Analysis
- max time kernel
85s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 01:57
General
- Target 2026-07-05_0b03856fbc28aec6dec385ed157ee35a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
- Size 1.6MB
- Sample260705-cdbnmacs6n
- SHA256 34729df78f82298d4bac523cbb1f04a3d06f1d0f215cfddb331a05b5cf122480
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 4 IoCs
- Drops file in Program Files directory 64 IoCs
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 40 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 47 IoCs
- Suspicious use of FindShellTrayWindow 53 IoCs
- Suspicious use of SendNotifyMessage 40 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_0b03856fbc28aec6dec385ed157ee35a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_0b03856fbc28aec6dec385ed157ee35a_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
AppVShNotify.exe
IntegratedOffice.exe
MavInject32.exe
OfficeC2RClient.exe
appvcleaner.exe
LICLUA.EXE
OSE.EXE
VSTOInstaller.exe
chrmstp.exe
setup.exe
chrome_pwa_launcher.exe
elevated_tracing_service.exe
elevation_service.exe
notification_helper.exe
os_update_handler.exe
chrome_proxy.exe
appletviewer.exe
extcheck.exe
idlj.exe
jabswitch.exe
jar.exe
jarsigner.exe
java-rmi.exe
java.exe
javac.exe
javadoc.exe
javafxpackager.exe
javah.exe
javap.exe
javapackager.exe
javaw.exe
javaws.exe
jcmd.exe
jconsole.exe
jdb.exe
jdeps.exe
dotnet.exe
prep_Activatable Class_Hermes_perf.cache
prep_Activatable Class_Hermes_perf.cache
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SearchIndexer.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/548-476-0x0000000000990000-0x00000000009F9000-memory.dmp
memory/548-481-0x0000000000990000-0x00000000009F9000-memory.dmp
memory/548-475-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/548-555-0x0000000000400000-0x00000000004AD000-memory.dmp
memory/856-564-0x000001BF3E860000-0x000001BF3E8C6000-memory.dmp
memory/856-569-0x00007FF754B40000-0x00007FF755010000-memory.dmp
memory/856-565-0x000001BF3E860000-0x000001BF3E8C6000-memory.dmp
memory/936-505-0x000002AEFB940000-0x000002AEFB9A6000-memory.dmp
memory/936-506-0x000002AEFB940000-0x000002AEFB9A6000-memory.dmp
memory/936-583-0x00007FF759470000-0x00007FF759886000-memory.dmp
memory/936-504-0x00007FF759470000-0x00007FF759886000-memory.dmp
memory/1204-11-0x0000024852AE0000-0x0000024852B46000-memory.dmp
memory/1204-60-0x00007FF6BC8E0000-0x00007FF6BCA02000-memory.dmp
memory/1204-13-0x0000024852AE0000-0x0000024852B46000-memory.dmp
memory/1204-12-0x0000024852AE0000-0x0000024852B46000-memory.dmp
memory/1204-10-0x00007FF6BC8E0000-0x00007FF6BCA02000-memory.dmp
memory/1404-558-0x000001CF1FDF0000-0x000001CF1FE56000-memory.dmp
memory/1404-556-0x00007FF67D1E0000-0x00007FF67D46A000-memory.dmp
memory/1404-557-0x000001CF1FDF0000-0x000001CF1FE56000-memory.dmp
memory/1716-54-0x00000131174F0000-0x00000131175D9000-memory.dmp
memory/1716-55-0x0000013117700000-0x0000013117766000-memory.dmp
memory/1716-56-0x0000013117700000-0x0000013117766000-memory.dmp
memory/1720-454-0x00007FF6E2280000-0x00007FF6E2399000-memory.dmp
memory/1720-533-0x00007FF6E2280000-0x00007FF6E2399000-memory.dmp
memory/1720-456-0x000002311B810000-0x000002311B876000-memory.dmp
memory/1720-455-0x000002311B810000-0x000002311B876000-memory.dmp
memory/2044-516-0x000001C3C6AC0000-0x000001C3C6B26000-memory.dmp
memory/2044-515-0x000001C3C6AC0000-0x000001C3C6B26000-memory.dmp
memory/2044-592-0x00007FF750440000-0x00007FF7504F3000-memory.dmp
memory/2044-514-0x00007FF750440000-0x00007FF7504F3000-memory.dmp
memory/2472-24-0x0000028572D50000-0x0000028572E39000-memory.dmp
memory/2472-27-0x0000028572F30000-0x0000028572F96000-memory.dmp
memory/2472-26-0x0000028572F30000-0x0000028572F96000-memory.dmp
memory/2472-25-0x0000028572F30000-0x0000028572F96000-memory.dmp
memory/2692-467-0x00007FF688A70000-0x00007FF688BB9000-memory.dmp
memory/2692-469-0x0000022435690000-0x00000224356F6000-memory.dmp
memory/2692-468-0x0000022435690000-0x00000224356F6000-memory.dmp
memory/2692-542-0x00007FF688A70000-0x00007FF688BB9000-memory.dmp
memory/3168-269-0x000000000EB30000-0x000000000EC9C000-memory.dmp
memory/3240-596-0x000001B08B7D0000-0x000001B08B836000-memory.dmp
memory/3240-597-0x000001B08B7D0000-0x000001B08B836000-memory.dmp
memory/3240-595-0x00007FF7EE4F0000-0x00007FF7EE82E000-memory.dmp
memory/3272-536-0x0000021B888E0000-0x0000021B88946000-memory.dmp
memory/3272-534-0x00007FF6555E0000-0x00007FF655774000-memory.dmp
memory/3272-535-0x0000021B888E0000-0x0000021B88946000-memory.dmp
memory/3532-497-0x000001E6C10B0000-0x000001E6C1116000-memory.dmp
memory/3532-496-0x000001E6C10B0000-0x000001E6C1116000-memory.dmp
memory/3532-575-0x00007FF62F700000-0x00007FF62F7AD000-memory.dmp
memory/3532-495-0x00007FF62F700000-0x00007FF62F7AD000-memory.dmp
memory/4208-584-0x00000212A7960000-0x00000212A79C6000-memory.dmp
memory/4208-585-0x00007FF644B20000-0x00007FF644C4E000-memory.dmp
memory/4208-586-0x00000212A7960000-0x00000212A79C6000-memory.dmp
memory/4308-513-0x00007FF668940000-0x00007FF668A08000-memory.dmp
memory/4308-439-0x0000024602C50000-0x0000024602CB6000-memory.dmp
memory/4308-438-0x0000024602C50000-0x0000024602CB6000-memory.dmp
memory/4308-437-0x00007FF668940000-0x00007FF668A08000-memory.dmp
memory/4464-551-0x00007FF6CF3D0000-0x00007FF6CF6F0000-memory.dmp
memory/4464-543-0x00007FF6CF3D0000-0x00007FF6CF6F0000-memory.dmp
memory/4464-545-0x000001BB8E270000-0x000001BB8E2D6000-memory.dmp
memory/4464-544-0x000001BB8E270000-0x000001BB8E2D6000-memory.dmp
memory/4464-549-0x000001BB8E270000-0x000001BB8E2D6000-memory.dmp
memory/4768-133-0x000002C0942F0000-0x000002C094310000-memory.dmp
memory/4768-100-0x000002C081CF0000-0x000002C081D10000-memory.dmp
memory/4768-71-0x000002C0801E0000-0x000002C0802E0000-memory.dmp
memory/4768-112-0x000002C081D10000-0x000002C081D30000-memory.dmp
memory/4768-102-0x000002C081EF0000-0x000002C081FF0000-memory.dmp
memory/4904-2-0x00007FF7B84A0000-0x00007FF7B8883000-memory.dmp
memory/4904-1-0x00000200E4CB0000-0x00000200E4D16000-memory.dmp
memory/4904-19-0x00000200E4CB0000-0x00000200E4D16000-memory.dmp
memory/4904-0-0x00000200E4CB0000-0x00000200E4D16000-memory.dmp
memory/4904-21-0x00007FF7B84A0000-0x00007FF7B8883000-memory.dmp
memory/5212-487-0x0000021C05E50000-0x0000021C05EB6000-memory.dmp
memory/5212-572-0x00007FF670480000-0x00007FF670BC3000-memory.dmp
memory/5212-489-0x00007FF670480000-0x00007FF670BC3000-memory.dmp
memory/5212-488-0x0000021C05E50000-0x0000021C05EB6000-memory.dmp
memory/5332-35-0x00000160BC1C0000-0x00000160BC226000-memory.dmp
memory/5332-34-0x00000160BC1C0000-0x00000160BC226000-memory.dmp
memory/5332-33-0x00000160BC000000-0x00000160BC0E9000-memory.dmp
memory/5332-36-0x00000160BC1C0000-0x00000160BC226000-memory.dmp
memory/5376-576-0x000001299F650000-0x000001299F6B6000-memory.dmp
memory/5376-573-0x00007FF66DB30000-0x00007FF66E036000-memory.dmp
memory/5376-574-0x000001299F650000-0x000001299F6B6000-memory.dmp
memory/5852-51-0x00007FF79ADF0000-0x00007FF79AF57000-memory.dmp
memory/5852-49-0x00000228FC260000-0x00000228FC2C6000-memory.dmp
memory/5852-43-0x00000228FC260000-0x00000228FC2C6000-memory.dmp
memory/5852-44-0x00000228FC260000-0x00000228FC2C6000-memory.dmp
memory/5852-42-0x00007FF79ADF0000-0x00007FF79AF57000-memory.dmp
memory/5924-594-0x00007FF747940000-0x00007FF747BE2000-memory.dmp
memory/5924-526-0x000001EEFD490000-0x000001EEFD4F6000-memory.dmp
memory/5924-527-0x000001EEFD490000-0x000001EEFD4F6000-memory.dmp
memory/5924-525-0x00007FF747940000-0x00007FF747BE2000-memory.dmp
memory/6016-447-0x000002C31A350000-0x000002C31A3B6000-memory.dmp
memory/6016-524-0x00007FF668940000-0x00007FF668A08000-memory.dmp
memory/6016-448-0x000002C31A350000-0x000002C31A3B6000-memory.dmp
memory/6016-446-0x00007FF668940000-0x00007FF668A08000-memory.dmp