Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/11/2026, 21:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-09_41eb4e46fddf958402f290e8ac57cec7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc.exe
Resource
win10v2004-20260911-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-09_41eb4e46fddf958402f290e8ac57cec7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc.exe
Resource
win11ltsc2024-20260911-en
1 signatures
150 seconds
General
- Target 2026-11-09_41eb4e46fddf958402f290e8ac57cec7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc.exe
- Size 653KB
- Sample261110-1evd5abd36
- SHA256 b79fecfcba55ddc07d7ac598b67925d496eb0dcf26b94d1b3c8f769e9231e5f4
- MD5 41eb4e46fddf958402f290e8ac57cec7
- SHA1 ab8e1da3e453de4ad4d61e99ebb2dfae715c22b8
- SHA512 42a0c886c0b7f2ac582308404154a1366808b61ed4dbf7227a534cf6e6f0848533bcf9b20b6fa44dc7082e6ac137160bf8b88483f5e554b29f8df90c8496fbf2
- SSDEEP 12288:PNy3zMRdAwMIMJ9B4hN4+011HhhLoW54YVlK2yWqH6d:Fy3zMMFfB4hNu1phhcsBqad
- TLSH T1A3E46C19BA9924FED2C6C434C2874953BA25388B1B75ACEF43C056762E7A6F44F3B710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: 35 1432 2026-11-09_41eb4e46fddf958402f290e8ac57cec7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_41eb4e46fddf958402f290e8ac57cec7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_41eb4e46fddf958402f290e8ac57cec7_cobalt-strike_glassworm_icedid_njrat_ryuk_satacom_stealc.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1432
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\luacompile-manifest-541602579990\Модуль.lua
- Size 8B
- SHA256 8373f7e086bb27784827ef8f2f4ae118e05d58b67f513f82c2316dc57b0d896c
- MD5 61e5513229ba3d53a09d057769ac99cc
- SHA1 7f923f79fe76194c868d7e1d0820de36700eb649
- SHA512 7491eebe31b7c3be5188dfadb4471c7a9693a0ab56c5954689eb80cf2b6d91fc1ebf810a37da85eee4ad67b94fa280fc2fa60769799697453f6e3d61ba779465
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\luacompile-manifest-541639144190\𐐀.lua
- Size 8B
- SHA256 486d9affb60dbb0063b03d8e23a6ccf6364ce203dc3a9f56f20e750eb41ecade
- MD5 3bc8e173a68e60bfbbf5c803364978c9
- SHA1 e0e1f9fabfc9d4800c877a703b823ac0578ff8db
- SHA512 70efd43e86c3c66119ce4cf1ef7fa231c709e8ae6ad5a33c98a073dcf74fe0259f00f94b61b20a89c50cbc06ca48c59edaabf71cc4138d3687e35e998093a330
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\luacompile-manifest-541648199740\Новое расширение\extension.json
- Size 50B
- SHA256 59572c4f46e69cbd53ace27c8566c8b380ac535361461662095c9a80c76a6439
- MD5 80a843d595375737e60aadd9f1054bca
- SHA1 b55029896cb58c8e5f05f4730a220095a346dce0
- SHA512 48635a6d611e00478177c7e0bc83b55ddc0e83bb8bc91b2db67677cd7982fd1eb21b466647a22ebc814317be869b484373ce983a8efe92566461a60a28df58c8
- TLSH T1FE90045071411C1437441DC13C533D41C051CC5C034D7C014171104F07F5D0D575055F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\luacompile-manifest-541652902950\nested\util.lua
- Size 9B
- SHA256 e115c9b995f74018636bff111f65edb17dc88607987af947e055b0736097ff6e
- MD5 5b8adbcfee9905b4472ca8b4f4273e9d
- SHA1 1fa00e76656cc152ad327c13fe365858fd7be306
- SHA512 1e31be7f81678b8a03b993eaac3a7a250c6d0ed162007a381383098a19f9d74e07e92a68e7889b88062cac57698fea95d765ccb01890fe22d90d401e7320c3ab
- MD5 SHA1 SHA512