Overview

overview

8

Static

static

3

2026-08-08...ar.exe

windows10-2004-x64

7

2026-08-08...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    69s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 04:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_dc409770c1e0810a243ef2cf188c1aa3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  • Size 2.8MB
  • Sample260808-fdcgpshp7w
  • SHA256 88aab5909c89b869da5b4e93733bc44f6afcb3b5197ea826aa9db4d7f5759cf6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
ransomware

Malware Config

Signatures

  • Downloads MZ/PE file 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Opens file in notepad (likely ransom note) 8 IoCs
    ransomware
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_dc409770c1e0810a243ef2cf188c1aa3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_dc409770c1e0810a243ef2cf188c1aa3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
    1⤵
    • Downloads MZ/PE file
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3664
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\logs\patcherlog.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:2776
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\logs\patcherlog.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:1712
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\logs\patcherlog.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:6060
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\logs\patcherlog.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:4496
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\logs\patcherlog.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:5676
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\logs\patcherlog.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:5464
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\logs\patcherlog.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:1200
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\logs\patcherlog.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:3192

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        wonderland.mp3
        • Path C:\Users\Admin\AppData\Local\Temp\.patch_staging\files\bgm\wonderland.mp3
        • Size 3.9MB
        • SHA256 de6bee7f556d9c3b9a4989197153c59d7ed5ee015b8e905fec828fc5201fb6b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        patcherlog.txt
        • Path C:\Users\Admin\AppData\Local\Temp\logs\patcherlog.txt
        • Size 2KB
        • SHA256 c946f54bd9f45c042bf6ba66e7f12bb542dd02c6d15fa28b431365c3ac90c1f1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        patcherlog.txt
        • Path C:\Users\Admin\AppData\Local\Temp\logs\patcherlog.txt
        • Size 2KB
        • SHA256 ecff396aebcbe71bd8773b7ad7ba57e9b09e8e0a7539befc03e34e449f8e6ef3
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        patcherlog.txt
        • Path C:\Users\Admin\AppData\Local\Temp\logs\patcherlog.txt
        • Size 2KB
        • SHA256 2f899fccda8ab7ee66d00bd46110ec58357ff2702375522723d0560ac10c347c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        patcherlog.txt
        • Path C:\Users\Admin\AppData\Local\Temp\logs\patcherlog.txt
        • Size 1KB
        • SHA256 391f8ac69706e3d3853afb2bd956a41b84fb41f9bca926e5fd3e3c6ba35fac36
        • MD5 SHA1 SHA512 TLSH
        Submit Download