Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
08/08/2026, 03:47
General
- Target 2026-08-08_3af09e3911f38af0e22f03bab68fa100_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
- Size 1.6MB
- Sample260808-ecf8tszbrd
- SHA256 fc09b7c84e97f5be64010f0e9bf0e2458dc8abffb62e6689ea65dca2f316a376
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 4 IoCs
- Drops file in Program Files directory 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_3af09e3911f38af0e22f03bab68fa100_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_3af09e3911f38af0e22f03bab68fa100_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
OSE.EXE
elevation_service.exe
alg.exe
memory/1072-44-0x00000188A3F00000-0x00000188A3F66000-memory.dmp
memory/1072-43-0x00000188A3F00000-0x00000188A3F66000-memory.dmp
memory/1072-42-0x00007FF7DC2E0000-0x00007FF7DC447000-memory.dmp
memory/1072-49-0x00000188A3F00000-0x00000188A3F66000-memory.dmp
memory/1072-51-0x00007FF7DC2E0000-0x00007FF7DC447000-memory.dmp
memory/4072-22-0x00007FF770F50000-0x00007FF771333000-memory.dmp
memory/4072-19-0x000002879A0E0000-0x000002879A146000-memory.dmp
memory/4072-0-0x00007FF770F50000-0x00007FF771333000-memory.dmp
memory/4072-2-0x000002879A0E0000-0x000002879A146000-memory.dmp
memory/4072-3-0x000002879A0E0000-0x000002879A146000-memory.dmp
memory/4072-1-0x000002879A0E0000-0x000002879A146000-memory.dmp
memory/4844-33-0x00000256C1910000-0x00000256C1A0B000-memory.dmp
memory/4844-34-0x00000256C1B30000-0x00000256C1B96000-memory.dmp
memory/4844-36-0x00000256C1B30000-0x00000256C1B96000-memory.dmp
memory/4844-35-0x00000256C1B30000-0x00000256C1B96000-memory.dmp
memory/5132-54-0x00000208C5360000-0x00000208C545B000-memory.dmp
memory/5132-56-0x00000208C55B0000-0x00000208C5616000-memory.dmp
memory/5132-55-0x00000208C55B0000-0x00000208C5616000-memory.dmp
memory/5208-27-0x000001FC46E60000-0x000001FC46EC6000-memory.dmp
memory/5208-26-0x000001FC46E60000-0x000001FC46EC6000-memory.dmp
memory/5208-25-0x000001FC46C40000-0x000001FC46D3B000-memory.dmp
memory/5744-14-0x0000020589ED0000-0x0000020589F36000-memory.dmp
memory/5744-13-0x0000020589ED0000-0x0000020589F36000-memory.dmp
memory/5744-12-0x0000020589ED0000-0x0000020589F36000-memory.dmp
memory/5744-11-0x00007FF711840000-0x00007FF711961000-memory.dmp
memory/5744-60-0x00007FF711840000-0x00007FF711961000-memory.dmp