71e4d784950e01efb3a64dea5d6c07bc662fb7620258ef158ea88e9f2caa2d62

General

Target
2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe
Size 60.6MB
Sample261113-e6k4wazx4q
SHA256 71e4d784950e01efb3a64dea5d6c07bc662fb7620258ef158ea88e9f2caa2d62
MD5 414c886c3d6cec0d9d3ccea645362a99
SHA1 a0d79fec256ef13fe193ec28bc7ffe1bfd95f764
SHA512 ee1907fb05df0b78567aeb06151adae8e6ad391837226367e7fb28945a0c605ce36d349c37f7566ef90c82381a81bfb6e0b3b6afe1b6d3646be9129b5c6e785c
SSDEEP 393216:h8enxSqMKIW7y1a8YmO5RzJ/WIczzoGw+J4rV:h/nxSq77y1a/5RFW8h/
TLSH
T189D7E7113B9BA8ADD55AC87083464A631E2130DB1A36B9FF84D496353F7EAF46B3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
15	raw.githubusercontent.com

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe
1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe
1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe
1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe
1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe
1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe
1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe
1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe
1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe
1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe
1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe
1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 1908	3428	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe	90
PID 1908 wrote to memory of 3492	1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe	92
PID 1908 wrote to memory of 3316	1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe	93
PID 1908 wrote to memory of 4524	1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe	94
PID 1908 wrote to memory of 4972	1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe	95
PID 1908 wrote to memory of 4800	1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe	97
PID 1908 wrote to memory of 2452	1908	2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe	98

cURL User-Agent 3 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	5	curl/8.8.0
HTTP User-Agent header	10	curl/8.8.0
HTTP User-Agent header	15	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Users\Admin\AppData\Local\Temp\2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-12_414c886c3d6cec0d9d3ccea645362a99_cobalt-strike_glassworm_icedid_quasar-rat_satacom.exe" daemon run
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\system32\curl.exe
    "curl" -fsSL --max-time 10 --proto =https --proto-redir =https --max-filesize 8388608 https://github.com/devlanes-run/devlanes/releases/latest/download/release-manifest.json
    3⤵
    PID:3492
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" interface ipv4 show excludedportrange protocol=tcp
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3316
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" interface ipv6 show excludedportrange protocol=tcp
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4524
- - C:\Windows\system32\curl.exe
    "curl" -fsSL --max-time 10 --proto =https --proto-redir =https --max-filesize 8388608 https://raw.githubusercontent.com/devlanes-run/devlanes/v0.13.0/bins/devlanes/CHANGELOG.md
    3⤵
    PID:4972
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" interface ipv4 show excludedportrange protocol=tcp
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4800
- - C:\Windows\system32\netsh.exe
    "C:\Windows\system32\netsh.exe" interface ipv6 show excludedportrange protocol=tcp
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ca-key.pem

Path C:\Users\Admin\.devlanes\ca\ca-key.pem
Size 246B
SHA256 8b182b447837e8dca956d515f73ac4cd6f2f4bd14951c45c63a9044e08ae4a14
MD5 3ba20496dcf52b2c9509b2083e77d6e6
SHA1 b5a9d3e648d48887b9a6e930d08df6b7090c06f3
SHA512 8b94c64f7d40dbadb31a29f780f5ea70997c437914e1b5ac021379900e95552c065a9ba702d5bc6b592f703d2969cd2d675ab2629b7200dc9be83c54af63f7e6
TLSH
T1E3D097824E999C80C58AD1D009AB2BBA813DC733D3232AB20082001639248A428FE64A
MD5 SHA1 SHA512 TLSH

Submit Download

ca.pem

Path C:\Users\Admin\.devlanes\ca\ca.pem
Size 878B
SHA256 7b5d73db093da6b28bc246ef75d21d3abc2c41c063d7df36dd8aadbc593b6c83
MD5 71863cca5aa3a67d0e6c90fb84508246
SHA1 f84d9dbeaaa6054cf0bbdb87dcd1f4ab74c147d0
SHA512 9e894bb3c3464244e1c8442b9a89cbe54aff5e8a98a756fee1c1738d04fb9618685b68d11a0a1739c4f075a9abf8ad7cffe2f1373922f266ef9c61e69999343a
TLSH
T1901123A86F625D14B495E09DCCBE93110005D8958CABDD9D0B9DA4A9DE0C4A34D3C54E
MD5 SHA1 SHA512 TLSH

Submit Download

notices.json

Path C:\Users\Admin\.devlanes\notices.json
Size 51B
SHA256 f0e1e9770c1368da683799828ecbb19d1b6c1a415c00a93fcaf407a0d720b43d
MD5 a96bd11e642ba7f435e12855be8d49d8
SHA1 9ef7a586cb4dccdf3833d7d8ea9169bffb4cb3cd
SHA512 5d45e0f0289295e801cb4df9beaace7a3cea6019c646d43d363ffb945524363ddfb441e7217941cfd6c77c15ec42cd608cde7cdd2288def6ca5e3089eda60dc3
TLSH
T1DE900225166051230452672411015501C3FA4B19B508160500970214471C9AB560040E
MD5 SHA1 SHA512 TLSH

Submit Download

state.db

Path C:\Users\Admin\.devlanes\state.db
Size 236KB
SHA256 783b98f3c2a1fd556be72f38ecb3b465a315277621e258c5ee4e3c1029d7e598
MD5 895614fe1b512863afc05be8a20e15ef
SHA1 c3f42195131d524bd2bde736988b8c9ed74f1e7b
SHA512 5bc43ef299680d4a7007f6fd4d59b257d75a075981fc370e90af5731c8b798cb2f7aac69b3d6b3d98bb693b780d2eacb63e496e6d8886215e94276cb4db10afc
SSDEEP 6144:IuAu8uMuLN6cbIuKu46cbp6cbLuj6cbcu76cb/6cbkUuK6cbAdGuI:IuAu8uMuLauKuOu8uQUu5dGuI
TLSH
T18334EE4D8B356B84D2E18131DAF32D02A83D020F2F567AD8B9B4A3E6DF0C95DD079976
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads