ae9161b9236ed7320f2a81c2ba8da38c0f46bdfb09f6d81db713c509126914f9

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-07_7fdee16000425c384df1a455a21dce8e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Size 4.4MB
Sample261107-pv2btsbz7x
SHA256 ae9161b9236ed7320f2a81c2ba8da38c0f46bdfb09f6d81db713c509126914f9
MD5 7fdee16000425c384df1a455a21dce8e
SHA1 0fc6fcad4d98c6157d69d600e441afd44343ac7a
SHA512 5a88b523d0832bbaa31edc415c869bb38168718127a959872fb9a5e5f107b4e8011e0b2d1058e9b7724476eadfaaaf7ae3d20b6332719e1e3d9009e0d80b620e
SSDEEP 49152:FzVmaSGk1xRFF9RmcfzjtUPyz3Dzjo/u6lJx4v23pk3eZ+zlgyMTpTbT1QQwzbla:FJtkNFLDz3Dzjwc23pkjzMTLuxN620
TLSH
T11326DF49F265C2BDE9AB8074C61A6AF3EA313C54876151DB4390FA5C3A32BD09F3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-07_7fdee16000425c384df1a455a21dce8e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-07_7fdee16000425c384df1a455a21dce8e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3336	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3336	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\2026-11-07_7fdee16000425c384df1a455a21dce8e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-07_7fdee16000425c384df1a455a21dce8e_cobalt-strike_glassworm_icedid_njrat_satacom_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:5112

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

colors.ini

Path C:\Users\Admin\Documents\Escapeless\colors.ini
Size 101B
SHA256 654e0204af73bc99c91cefc6eca196b415a4861012c3c86ebc6e5af733d5e1c9
MD5 62e4e56d9107dc7b6230ae8b2558b897
SHA1 d7aaa40ac358badcebbb1926aeb6da18a2673533
SHA512 090f75025d4843eb3fe321f30567cc2a0dae39ab8f3047c70a547aa9522e1ff9479238bc5056e2cd91fbbd68ed2cef01f86f3510784a621c69c35f1d42a869de
TLSH
T1B9B0110A222283C8AABF033C0800EC8A80A332A3B2030BAC0CF2C003C000CEE0888C88
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5112-18-0x0000016C88080000-0x0000016C8848A000-memory.dmp

Download