004E00000-0x0000000004EA8000-memory.dmp
memory/5212-37-0x0000000006910000-0x0000000006978000-memory.dmp
memory/5212-36-0x0000000004F60000-0x0000000004F7D000-memory.dmp
memory/5212-33-0x0000000004F90000-0x00000000057BA000-memory.dmp
memory/5212-31-0x0000000004B40000-0x0000000004BD9000-memory.dmp
memory/5212-30-0x0000000004B20000-0x0000000004B3A000-memory.dmp
memory/5212-29-0x0000000001E90000-0x0000000001EA3000-memory.dmp
memory/5212-28-0x0000000003500000-0x000000000352F000-memory.dmp
memory/5212-27-0x00000000032C0000-0x00000000032F9000-memory.dmp
memory/5212-25-0x0000000002F40000-0x00000000032BC000-memory.dmp
memory/5212-24-0x0000000002DF0000-0x0000000002F3B000-memory.dmp
memory/5212-23-0x0000000002D40000-0x0000000002DE3000-memory.dmp
memory/5212-22-0x0000000002C90000-0x0000000002D37000-memory.dmp
memory/5212-21-0x0000000002BE0000-0x0000000002C89000-memory.dmp
memory/5212-20-0x0000000002AB0000-0x0000000002BD1000-memory.dmp
memory/5212-19-0x00000000015C0000-0x00000000015E7000-memory.dmp
memory/5212-17-0x00000000028E0000-0x0000000002AAA000-memory.dmp
memory/5212-16-0x00000000028D0000-0x00000000028DB000-memory.dmp
memory/5212-13-0x0000000002640000-0x0000000002666000-memory.dmp
memory/5212-8-0x0000000002060000-0x0000000002136000-memory.dmp
memory/5212-7-0x0000000001EC0000-0x0000000002059000-memory.dmp