Analysis
- max time kernel
141s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 22:48
General
- Target 2026-09-25_9269531265fca0cc1fb2e42b786796cd_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe
- Size 819KB
- Sample260925-2rfl6sycph
- SHA256 5a9b45c9da0f29e50fd2a6f605078145651050d58bd60be3ea1b88005fb2b766
Malware Config
Signatures
- Executes dropped EXE 19 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 23 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 42 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies data under HKEY_USERS 41 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 18 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-25_9269531265fca0cc1fb2e42b786796cd_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-25_9269531265fca0cc1fb2e42b786796cd_cobalt-strike_icedid_mespinoza_njrat_ryuk_vidar.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\config\systemprofile\AppData\Roaming\240734437.tmp"C:\Windows\system32\config\systemprofile\AppData\Roaming\240734437.tmp"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\notepad.exe"C:\Windows\notepad.exe"3⤵
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\System32\GameInputSvc.exeC:\Windows\System32\GameInputSvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\GameInputSvc.exe"C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_12⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
elevation_service.exe
maintenanceservice.exe
7z.exe
7zFM.exe
7zG.exe
Uninstall.exe
AppVShNotify.exe
IntegratedOffice.exe
MavInject32.exe
OfficeC2RClient.exe
appvcleaner.exe
LICLUA.EXE
OSE.EXE
VSTOInstaller.exe
chrmstp.exe
setup.exe
chrome_pwa_launcher.exe
elevated_tracing_service.exe
elevation_service.exe
notification_helper.exe
os_update_handler.exe
chrome_proxy.exe
appletviewer.exe
extcheck.exe
idlj.exe
jabswitch.exe
jar.exe
jarsigner.exe
java-rmi.exe
java.exe
javac.exe
javadoc.exe
javafxpackager.exe
javah.exe
javap.exe
javapackager.exe
javaw.exe
javaws.exe
jcmd.exe
jconsole.exe
dotnet.exe
perfhost.exe
AgentService.exe
GameInputSvc.exe
Locator.exe
ssh-agent.exe
PerceptionSimulationService.exe
ReFsDedupSvc.exe
SearchIndexer.exe
SensorDataService.exe
TieringEngineService.exe
VSSVC.exe
alg.exe
msdtc.exe
snmptrap.exe
vds.exe
WmiApSrv.exe
wbengine.exe
240734437.tmp
memory/8-394-0x00007FF70F850000-0x00007FF70F904000-memory.dmp
memory/8-315-0x00007FF70F850000-0x00007FF70F904000-memory.dmp
memory/8-316-0x000001FBD3470000-0x000001FBD34D6000-memory.dmp
memory/8-317-0x000001FBD3470000-0x000001FBD34D6000-memory.dmp
memory/844-297-0x00007FF7F6E50000-0x00007FF7F6EFE000-memory.dmp
memory/844-298-0x000001FCC3770000-0x000001FCC37D6000-memory.dmp
memory/844-299-0x000001FCC3770000-0x000001FCC37D6000-memory.dmp
memory/844-380-0x00007FF7F6E50000-0x00007FF7F6EFE000-memory.dmp
memory/956-249-0x000002F1F5890000-0x000002F1F58F6000-memory.dmp
memory/956-250-0x000002F1F5890000-0x000002F1F58F6000-memory.dmp
memory/956-334-0x00007FF619230000-0x00007FF6192F9000-memory.dmp
memory/956-248-0x00007FF619230000-0x00007FF6192F9000-memory.dmp
memory/972-373-0x00007FF769430000-0x00007FF769B74000-memory.dmp
memory/972-291-0x0000027C09BD0000-0x0000027C09C36000-memory.dmp
memory/972-289-0x00007FF769430000-0x00007FF769B74000-memory.dmp
memory/972-290-0x0000027C09BD0000-0x0000027C09C36000-memory.dmp
memory/1508-390-0x00007FF6887A0000-0x00007FF6888CF000-memory.dmp
memory/1508-385-0x000001F6E2C80000-0x000001F6E2CE6000-memory.dmp
memory/1508-384-0x000001F6E2C80000-0x000001F6E2CE6000-memory.dmp
memory/1608-328-0x000001B131220000-0x000001B131286000-memory.dmp
memory/1608-327-0x000001B131220000-0x000001B131286000-memory.dmp
memory/1608-325-0x00007FF722760000-0x00007FF722A03000-memory.dmp
memory/1912-374-0x00000205BE190000-0x00000205BE1F6000-memory.dmp
memory/1912-375-0x00000205BE190000-0x00000205BE1F6000-memory.dmp
memory/1912-379-0x00007FF6EE030000-0x00007FF6EE537000-memory.dmp
memory/2352-25-0x0000026BA4BB0000-0x0000026BA4CE0000-memory.dmp
memory/2352-28-0x0000026BA4E30000-0x0000026BA4E96000-memory.dmp
memory/2352-27-0x0000026BA4E30000-0x0000026BA4E96000-memory.dmp
memory/2352-26-0x0000026BA4E30000-0x0000026BA4E96000-memory.dmp
memory/2464-257-0x000002488EC90000-0x000002488ECF6000-memory.dmp
memory/2464-343-0x00007FF79C510000-0x00007FF79C62A000-memory.dmp
memory/2464-253-0x00007FF79C510000-0x00007FF79C62A000-memory.dmp
memory/2464-258-0x000002488EC90000-0x000002488ECF6000-memory.dmp
memory/2508-367-0x000001C2E6E90000-0x000001C2E6EF6000-memory.dmp
memory/2508-366-0x000001C2E6E90000-0x000001C2E6EF6000-memory.dmp
memory/2508-365-0x00007FF6A03D0000-0x00007FF6A08A1000-memory.dmp
memory/2520-35-0x000001C4718C0000-0x000001C471926000-memory.dmp
memory/2520-34-0x000001C471670000-0x000001C4717A0000-memory.dmp
memory/2520-37-0x000001C4718C0000-0x000001C471926000-memory.dmp
memory/2948-45-0x000001D2A0230000-0x000001D2A0296000-memory.dmp
memory/2948-50-0x000001D2A0230000-0x000001D2A0296000-memory.dmp
memory/2948-52-0x00007FF68E2E0000-0x00007FF68E448000-memory.dmp
memory/2948-44-0x000001D2A0230000-0x000001D2A0296000-memory.dmp
memory/2948-43-0x00007FF68E2E0000-0x00007FF68E448000-memory.dmp
memory/3296-20-0x000002542DE50000-0x000002542DEB6000-memory.dmp
memory/3296-0-0x000002542DE50000-0x000002542DEB6000-memory.dmp
memory/3296-1-0x00007FF75DBD0000-0x00007FF75DD26000-memory.dmp
memory/3296-2-0x000002542DE50000-0x000002542DEB6000-memory.dmp
memory/3296-22-0x00007FF75DBD0000-0x00007FF75DD26000-memory.dmp
memory/3296-3-0x000002542DE50000-0x000002542DEB6000-memory.dmp
memory/3456-277-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/3456-278-0x0000000000A30000-0x0000000000A99000-memory.dmp
memory/3456-283-0x0000000000A30000-0x0000000000A99000-memory.dmp
memory/3456-364-0x0000000000400000-0x00000000004AE000-memory.dmp
memory/4088-337-0x0000020F9FAA0000-0x0000020F9FB06000-memory.dmp
memory/4088-336-0x0000020F9FAA0000-0x0000020F9FB06000-memory.dmp
memory/4088-335-0x00007FF76F900000-0x00007FF76FA95000-memory.dmp
memory/4164-324-0x00007FF619230000-0x00007FF6192F9000-memory.dmp
memory/4164-241-0x0000020494C00000-0x0000020494C66000-memory.dmp
memory/4164-240-0x0000020494C00000-0x0000020494C66000-memory.dmp
memory/4164-239-0x00007FF619230000-0x00007FF6192F9000-memory.dmp
memory/4380-61-0x00007FF7A5590000-0x00007FF7A56B3000-memory.dmp
memory/4380-11-0x00007FF7A5590000-0x00007FF7A56B3000-memory.dmp
memory/4380-12-0x00000236E7480000-0x00000236E74E6000-memory.dmp
memory/4380-14-0x00000236E7480000-0x00000236E74E6000-memory.dmp
memory/4380-13-0x00000236E7480000-0x00000236E74E6000-memory.dmp
memory/4852-268-0x00007FF600710000-0x00007FF60085A000-memory.dmp
memory/4852-355-0x00007FF600710000-0x00007FF60085A000-memory.dmp
memory/4852-271-0x00000135EAF70000-0x00000135EAFD6000-memory.dmp
memory/4852-270-0x00000135EAF70000-0x00000135EAFD6000-memory.dmp
memory/4976-395-0x000002005E7D0000-0x000002005E836000-memory.dmp
memory/4976-397-0x000002005E7D0000-0x000002005E836000-memory.dmp
memory/4976-396-0x00007FF7276A0000-0x00007FF7279DF000-memory.dmp
memory/5028-306-0x00000167F3080000-0x00000167F30E6000-memory.dmp
memory/5028-308-0x00000167F3080000-0x00000167F30E6000-memory.dmp
memory/5028-307-0x00007FF6BED00000-0x00007FF6BF117000-memory.dmp
memory/5028-389-0x00007FF6BED00000-0x00007FF6BF117000-memory.dmp
memory/5804-356-0x0000025190AF0000-0x0000025190B56000-memory.dmp
memory/5804-357-0x00007FF64F530000-0x00007FF64F7BB000-memory.dmp
memory/5804-358-0x0000025190AF0000-0x0000025190B56000-memory.dmp
memory/5932-352-0x00007FF6911E0000-0x00007FF691501000-memory.dmp
memory/5932-350-0x000001F7600D0000-0x000001F760136000-memory.dmp
memory/5932-344-0x000001F7600D0000-0x000001F760136000-memory.dmp
memory/5932-349-0x00007FF6911E0000-0x00007FF691501000-memory.dmp
memory/5932-345-0x000001F7600D0000-0x000001F760136000-memory.dmp
memory/5968-56-0x0000025780D00000-0x0000025780D66000-memory.dmp
memory/5968-57-0x0000025780D00000-0x0000025780D66000-memory.dmp
memory/5968-55-0x0000025780AB0000-0x0000025780BE0000-memory.dmp
memory/6104-69-0x0000027C9E460000-0x0000027C9E520000-memory.dmp