Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/07/2026, 12:20
General
- Target 2026-07-17_f4ad2eaed34bba09af39cfcec995fd21_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
- Size 819KB
- Sample260717-phv92sev41
- SHA256 fa15ab03e56c3cfd439886941aca81b83520f11596364ccce591b52e947354f3
Malware Config
Signatures
- Executes dropped EXE 21 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 26 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_f4ad2eaed34bba09af39cfcec995fd21_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_f4ad2eaed34bba09af39cfcec995fd21_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
memory/1124-270-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/1124-349-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/1124-276-0x0000000000940000-0x00000000009A9000-memory.dmp
memory/1124-271-0x0000000000940000-0x00000000009A9000-memory.dmp
memory/1392-312-0x00000291EE630000-0x00000291EE696000-memory.dmp
memory/1392-311-0x00000291EE630000-0x00000291EE696000-memory.dmp
memory/1392-379-0x00007FF73F610000-0x00007FF73F6C4000-memory.dmp
memory/1392-310-0x00007FF73F610000-0x00007FF73F6C4000-memory.dmp
memory/1448-55-0x0000021812950000-0x0000021812AC6000-memory.dmp
memory/1448-56-0x0000021812BF0000-0x0000021812C56000-memory.dmp
memory/1448-57-0x0000021812BF0000-0x0000021812C56000-memory.dmp
memory/1584-386-0x00007FF6AD150000-0x00007FF6AD3F3000-memory.dmp
memory/1584-321-0x00000170BC440000-0x00000170BC4A6000-memory.dmp
memory/1584-319-0x00007FF6AD150000-0x00007FF6AD3F3000-memory.dmp
memory/1584-322-0x00000170BC440000-0x00000170BC4A6000-memory.dmp
memory/1968-351-0x0000019F7D7F0000-0x0000019F7D856000-memory.dmp
memory/1968-350-0x00007FF7747A0000-0x00007FF774A2B000-memory.dmp
memory/1968-352-0x0000019F7D7F0000-0x0000019F7D856000-memory.dmp
memory/2484-377-0x00007FF75C450000-0x00007FF75C867000-memory.dmp
memory/2484-301-0x000001ED4EF50000-0x000001ED4EFB6000-memory.dmp
memory/2484-299-0x000001ED4EF50000-0x000001ED4EFB6000-memory.dmp
memory/2484-300-0x00007FF75C450000-0x00007FF75C867000-memory.dmp
memory/2640-52-0x00007FF7204A0000-0x00007FF720608000-memory.dmp
memory/2640-44-0x00000222D5910000-0x00000222D5976000-memory.dmp
memory/2640-43-0x00007FF7204A0000-0x00007FF720608000-memory.dmp
memory/2640-45-0x00000222D5910000-0x00000222D5976000-memory.dmp
memory/2640-50-0x00000222D5910000-0x00000222D5976000-memory.dmp
memory/2664-360-0x000001FC261D0000-0x000001FC26236000-memory.dmp
memory/2664-358-0x000001FC261D0000-0x000001FC26236000-memory.dmp
memory/2664-359-0x00007FF73DD00000-0x00007FF73E1D1000-memory.dmp
memory/2764-291-0x000001B0BBEB0000-0x000001B0BBF16000-memory.dmp
memory/2764-367-0x00007FF68E8E0000-0x00007FF68E98E000-memory.dmp
memory/2764-292-0x000001B0BBEB0000-0x000001B0BBF16000-memory.dmp
memory/2764-290-0x00007FF68E8E0000-0x00007FF68E98E000-memory.dmp
memory/2880-22-0x00007FF7DE860000-0x00007FF7DE9B6000-memory.dmp
memory/2880-1-0x000002387F020000-0x000002387F086000-memory.dmp
memory/2880-0-0x00007FF7DE860000-0x00007FF7DE9B6000-memory.dmp
memory/2880-3-0x000002387F020000-0x000002387F086000-memory.dmp
memory/2880-19-0x000002387F020000-0x000002387F086000-memory.dmp
memory/2880-2-0x000002387F020000-0x000002387F086000-memory.dmp
memory/3148-242-0x0000027291F30000-0x0000027291F96000-memory.dmp
memory/3148-243-0x0000027291F30000-0x0000027291F96000-memory.dmp
memory/3148-318-0x00007FF771470000-0x00007FF771539000-memory.dmp
memory/3148-241-0x00007FF771470000-0x00007FF771539000-memory.dmp
memory/3360-338-0x00007FF79D6B0000-0x00007FF79D9D1000-memory.dmp
memory/3360-339-0x00000277DB590000-0x00000277DB5F6000-memory.dmp
memory/3360-346-0x00007FF79D6B0000-0x00007FF79D9D1000-memory.dmp
memory/3360-344-0x00000277DB590000-0x00000277DB5F6000-memory.dmp
memory/3360-340-0x00000277DB590000-0x00000277DB5F6000-memory.dmp
memory/3376-27-0x0000017482860000-0x00000174828C6000-memory.dmp
memory/3376-25-0x00000174826E0000-0x0000017482856000-memory.dmp
memory/3376-26-0x0000017482860000-0x00000174828C6000-memory.dmp
memory/3376-28-0x0000017482860000-0x00000174828C6000-memory.dmp
memory/3552-370-0x0000025BA2980000-0x0000025BA29E6000-memory.dmp
memory/3552-368-0x00007FF752430000-0x00007FF752936000-memory.dmp
memory/3552-369-0x0000025BA2980000-0x0000025BA29E6000-memory.dmp
memory/4836-13-0x0000022113280000-0x00000221132E6000-memory.dmp
memory/4836-61-0x00007FF6D7C90000-0x00007FF6D7DB3000-memory.dmp
memory/4836-14-0x0000022113280000-0x00000221132E6000-memory.dmp
memory/4836-11-0x00007FF6D7C90000-0x00007FF6D7DB3000-memory.dmp
memory/4836-12-0x0000022113280000-0x00000221132E6000-memory.dmp
memory/5224-37-0x000001CF1CAE0000-0x000001CF1CB46000-memory.dmp
memory/5224-34-0x000001CF1C840000-0x000001CF1C9B6000-memory.dmp
memory/5224-36-0x000001CF1CAE0000-0x000001CF1CB46000-memory.dmp
memory/5224-35-0x000001CF1CAE0000-0x000001CF1CB46000-memory.dmp
memory/5340-264-0x00000285B0520000-0x00000285B0586000-memory.dmp
memory/5340-337-0x00007FF7892E0000-0x00007FF78942A000-memory.dmp
memory/5340-261-0x00007FF7892E0000-0x00007FF78942A000-memory.dmp
memory/5340-263-0x00000285B0520000-0x00000285B0586000-memory.dmp
memory/5616-233-0x000002076C310000-0x000002076C376000-memory.dmp
memory/5616-309-0x00007FF771470000-0x00007FF771539000-memory.dmp
memory/5616-234-0x000002076C310000-0x000002076C376000-memory.dmp
memory/5616-232-0x00007FF771470000-0x00007FF771539000-memory.dmp
memory/5736-381-0x000002296B200000-0x000002296B266000-memory.dmp
memory/5736-378-0x00007FF7B76E0000-0x00007FF7B780E000-memory.dmp
memory/5736-380-0x000002296B200000-0x000002296B266000-memory.dmp
memory/6008-250-0x0000028278140000-0x00000282781A6000-memory.dmp
memory/6008-249-0x00007FF762470000-0x00007FF76258A000-memory.dmp
memory/6008-328-0x00007FF762470000-0x00007FF76258A000-memory.dmp
memory/6008-251-0x0000028278140000-0x00000282781A6000-memory.dmp
memory/6080-364-0x00007FF6F0240000-0x00007FF6F0984000-memory.dmp
memory/6080-282-0x00007FF6F0240000-0x00007FF6F0984000-memory.dmp
memory/6080-283-0x000001892DEE0000-0x000001892DF46000-memory.dmp
memory/6080-284-0x000001892DEE0000-0x000001892DF46000-memory.dmp
memory/6120-330-0x000001DFAF3A0000-0x000001DFAF406000-memory.dmp
memory/6120-329-0x00007FF7DD6C0000-0x00007FF7DD855000-memory.dmp
memory/6120-331-0x000001DFAF3A0000-0x000001DFAF406000-memory.dmp