Overview

overview

7

Static

static

1

2026-08-06...ar.exe

windows10-2004-x64

7

2026-08-06...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/08/2026, 05:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-06_c4e8d36f10171628c2bd88991346adeb_akira_cobalt-strike_icedid_satacom_vidar.exe
  • Size 26.8MB
  • Sample260806-ftshvstekd
  • SHA256 4b46617047b23d9c36fdb99e629bbd2bff6a33cee1188ebe56ff28f186affc8f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecution

Malware Config

Signatures

  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Drops file in Windows directory 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 56 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-06_c4e8d36f10171628c2bd88991346adeb_akira_cobalt-strike_icedid_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-06_c4e8d36f10171628c2bd88991346adeb_akira_cobalt-strike_icedid_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4376
    • C:\Windows\system32\taskkill.exe
      "taskkill" /F /IM RuntimeBroker_rustdesk.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4900
    • C:\Users\Admin\AppData\Local\sygecom-remoto-client\sygecom-remoto-client.exe
      "C:\Users\Admin\AppData\Local\sygecom-remoto-client\.\sygecom-remoto-client.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:568
      • C:\Windows\system32\icacls.exe
        "icacls" C:\ProgramData\Sygecom-Remoto-Client /grant *S-1-1-0:(OI)(CI)F /T
        3⤵
        • Modifies file permissions
        PID:3596
      • C:\Windows\system32\icacls.exe
        "icacls" C:\ProgramData\Sygecom-Remoto-Client\shared_memory_portable_service /grant *S-1-1-0:(OI)(CI)F /T
        3⤵
        • Modifies file permissions
        PID:4888
      • C:\Users\Admin\AppData\Local\sygecom-remoto-client\sygecom-remoto-client.exe
        "C:\Users\Admin\AppData\Local\sygecom-remoto-client\sygecom-remoto-client.exe" --portable-service
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4780
        • C:\Users\Admin\AppData\Local\sygecom-remoto-client\sygecom-remoto-client.exe
          "C:\Users\Admin\AppData\Local\sygecom-remoto-client\sygecom-remoto-client.exe" --run-as-system
          4⤵
          • Drops file in Windows directory
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2200
      • C:\Windows\system32\cmd.exe
        "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\Windows\system32\taskkill.exe
          taskkill /F /IM RuntimeBroker_rustdesk.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3288
      • C:\Users\Admin\AppData\Local\sygecom-remoto-client\sygecom-remoto-client.exe
        "C:\Users\Admin\AppData\Local\sygecom-remoto-client\.\sygecom-remoto-client.exe" --check-hwcodec-config
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:3088

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        shared_memory_portable_service
        • Path C:\ProgramData\Sygecom-Remoto-Client\shared_memory_portable_service
        • Size 23B
        • SHA256 b093f1b55c99a847516cf034c61a5a9b6142e91469bdc2e73594e8d013e977d0
        • MD5 SHA1 SHA512
        Submit Download

        custom.txt
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\custom.txt
        • Size 708B
        • SHA256 173e30f6e59e00d1233d1f2d78cd613ca829a53e30427b8dbceefa87a6f1b588
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        app.so
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\data\app.so
        • Size 12.6MB
        • SHA256 2c92c70f292cb03a2cc8e47ca006d327c92a27cfac1a930945478a5d4f6b1534
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\data\icudtl.dat
        • Size 760KB
        • SHA256 c12537022ef818991a7bfed41a76d8d6ae962ffbc0e6511ac762a5d0845e7f7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        desktop_drop_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\desktop_drop_plugin.dll
        • Size 333KB
        • SHA256 76fe29d25d15349ae0f2e207c6ba30bcb939083d7fe3239018f25609c1e234cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        desktop_multi_window_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\desktop_multi_window_plugin.dll
        • Size 398KB
        • SHA256 f8f97ad3c468e78be700bc43f5e27323fceb06aeb9e078b4ab1b82fe3d90ba5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        file_selector_windows_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\file_selector_windows_plugin.dll
        • Size 361KB
        • SHA256 6a79770fe1b66188ded93e52c74b047df9bb05ed906f7e57d786b4b5648c2856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        flutter_custom_cursor_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\flutter_custom_cursor_plugin.dll
        • Size 324KB
        • SHA256 47da7021e1333d313c14a17983a07a2857299e217de426fdc88147f070c0f79e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        flutter_gpu_texture_renderer_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\flutter_gpu_texture_renderer_plugin.dll
        • Size 356KB
        • SHA256 58c4d09330ba2c80c4a748b98c6b3c2bea12f49ba43b25493314fab7dd892161
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        flutter_windows.dll
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\flutter_windows.dll
        • Size 17.2MB
        • SHA256 4cf04758434d201d5db63b4e66441a13f6c59a9f44ce7dadfda7bf3e6359abde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        librustdesk.dll
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\librustdesk.dll
        • Size 33.7MB
        • SHA256 01de5d90267f90cb73737f34c82d7cdd9cbb534b89b6bcd0261017292bf16168
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        printer_driver_adapter.dll
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\printer_driver_adapter.dll
        • Size 1.3MB
        • SHA256 b6a61ab814fd43c01bfd8c69007671e45712bc01913dc20eebc3b4e07c620c90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        screen_retriever_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\screen_retriever_plugin.dll
        • Size 528KB
        • SHA256 42b99b1c7280b1cbfa7067a632e5d006d00c0b73a509287318c9642182d67fc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sygecom-remoto-client.exe
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\sygecom-remoto-client.exe
        • Size 412KB
        • SHA256 139c83202196d38b5f757067f75822a1ad55764ed1896ba823d6833174f1b4c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        texture_rgba_renderer_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\texture_rgba_renderer_plugin.dll
        • Size 333KB
        • SHA256 4cfe7e6f2d1b908cbdb822b0c18106bc327556b46055efeb780a7f24b6d1256a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uni_links_desktop_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\uni_links_desktop_plugin.dll
        • Size 531KB
        • SHA256 60c67f4237108c7b4e9b0f42a09a9911eb7382449469eb3db0ea0c5370f9d331
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        url_launcher_windows_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\url_launcher_windows_plugin.dll
        • Size 337KB
        • SHA256 54c6b076fc8fd37e6a95984c4ccbbdfa4fc789c86ab03d97a32aa843640ac785
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        window_manager_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\window_manager_plugin.dll
        • Size 557KB
        • SHA256 834524de85d58f22d3a4439c98ebcbeb85d5dfe7855662a3584bba98479cc1bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        window_size_plugin.dll
        • Path C:\Users\Admin\AppData\Local\sygecom-remoto-client\window_size_plugin.dll
        • Size 525KB
        • SHA256 a32b16f1437c6b2c8ae1c7fa739bd3224d1ed4bdff3f0bd8a8ec03d27051b74b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/568-166-0x00000171A9810000-0x00000171AA4AD000-memory.dmp
        Download

        memory/568-165-0x00000171A9810000-0x00000171AA4AD000-memory.dmp
        Download

        memory/568-164-0x00000171A9810000-0x00000171AA4AD000-memory.dmp
        Download

        memory/568-167-0x00000171A96E0000-0x00000171A96E1000-memory.dmp
        Download

        memory/568-163-0x00000171A96D0000-0x00000171A96D1000-memory.dmp
        Download