Analysis
- max time kernel
144s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/08/2026, 02:23
General
- Target 2026-08-03_9ec644e6bfa868abb740df995ada4836_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe
- Size 1.0MB
- Sample260803-cvasnaap91
- SHA256 12b4a21b6ca3d9f1de0304171cb89fc23f82f87158ab7f924c6f3d3802544f8f
Malware Config
Signatures
- Executes dropped EXE 16 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 20 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 15 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_9ec644e6bfa868abb740df995ada4836_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_9ec644e6bfa868abb740df995ada4836_cobalt-strike_icedid_njrat_satacom_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
wbengine.exe
memory/548-345-0x00007FF6C07B0000-0x00007FF6C0AD0000-memory.dmp
memory/548-337-0x00007FF6C07B0000-0x00007FF6C0AD0000-memory.dmp
memory/548-338-0x0000024FADC70000-0x0000024FADCD6000-memory.dmp
memory/548-339-0x0000024FADC70000-0x0000024FADCD6000-memory.dmp
memory/548-343-0x0000024FADC70000-0x0000024FADCD6000-memory.dmp
memory/1116-359-0x00007FF6D5DD0000-0x00007FF6D6513000-memory.dmp
memory/1116-283-0x000002C885360000-0x000002C8853C6000-memory.dmp
memory/1116-281-0x000002C885360000-0x000002C8853C6000-memory.dmp
memory/1116-282-0x00007FF6D5DD0000-0x00007FF6D6513000-memory.dmp
memory/1264-364-0x00007FF714880000-0x00007FF71492D000-memory.dmp
memory/1264-291-0x000001DAEA4F0000-0x000001DAEA556000-memory.dmp
memory/1264-290-0x000001DAEA4F0000-0x000001DAEA556000-memory.dmp
memory/1264-289-0x00007FF714880000-0x00007FF71492D000-memory.dmp
memory/1468-259-0x000001A2E20E0000-0x000001A2E2146000-memory.dmp
memory/1468-257-0x00007FF789A70000-0x00007FF789BB9000-memory.dmp
memory/1468-260-0x000001A2E20E0000-0x000001A2E2146000-memory.dmp
memory/1468-336-0x00007FF789A70000-0x00007FF789BB9000-memory.dmp
memory/1840-240-0x00007FF6B5070000-0x00007FF6B5138000-memory.dmp
memory/1840-317-0x00007FF6B5070000-0x00007FF6B5138000-memory.dmp
memory/1840-244-0x00000269663B0000-0x0000026966416000-memory.dmp
memory/1840-245-0x00000269663B0000-0x0000026966416000-memory.dmp
memory/2060-19-0x0000023207180000-0x00000232071E6000-memory.dmp
memory/2060-22-0x00007FF748BA0000-0x00007FF748DD4000-memory.dmp
memory/2060-2-0x0000023207180000-0x00000232071E6000-memory.dmp
memory/2060-3-0x0000023207180000-0x00000232071E6000-memory.dmp
memory/2060-1-0x0000023207180000-0x00000232071E6000-memory.dmp
memory/2060-0-0x00007FF748BA0000-0x00007FF748DD4000-memory.dmp
memory/3220-54-0x0000025F96F90000-0x0000025F970A8000-memory.dmp
memory/3220-56-0x0000025F96F10000-0x0000025F96F76000-memory.dmp
memory/3220-55-0x0000025F96F10000-0x0000025F96F76000-memory.dmp
memory/3328-309-0x00007FF6F6720000-0x00007FF6F67D3000-memory.dmp
memory/3328-310-0x000002AC499F0000-0x000002AC49A56000-memory.dmp
memory/3328-311-0x000002AC499F0000-0x000002AC49A56000-memory.dmp
memory/3364-49-0x000001C5D7700000-0x000001C5D7766000-memory.dmp
memory/3364-43-0x000001C5D7700000-0x000001C5D7766000-memory.dmp
memory/3364-44-0x000001C5D7700000-0x000001C5D7766000-memory.dmp
memory/3364-51-0x00007FF78ACD0000-0x00007FF78AE38000-memory.dmp
memory/3364-42-0x00007FF78ACD0000-0x00007FF78AE38000-memory.dmp
memory/3576-231-0x00007FF6B5070000-0x00007FF6B5138000-memory.dmp
memory/3576-308-0x00007FF6B5070000-0x00007FF6B5138000-memory.dmp
memory/3576-232-0x000001820C060000-0x000001820C0C6000-memory.dmp
memory/3576-233-0x000001820C060000-0x000001820C0C6000-memory.dmp
memory/4100-35-0x00000197285E0000-0x0000019728646000-memory.dmp
memory/4100-36-0x00000197285E0000-0x0000019728646000-memory.dmp
memory/4100-34-0x00000197283A0000-0x00000197284B8000-memory.dmp
memory/4216-13-0x000002B706D60000-0x000002B706DC6000-memory.dmp
memory/4216-14-0x000002B706D60000-0x000002B706DC6000-memory.dmp
memory/4216-60-0x00007FF66AF40000-0x00007FF66B062000-memory.dmp
memory/4216-12-0x000002B706D60000-0x000002B706DC6000-memory.dmp
memory/4216-11-0x00007FF66AF40000-0x00007FF66B062000-memory.dmp
memory/4276-351-0x00000218EDB30000-0x00000218EDB96000-memory.dmp
memory/4276-349-0x00007FF66BDD0000-0x00007FF66C05A000-memory.dmp
memory/4276-350-0x00000218EDB30000-0x00000218EDB96000-memory.dmp
memory/4344-28-0x000001A647930000-0x000001A647996000-memory.dmp
memory/4344-25-0x000001A6479E0000-0x000001A647AF8000-memory.dmp
memory/4344-27-0x000001A647930000-0x000001A647996000-memory.dmp
memory/4344-26-0x000001A647930000-0x000001A647996000-memory.dmp
memory/4484-333-0x00007FF778440000-0x00007FF7785D4000-memory.dmp
memory/4484-326-0x0000029467E00000-0x0000029467E66000-memory.dmp
memory/4484-327-0x0000029467E00000-0x0000029467E66000-memory.dmp
memory/4552-363-0x00007FF71A760000-0x00007FF71AC30000-memory.dmp
memory/4552-357-0x000001982D060000-0x000001982D0C6000-memory.dmp
memory/4552-358-0x000001982D060000-0x000001982D0C6000-memory.dmp
memory/4572-369-0x000001534A620000-0x000001534A686000-memory.dmp
memory/4572-368-0x000001534A620000-0x000001534A686000-memory.dmp
memory/4572-367-0x00007FF6C75D0000-0x00007FF6C7AD6000-memory.dmp
memory/5052-249-0x0000021692860000-0x00000216928C6000-memory.dmp
memory/5052-250-0x0000021692860000-0x00000216928C6000-memory.dmp
memory/5052-332-0x00007FF7DDBD0000-0x00007FF7DDCE9000-memory.dmp
memory/5052-243-0x00007FF7DDBD0000-0x00007FF7DDCE9000-memory.dmp
memory/5500-298-0x0000018A33A00000-0x0000018A33A66000-memory.dmp
memory/5500-299-0x0000018A33A00000-0x0000018A33A66000-memory.dmp
memory/5500-300-0x00007FF656810000-0x00007FF656C26000-memory.dmp
memory/5500-373-0x00007FF656810000-0x00007FF656C26000-memory.dmp
memory/5860-320-0x0000021249ED0000-0x0000021249F36000-memory.dmp
memory/5860-319-0x0000021249ED0000-0x0000021249F36000-memory.dmp
memory/5860-331-0x00007FF7B25E0000-0x00007FF7B2883000-memory.dmp
memory/6004-348-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/6004-266-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/6004-267-0x00000000009C0000-0x0000000000A29000-memory.dmp
memory/6004-272-0x00000000009C0000-0x0000000000A29000-memory.dmp